topic Re: Run rules as system user in Alfresco Archive

Run rules as system user

sebp — Tue, 11 May 2010 10:03:15 GMT

Is there an option to run rules as system user? I have the following use case:There is a Boss' Mail folder and nobody instead of the boss herself should see the contents of that folder. But some secretaries should be able to scan into that folder. I thought I:1. create a "For Boss" folder where secr

Re: Run rules as system user

brian_robinson — Thu, 13 May 2010 05:19:04 GMT

The problem you have is one of ownership. When the secretary adds the document, they own it, and thus have full rights to do whatever they want with it, even if a content rule moves it somewhere else. Try executing a script (server side java script) that changes the ownership to a system user (perhaps one that you create that no human knows the password for).

Re: Run rules as system user

sebp — Thu, 20 May 2010 09:24:04 GMT

Hi Brian, thanks for the reply. But the problem is that the rule can't move the content, since the rule is executed with the user rights of the secretary.

Re: Run rules as system user

neilm — Mon, 25 Oct 2010 11:15:17 GMT

There's no option in the UI to run an action as another user. That would be a security risk, I think.

But you can do it within the implementation of your action. If your action is Java-based (and it only works for Java-based actions) you need to wrap the copy code up in an AuthenticationUtil.runAs() call. Have a look at AbstractRenderingEngine.java (~line 400) for an example. It should look something like this:


AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork<Void>()
   {
      public Void doWork() throws Exception
         {
            // Do your work here…
            return null;
         }
   }, AuthenticationUtil.getSystemUserName());
‍‍‍‍‍‍‍‍‍‍

But this is powerful code. The work being done within the doWork will be done as "system" with system privileges. You should do as little work as possible within that block - only the part that is strictly necessary. The rest can be done as the currently authenticated user in the normal way.