topic Re: AccessDeniedException in Alfresco Archive

AccessDeniedException

luca — Fri, 25 Sep 2009 09:00:13 GMT

Hi,I have a permission problem: sometimes the Web Client return AccessDeniedException after updates from WebServicesrg.alfresco.repo.security.permissions.AccessDeniedException: Access Denied. You do not have the appropriate permissionsto perform this operation.caused by:net.sf.acegisecurity.Access

Re: AccessDeniedException

luca — Mon, 05 Oct 2009 14:13:40 GMT

Hi All,
it seems that all the problem it is caused from ExternalAccessServlet.

I don't know if it is a bug or a wrong configuration, but it seems that if I try to access directly to it, it doesn't call the login page if the user is'nt already logged.
For example:
/alfresco/navigate/browse/webdav/myFolder

I use CAS to authenticate users.

Can Anyone help?

Re: AccessDeniedException

luca — Wed, 07 Oct 2009 10:13:11 GMT

I found that the /navigate/* urls were not under the CAS filter, so the user couldn't authenticate resulting in ADE Exception.

Now I add it, but it result in an infinite loop! :shock:

I found that the ExternalAccessServlet, after a correct authentication through the CAS filter, resend me to the login page, which call the CAS filter again who found that the user is authenticated and so it resend me to the page that I called first, so I return to the ExternalAccessServlet to start the round again. :cry:

Now I'll see if there is a solution, if anyone has an idea, please help!

Re: AccessDeniedException

luca — Fri, 09 Oct 2009 09:51:58 GMT

I have inspected more deep into the code and I found that the problem is that the ExternalAccessServlet try to authenticate the user using the ticket sent from the cas, but it doesn't find any Alfresco ticket in its cache and throws an ADE Exception.

Does anyone have similar problem?

Re: AccessDeniedException

jdbrown — Fri, 18 Dec 2009 21:03:36 GMT

Are you clustering the Alfresco ticketCache? See /extension/ehcache-custom.sample.cluster.xml. I think that would be needed since CAS may get ticket against Alf1 and then your servlet tries to authenticate against Alf2.