topic Re: Action with setRunAsUser in Alfresco Archive

Action with setRunAsUser

dranakan — Fri, 15 Apr 2011 09:47:18 GMT

Hello,It is useful to clear the permissions if we use the setRunAsUserbefore the end of an action (security reason) ?MyActionString currentUser = AuthenticationUtil.getRunAsUser();…AuthenticationUtil.setRunAsUser(AuthenticationUtil.getAdminUserName());AuthenticationUtil.setFullyAuthenticatedUser(Aut

Re: Action with setRunAsUser

mrogers — Fri, 15 Apr 2011 09:55:18 GMT

Its much safer to use AuthenticationUtil.runAs which will always clean up after itself.

And yes you should clean up after yourself after fiddling with the authentication context so your code above needs try/finally blocks.

Re: Action with setRunAsUser

dranakan — Fri, 15 Apr 2011 12:03:23 GMT

Thank you mrogers.

My action move a file and creates some directories. I would like that the user that start the action have no access to theses directories file.
I used setFullyAuthenticatedUser and the creator was admin. But now… how can I do with runas ?

public void executeImpl(final Action actionF, final NodeRef actionedUponNodeRefF) {
      if (logger.isDebugEnabled()) {
         logger.debug("Action : OrganizeFileInDirectory");
      }
      // Check that the node still exists
      if (this.nodeService.exists(actionedUponNodeRefF) == true) {

         try {         
            AuthenticationUtil.runAs(
                  new AuthenticationUtil.RunAsWork<Object>() {
                  public Object doWork() throws Exception {
                  
            
            UserTransaction trx_A = serviceRegistry.getTransactionService()
                  .getUserTransaction();
            try {
               trx_A.begin();
               // Move files
                moveFile(…);
               trx_A.commit();
            } catch (Throwable e) {
               try {
                  if (trx_A.getStatus() == Status.STATUS_ACTIVE) {
                     trx_A.rollback();
                  }
               } catch (Throwable ee) {
                  // Handle double exception in whatever way is
                  // appropriate eg. log it
                  logger.error("", e);
               }

               logger.error("", e);
            }
            return null;
         }},"admin");

         } catch (Exception e) {
            if (logger.isDebugEnabled()) {
               logger.error("", e);
            }
         }

         if (logger.isDebugEnabled()) {
            logger.debug("End");

         }
      }
   }‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Action with setRunAsUser

mrogers — Fri, 15 Apr 2011 12:29:59 GMT

That code looks on the right sort of lines. What's the problem?

And while you are at it you should be using the same pattern with the RetryingTransactionHelper rather than attempting to manage the transactions yourself. In fact do you need the transaction handling at all?

Re: Action with setRunAsUser

dranakan — Fri, 15 Apr 2011 12:55:56 GMT

That code looks on the right sort of lines. What's the problem?

The directories and the files that the method creates have properties "creator" and "modifier" by the user. He has all rights on theses directories/files and I want he can not have access.
I can also set owner = admin but could I do by another way ? (avoid to set owner on each nodes)

And while you are at it you should be using the same pattern with the RetryingTransactionHelper rather than attempting to manage the transactions yourself. In fact do you need the transaction handling at all?

I used this before but I got problems… I have never found but using another method (with UserTransaction) and all was working…

Re: Action with setRunAsUser

mrogers — Fri, 15 Apr 2011 13:23:31 GMT

You may want to run your code as "system" rather than "admin".

AuthenticationUtil.getSystemUserName()

Re: Action with setRunAsUser

dranakan — Fri, 15 Apr 2011 13:37:10 GMT

Thank you.

UsingAuthenticationUtil.runAs(…, "system")… does not change the properties "Creator" and "Modifier" on the new directories/files.

However, if I set the owner, (in the action) the propertie on the file is "system". I would like to avoid using setting the owner. Only set "creator" and "modifier". Or this is the recommanded way in this situation ? (remove right on nodes)

Re: Action with setRunAsUser

dranakan — Tue, 03 May 2011 06:39:12 GMT

Instead of adding the owner on each node to remove user permissions, I use "setFullyAuthenticatedUser" inside the runAs. New node created in my method "moveFile" will have "system" as "creator" and "modifier".


AuthenticationUtil.runAs(
                  new AuthenticationUtil.RunAsWork<Object>() {
                  public Object doWork() throws Exception {
            UserTransaction trx_A = serviceRegistry.getTransactionService()
                  .getUserTransaction();
            try {
               trx_A.begin();
               AuthenticationUtil.setFullyAuthenticatedUser(AuthenticationUtil.getSystemUserName());
               // Move files
                moveFile(…);
               trx_A.commit();
            } catch (Throwable e) {
               try {
                  if (trx_A.getStatus() == Status.STATUS_ACTIVE) {
                     trx_A.rollback();
                  }
               } catch (Throwable ee) {
                  // Handle double exception in whatever way is
                  // appropriate eg. log it
                  logger.error("", e);
               }

               logger.error("", e);
            }
            return null;
         }},AuthenticationUtil.getSystemUserName());
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍