topic Re: Giving a user access to administration console in Alfresco Archive

Giving a user access to administration console

p3d3r0s0 — Fri, 07 May 2010 09:14:14 GMT

Is this possible? Without giving the user the admin role? I want to give a user access to the administration console and be able to do all options there but not be able to access the dictionary path. Is this possible?Best reguards,Pedro

Re: Giving a user access to administration console

p3d3r0s0 — Fri, 07 May 2010 10:34:25 GMT

By changing the titlebar.jsp i was able to give access to the administration console, but i cant add users or do any of the other operations because i dont have permission. Where is the permission verification made?

Re: Giving a user access to administration console

ebogaard — Fri, 07 May 2010 11:12:51 GMT

This is about the same I'm looking for. (http://forums.alfresco.com/en/viewtopic.php?f=9&t=26656)
Couldn't find anything in manuals or forums. Haven't got an answer on my post either.

Re: Giving a user access to administration console

savic_prvoslav — Fri, 07 May 2010 12:03:57 GMT

You can do this by editing :
web.xml
Admin Authentication Filter ( you can remove the usage of admin filter , this would be wrong idea, but you can do this)

class rg.alfresco.web.app.servlet.AdminAuthenticationFilter , this class checks if current user is admin or not .

you can create some cind of group for "admin" users and checking this in the class adminAuthfilter if they are in this group then give them access.

Re: Giving a user access to administration console

p3d3r0s0 — Fri, 07 May 2010 14:11:29 GMT

you can create some cind of group for "admin" users and checking this in the class adminAuthfilter if they are in this group then give them access.

that seems ideal, but i still needed to remove the access to the dictionary space and i think that if i make a user an admin, i cant stop him from accessing a space.

i tried removing these fields:

You can do this by editing :
web.xml
Admin Authentication Filter ( you can remove the usage of admin filter , this would be wrong idea, but you can do this)

class rg.alfresco.web.app.servlet.AdminAuthenticationFilter , this class checks if current user is admin or not .

but i still couldnt create a user using with a user that wasnt an admin.

Am i missing something?

Re: Giving a user access to administration console

savic_prvoslav — Fri, 07 May 2010 15:19:05 GMT

Well , you need to do some coding for this.
for instance:

‍

you have to code in that class ( you would replace that class with your own and inherit it ) next:
if current user in in group : LIKE_ADMIN_GROUP filter it.

and you create in alfresco group LIKE_ADMIN_GROUP and this should do it.**

** this filter like authentification filter filters who has access to what .


if (isAdmin)
      {
//add hire : 
//get all users from that group
authorities = this.getAuthorityService()
         .getContainedAuthorities(AuthorityType.USER,
            "GROUP_NAME_GROUP", immediate);
//get current user
String currentUserName=Application.getCurrentUser(FacesContext.getCurrentInstance()).getUserName();

//check if current user is in this group
for (String authority : authorities) {
NodeRef ref = this.getPersonService().getPerson(authority);

String userName= this.getNodeService().getProperty(ref, ContentModel.PROP_USERNAME);

if(userName.equals(currentUserName))//current user is in this group
{
  chain.doFilter(req, res);
}

}


this sould do it, you would have acces to admin parts, 
 also you can create multiple filters, and define some kind of security for your self. 

So have funn coding this out, but I think this is more or less what you need to make it nice and net .

PS: change classs of filter admin authentification filter according to what you jave coded out.








         chain.doFilter(req, res); //if is admin go to the page like /jsp/admin/….
      }
      else
      {
            httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN); //return 403
         }
        
      }

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Giving a user access to administration console

ebogaard — Sat, 08 May 2010 16:42:37 GMT

It looks like this is what I was looking for, but the problem is that the post isn't complete / is malformed.
And I'm afraid I would like some more detailed instructions on how to do this.

Savic, could you edit your post to make it complete and maybe give some more hints?
Thanks!

Re: Giving a user access to administration console

savic_prvoslav — Sun, 09 May 2010 14:20:43 GMT

I have thought that you are programmer.
I will send you code soon( monday or tuesday) and I guess you will have solved problem. If this time frame is ok, if not you could $$ to someone to get you the code faster.

send me the version of your alfresco.

Re: Giving a user access to administration console

p3d3r0s0 — Mon, 10 May 2010 10:36:24 GMT

Just checking, is this coding process made on eclipse? will i have to make a java class for this purpose or can this be done in a jsp or xml file?

Re: Giving a user access to administration console

savic_prvoslav — Mon, 10 May 2010 10:43:10 GMT

This is done in eclipse.

Re: Giving a user access to administration console

p3d3r0s0 — Tue, 11 May 2010 11:27:49 GMT

To anyone that might interested in having an example of java code, i have found this site:
http://ecmarchitect.com/archives/2009/07/30/1023

in it theres a link in which you can download the source code for some examples (All of the above, combined (~28.1 MB, Download))

Now, its just a matter of understanding how the class system works and what methods one needs to suit our purposes(hopefully it wont be a horrible experience ).

Re: Giving a user access to administration console

savic_prvoslav — Tue, 11 May 2010 13:19:55 GMT

you wont go far with this, let me tell you that. These are just basic examples of what you can do in alfresco , but this is god starting point. Buy a book too .

Re: Giving a user access to administration console

p3d3r0s0 — Tue, 11 May 2010 15:16:50 GMT

I was trying to do a bit of coding on the AdminAuthenticationFilter class based on what savic.prvoslav put here, but i cant get the current users group, i tried the
this.getAuthorityService().getContainedAuthorities(AuthorityType.USER,"GROUP_NAME_GROUP", immediate); method, but AdminAuthenticationFilter doesnt have that method nor do i know how to implement it. Is there another way to know if a certain user belongs to a group?

Re: Giving a user access to administration console

savic_prvoslav — Tue, 11 May 2010 18:45:41 GMT

package org.alfresco.docassistent.filter;

import java.io.IOException;
import java.util.Set;

import javax.faces.context.FacesContext;
import javax.servlet.FilterChain;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.repository.NodeService;
import org.alfresco.service.cmr.security.AuthorityService;
import org.alfresco.service.cmr.security.AuthorityType;
import org.alfresco.service.cmr.security.PersonService;
import org.alfresco.web.app.Application;
import org.alfresco.web.app.servlet.AdminAuthenticationFilter;
import org.alfresco.web.app.servlet.AuthenticationHelper;
import org.alfresco.web.bean.repository.Repository;
import org.alfresco.web.bean.repository.User;

public class CustomAdminAuthenticationFilter extends AdminAuthenticationFilter {

    @Override
    public void doFilter(ServletRequest httpRequest,
       ServletResponse httpResponse, FilterChain chain)
       throws IOException, ServletException {

   User user = AuthenticationHelper.getUser(
      (HttpServletRequest) httpRequest,
      (HttpServletResponse) httpResponse);
   boolean isAdmin = (user != null && user.isAdmin());

   if (!isAdmin) {

       ServletContext context = ((HttpServletRequest) httpRequest)
          .getSession().getServletContext();
       AuthorityService authorityService = Repository.getServiceRegistry(
          context).getAuthorityService();
       PersonService personService = Repository
          .getServiceRegistry(context).getPersonService();
       NodeService nodeService = Repository.getServiceRegistry(context)
          .getNodeService();

       // Set<String> test = authorityService
       // .getAllAuthorities(AuthorityType.GROUP);
       // for (String authority : test) {
       // System.out.println(authority);
       // }

       Set<String> authorities = authorityService.getContainedAuthorities(
          AuthorityType.USER, "GROUP_NAME_GROUP", true);
       // get current user
       String currentUserName = Application.getCurrentUser(
          FacesContext.getCurrentInstance()).getUserName();

       // check if current user is in this group
       for (String authority : authorities) {

      NodeRef ref = personService.getPerson(authority);

      String userName = (String) nodeService.getProperty(ref,
         org.alfresco.model.ContentModel.PROP_USERNAME);

      if (userName.equals(currentUserName))// current user is in this
      // group
      {
          chain.doFilter(httpRequest, httpResponse);

      }

       }
       super.doFilter(httpRequest, httpResponse, chain);
   } else {
       super.doFilter(httpRequest, httpResponse, chain);
   }
    }

}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

change web.xml,
change /jsp/parts/titlebar.jsp to see action with "dialog:adminConsole". this sould work fine, if not minor fix would do it.

in alfresco create goup "NAME_GROUP" and put "admins" in it.

Re: Giving a user access to administration console

p3d3r0s0 — Wed, 12 May 2010 09:53:11 GMT

I added this code in the titlebar.jsp:

<a:stringEqualsEvaluator value="#{NavigationBean.currentUser.userName}" condition="user1@ecm.alfresco.com">
<a:actionLink value="#{msg.admin_console}"
image="/images/icons/admin_console.gif"
showLink="false"
action="dialog:adminConsole"
id="alf_admin_console" />
</a:stringEqualsEvaluator>

it works well, but only for a specific user, i dont know how to access usergroups on a .jsp

Thank you very much for the code savic.prvoslav, I was trying to use it, but from what i know, i have to create a project with the CustomAdminAuthenticationFilter.java make a src/java source folder, config, data, src/web/jsp, src/web/META-INF folders and make a build.properties and a build.xml.

for the build.properties i put in it:
alfresco.sdk.dir=C:/alfresco-community-sdk-3.3
alfresco.web.dir=C:/Alfresco/tomcat/webapps/alfresco

I dont know what to put in the build.xml file ops:

and as for the web.xml i have changed:
   <filter>
      <filter-name>Admin Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.app.servlet.AdminAuthenticationFilter</filter-class>
   </filter>

to

   <filter>
      <filter-name>Admin Authentication Filter</filter-name>
      <filter-class>org.alfresco.docassistent.filter.CustomAdminAuthenticationFilter</filter-class>
   </filter>

Is everything correct?
What do i put in the build.xml file?

Re: Giving a user access to administration console

savic_prvoslav — Wed, 12 May 2010 11:09:45 GMT

Give me email I will send you jar for this so you do not have to spend time on this.

everything is good except:

<a:stringEqualsEvaluator value="#{NavigationBean.currentUser.userName}" condition="user1@ecm.alfresco.com"> //this means: if current user is user1… then render it.
it is wrong, I will send you the code for this to say: if user is in group for like admin users then render, no problem at all. for now just remove this so all users can see , we will change this letter.
<a:actionLink value="#{msg.admin_console}"
image="/images/icons/admin_console.gif"
showLink="false"
action="dialog:adminConsole"
id="alf_admin_console" />
</a:stringEqualsEvaluator>

Re: Giving a user access to administration console

p3d3r0s0 — Thu, 13 May 2010 15:41:25 GMT

Its working at last. (joy!!)
To someone that might want to do something similar, i advise you to import the customLogin project to eclipse from the site i mentioned somewhere in the previous page, then do:

1-Make a MyClass in a org.alfresco.sample with this as its content:

package org.alfresco.sample;

import javax.faces.context.FacesContext;

import org.alfresco.repo.security.authentication.AuthenticationUtil;
import org.alfresco.web.app.Application;

public class MyClass extends org.alfresco.web.bean.users.CreateUserWizard
{

       private static final long serialVersionUID = 1L;
       
       @Override
       protected String finishImpl(FacesContext arg0, String arg1) throws Exception
       {
               //GetSuccessItemsTable getSuccessItemsTable = new GetSuccessItemsTable(this, arg0, arg1);
               String tenant = Application.getCurrentUser(FacesContext.getCurrentInstance()).getUserName().split("@")[1];

               AuthenticationUtil.setRunAsUser("admin@" + tenant);
                     try {
                        return super.finishImpl(arg0, arg1);
                     } catch (Throwable e) {
                  // TODO Auto-generated catch block
                  e.printStackTrace();
               }
               return null;
       }
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

2-Create a build.properties with this as its content:
alfresco.sdk.dir=C:/alfresco-community-sdk-3.3
alfresco.web.dir=C:/Alfresco/tomcat/webapps/alfresco

replace both paths with the ones you use.

3-Right click on your project and export as jar.

4-Place the Jar in the (in my case) "C:\Alfresco\tomcat\webapps\alfresco\WEB-INF\lib" dir

5-Change:
      <managed-bean-name>CreateUserWizard</managed-bean-name>
      <managed-bean-class>
         org.alfresco.web.bean.users.CreateUserWizard
      </managed-bean-class>

to

      <managed-bean-name>CreateUserWizard</managed-bean-name>
      <managed-bean-class>
         org.alfresco.sample.MyLoginClass
      </managed-bean-class>

in the C:\Alfresco\tomcat\webapps\alfresco\WEB-INF\faces-config-beans.xml .

6-Start Alfresco and now, if you have changed the "C:\Alfresco\tomcat\webapps\alfresco\jsp\parts\titlebar.jsp" file to what i have in a previous post then that user, in my case user1@ecm.alfresco.com, will now be able to see the admin console and create users.

7-???

8-PROFIT!!

I have to thank savic.prvoslav for his time and patient, still owe you a beer.

Re: Giving a user access to administration console

p3d3r0s0 — Thu, 13 May 2010 15:46:17 GMT

Actually now i just need to know how to do this:
<a:stringEqualsEvaluator value="#{NavigationBean.currentUser.userName}" condition="user1@ecm.alfresco.com">

but instead of only letting user1 see the admin console link i would like to let a whole group see the link. Any hints?

Re: Giving a user access to administration console

savic_prvoslav — Thu, 13 May 2010 15:46:32 GMT

Do not think that I have forgotten.

String username = Application.getCurrentUser(FacesContext.getCurrentInstance()).getUserName();
if(username.contans("@"))
{
String tenant= Application.getCurrentUser(FacesContext.getCurrentInstance()).getUserName().split("@")[1];
AuthenticationUtil.setRunAsUser("admin@" + tenant);
}else {

AuthenticationUtil.setRunAsUser("admin");
}‍‍‍‍‍‍‍‍‍

Re: Giving a user access to administration console

p3d3r0s0 — Thu, 13 May 2010 16:00:08 GMT

I was talking about this code in the titlebar.jsp file:

<a:stringEqualsEvaluator value="#{NavigationBean.currentUser.userName}" condition="user1@ecm.alfresco.com">
<a:actionLink value="#{msg.admin_console}"
image="/images/icons/admin_console.gif"
showLink="false"
action="dialog:adminConsole"
id="alf_admin_console" />
</a:stringEqualsEvaluator>‍‍‍‍‍‍‍

i just wanted to change the user1@ecm.alfresco.com to something like MYGROUP
So that only people from the MYGROUP group could see the adminconsole.

What do i have to put in the value field?