I've getting a warning on the security overview. I have no idea how to resolve this. There is a reset button at the top of the 'Authenticated user page. Is this the answer. I'd really appreciate guidance. Thank you.
| Default role for all users | Critical | The default user role "Authenticated user" is incorrectly defined! |
Had the same issue, clicked the reset button. The flag went away and Im "ok" now.
Hi, I have the same Critical Warning for using authenticated user as the default role. Did I read somewhere this is actually a bug? Where is the reset button mentioned please?
Hi Nick,
As far as I know there is no bug with the critical warning.
I checked things out and discovered that when mobile web services are enabled on a site (for Moodle Mobile app users), the security overview report shows the default role for all users with status 'Critical' due to the webservice capabilities being allowed for the authenticated user role.
Hopefully the documentation report/security/report_security_check_defaultuserrole explains things (including where to find the reset role button!) though if anything remains unclear, please say so, then the text can be improved.
Thank you Helen, I hadn't come across that documentation before now. Very useful.
Having determined that's why the critical flag is showing I think it would be useful for the documentation to say if one needs be concerned about it. It doesn't go as far as providing the reassurance that the flag can be ignored (if indeed it can be) if your web service is enabled and only the two associated capabilities are active.
As such it just states that's why the flag appears and I'm left wondering a little is that good, is that bad, do I need to do anything?
Thanks Nick for your reply. I'm glad to hear you found the documentation useful. You couldn't have come across it before, as I wrote it after reading your post and realising some explanation was needed.
I was also left wondering about the critical flag (not something you would normally just ignore) and so I created a tracker issue - MDL-50613 - for us to review the situation. In the meantime, you may find Juan's comments in the issue of help in understanding things a bit more.
Perfect, thanks Helen. I shall watch the Tracker with interest.
Good news: MDL-50613 has now been fixed in Moodle 2.8.9 and 2.9.3 (due for release on 9 November 2015), meaning when mobile web services are enabled the security overview report no longer shows the default role for all users with status 'Critical'.
