topic Re: Authentication on CMIS with non-admin user in Alfresco Archive

Authentication on CMIS with non-admin user

frank_miller — Mon, 30 Jan 2012 17:55:14 GMT

Hi!I'm having an issue trying to authenticate on CMIS with a non-admin user. Finally, I tried to do a simple get request, and I get this response…org/springframework/extensions/webscripts/scriptdump.get requires admin authentication; however, a non-admin has attempted accessdoes this mean only admin

Re: Authentication on CMIS with non-admin user

jpotts — Mon, 30 Jan 2012 22:05:15 GMT

Non-admin users should definitely be able to connect via CMIS and do anything the permissions are set to allow them to do.

Can you share with us some specifics such as:
- Alfresco server version
- Client you are using
- Binding you are using (Atom Pub versus Web Services)
- Specific code you are using that is failing
- Any exceptions you are seeing in the log

Jeff

Re: Authentication on CMIS with non-admin user

frank_miller — Tue, 31 Jan 2012 16:55:22 GMT

Thanks for the quick response Jeff.

I don't think this is a specific Alfresco version issue (tried on 3.4 and 4.0). Actually, I'm using an opensource api written in ruby (ActiveCMIS). I get a little lost understanding the procedure to connect to CMIS, but debugging the code I reach to the following request.

http://.../alfresco/service/cmis/arg/n?noderef=workspace%3A%2F%2FSpacesStore%2F68c3c179-7027-466a-ad4b-9b0d64e06ab9&filter=&includeAllowableActions=true&includePolicyIds=&includeRelationships=&includeACL=true&renditionFilter=*

which returns a 500 server exception. I include some log lines.-

net.sf.acegisecurity.AccessDeniedException - Access is denied.

org.springframework.extensions.webscripts.WebScriptException - 00310007 Wrapped Exception (with status template): 00310014 Error during processing of the template

org.springframework.extensions.webscripts.AbstractWebScript.createStatusException(AbstractWebScript.java:758)

I hope this information could be useful. Please, let me know if I can provide any other relevant information.

Thanks!

Re: Authentication on CMIS with non-admin user

jpotts — Tue, 31 Jan 2012 17:09:31 GMT

Without seeing the code it is hard to say, but it sounds like you might not be passing in the credentials in the header. When connecting to CMIS, you can either use basic authentication or you can use an Alfresco ticket. Tickets get passed in through an "alf_ticket" argument, so you clearly aren't doing that.

The auth header needs to be set on every request.

You could test your call using curl. For example, you should be able to do:

curl -uSomeUseromePassword "http://.../alfresco/service/cmis/arg/n?noderef=workspace%3A%2F%2FSpacesStore%2F68c3c179-7027-466a-ad4b-9b0d64e06ab9&filter=&includeAllowableActions=true&includePolicyIds=&includeRelationships=&includeACL=true&renditionFilter=*"

And have that come back successfully. If you get the same response you are currently seeing, then you might be able to assume that the user and password you are using doesn't have the permissions to hit the node you are trying to hit.

If it works, but your Ruby code fails, you might be able to assume that the Ruby code is screwing up the auth somewhere.

Jeff

Re: Authentication on CMIS with non-admin user

frank_miller — Tue, 31 Jan 2012 18:13:09 GMT

You're right! The problem was indeed the user didn't have permissions to read that node (silly me! ops: )

Thank you very much Jeff!

Re: Authentication on CMIS with non-admin user

frank_miller — Sat, 11 Feb 2012 12:34:46 GMT

Hi!

my problem now is that the api I'm using needs to get repository info before performing any other operation. Then, through repository object, it gets several templates for getting objects by id, by path, … (I understand the reason is the urls may vary depending on the CMS I'm connecting) But when I try this steps with a user without access to root folder, I get a forbidden exception. Is it possible for a non-admin user to retrieve repository info?

EDITED:

also, trying to connect to the home space of a given user, if the user does not have permissions to company home, I get a forbidden exception. The url looks like…

curl -uUserassword "http://localhost/alfresco/service/cmis/arg/n?noderef=workspace%3A%2F%2FSpacesStore%2Fd96b2971-c718-4e0f-9b6e-e9dc68804341"

this url returns me the node, only when the user has permissions to read company home. This doesn't make much sense to me, so I'm pretty sure I'm missing something obvious here. Please, any advice would be really appreciated.

Best regards.

Re: Authentication on CMIS with non-admin user

jpotts — Tue, 14 Feb 2012 16:55:54 GMT

I don't think you need access to Company Home to get the repository information. To confirm that, I went into my Alfresco 4.0.d Community repository and removed the EVERYONE group from Company Home. I then used cmislib to connect as a test user (non-admin) and successfully retrieved the repository information:

>>> from cmislib.model import CmisClient
>>> client = CmisClient('http://localhost:8080/alfresco/cmisatom', 'tuser1', 'password')
>>> repo = client.defaultRepository
>>> repo.getRepositoryInfo()
{u'aclCapability': None, u'cmisVersionSupported': u'1.0', u'principalAnonymous': u'guest', u'principalAnyone': u'GROUP_EVERYONE', u'repositoryDescription': u'Main Repository', u'changesOnType': u'cmis:folder', u'changesIncomplete': u'true', u'productVersion': u'4.0.0 (4003)', u'rootFolderId': u'workspace://SpacesStore/98f66c7a-b300-48b9-b35f-8695b8ca22b8', u'repositoryId': u'558e5b3c-71a0-42ac-b420-eda16e93e95b', u'repositoryName': u'Main Repository', u'vendorName': u'Alfresco', u'productName': u'Alfresco Repository (contentUrl=|mimetype=|size=0|encoding=|locale=en_US_|id=120)'}
‍‍‍‍‍‍

However, as you mentioned, when attempting to retrieve the properties of tuser1's home directory, I got a permission denied. That's because the user's home directory sits in "User Homes" and tuser1 has no access to User Homes–User Homes inherits its perms from Company Home. When I made the EVERYONE group a consumer on User Homes, the tuser1 user was able to get to his home directory.

What's going on is that the properties of an object include some properties related to the parent. If the user has no access to the parent, the calls fail. You can work around this by providing a filter that lists only the properties you need and excludes any parent-related properties.

For example, if tuser1 has no access to the User Homes folder, the following call will fail with a PermissionDeniedException:

home = repo.getObjectByPath('/User Homes/tuser1')‍

But this call, which excludes properties like cmisarentObjectId and cmisath will successfully retrieve the object:

home = repo.getObjectByPath('/User Homes/tuser1', filter="cmis:creationDate,cm:owner,cmis:changeToken,cm:description,cmis:objectId,cmis:objectTypeId,cmis:lastModifiedBy,cmis:name,cmis:createdBy,cmis:baseTypeId")‍

Jeff

Re: Authentication on CMIS with non-admin user

frank_miller — Wed, 15 Feb 2012 12:35:14 GMT

Thank you very much for your detailed response Jeff.

I think I understand now most of the issues I was having accessing different folders. Anyway, I'm still not able to obtain repository info with a user without Company Home access. I'm trying this url directly on a web browser.-

http://alfrescoserver/alfresco/service/cmis

(which is the url that my ruby component uses to get repo info), it asks me for user/pass; if I introduce a user without access to Company Home, I get a 500 again. Perhaps this is not the right url to access to repository info?

Best regards.

Re: Authentication on CMIS with non-admin user

jpotts — Wed, 15 Feb 2012 17:26:19 GMT

Starting with Alfresco 4, the web script based CMIS implementation (http://localhost:8080/alfresco/service/cmis) is deprecated. Where possible, you should use the OpenCMIS implementation instead (http://localhost:8080/alfresco/cmisatom).

In a quick test using curl, I noticed that when a user does not have access to Company Home, the old implementation fails while the new implementation succeeds.

Jeff

Re: Authentication on CMIS with non-admin user

frank_miller — Wed, 15 Feb 2012 22:04:57 GMT

Thanks Jeff, it's good to know

I'll give it a try to 4.0.d

Again, thank you very much for all your help, it's really appreciated!

Re: Authentication on CMIS with non-admin user

frank_miller — Thu, 16 Feb 2012 10:04:59 GMT

Just tried cmisatom on Alfresco 4.0.d and it works!

Now I can browse subfolders and files for the logged user home space. However, doing some tests, I've created a subfolder giving the user only Consumer role, so I have the path userHome/subfolderWithConsumerRole. My ruby component connects to cmis successfully with my non-admin user, and shows userHome content (only subfolderWithConsumerRole), but when I browse into subfolderWithConsumerRole (all I do here is another getObjectByPath) I get a forbidden exception. Adding Editor role to the folder solves it, so I understand it must have something to do with the filters you mentioned, but I don't understand what exactly is happening. Is there something wrong in reading cmis objects with Consumer-only role?

Best regards.

Re: Authentication on CMIS with non-admin user

jpotts — Thu, 16 Feb 2012 17:20:58 GMT

No there should not be a problem getting a folder that a user has consumer access to. But you will have to filter out parent-related properties if the user doesn't have access to any of the folders in the hierarchy.

For example, I've created a structure with the following:

test (Test User has no access)
|—– subFolder (Test User has Collaborator access)
         |——subSubFolder (Test User has Consumer access)‍‍‍

I can successfully get a handle to subSubFolder only if I use a filter:

>>> folder = repo.getObjectByPath('/test/subFolder/subSubFolder', filter='cmis:objectId,cmis:objectTypeId,cmis:name')
>>> folder.properties
{u'cmis:objectId': 'workspace://SpacesStore/3ac7873d-0400-48ad-84d3-887c7b040377', u'cmis:name': u'subSubFolder', u'cmisra:object': None, u'cmis:objectTypeId': 'cmis:folder', u'cmis:baseTypeId': 'cmis:folder'}
>>> folder.getAllowableActions()
{u'canDeleteContentStream': False, u'canSetContentStream': False, u'canCreateRelationship': False, u'canDeleteTree': False, u'canGetDescendants': True, u'canCheckIn': False, u'canApplyACL': False, u'canGetFolderParent': True, u'canDeleteObject': False, u'canGetAllVersions': False, u'canGetObjectParents': True, u'canGetProperties': True, u'canCreateDocument': False, u'canGetRenditions': False, u'canApplyPolicy': False, u'canUpdateProperties': False, u'canGetAppliedPolicies': True, u'canGetContentStream': False, u'canMoveObject': False, u'canAddObjectToFolder': False, u'canRemoveObjectFromFolder': False, u'canRemovePolicy': False, u'canGetObjectRelationships': True, u'canGetChildren': True, u'canCancelCheckOut': False, u'canGetFolderTree': True, u'canCheckOut': False, u'canCreateFolder': False, u'canGetACL': False}‍‍‍‍‍

If I try to get subSubFolder without the filter, even though my test user has access to the immediate parent, the call will fail:

>>> folder = repo.getObjectByPath('/test/subFolder/subSubFolder')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/opt/src/chemistry/cmislib/src/cmislib/model.py", line 969, in getObjectByPath
    result = self._cmisClient.get(byObjectPathUrl.encode('utf-8'), **addOptions)
  File "/opt/src/chemistry/cmislib/src/cmislib/model.py", line 209, in get
    self._processCommonErrors(result)
  File "/opt/src/chemistry/cmislib/src/cmislib/model.py", line 315, in _processCommonErrors
    raise PermissionDeniedException(error.status, error.url)
cmislib.exceptions.PermissionDeniedException: Error 403 at http://localhost:8080/alfresco/cmisatom/558e5b3c-71a0-42ac-b420-eda16e93e95b/path?path=/test/subFolder/subSubFolder&filter=&includeAllowableActions=false&includeACL=false&includePolicyIds=false&includeRelationships=&renditionFilter=‍‍‍‍‍‍‍‍‍‍

Hope this helps,

Jeff

Re: Authentication on CMIS with non-admin user

frank_miller — Thu, 16 Feb 2012 18:12:14 GMT

Thanks Jeff,

I was already filtering as you suggested, so I've tried removing one by one the rest of request params. Finally, it seems

includeACL=true‍

was preventing my request to work properly (I assume it tries to retrieve ACL info for parent folders). Once changed includeACL to false, it works!

Thank you very much!

Re: Authentication on CMIS with non-admin user

frank_miller — Wed, 22 Feb 2012 21:44:24 GMT

Hi!

I'm facing another issue regarding cmis access with non-admins, this time when creating new folders. I'm already able to read/delete document and folders, even can create documents without problems, but when I send a post request to create a folder (with a user without Company Home access), I get a cmis error I hadn't seen before.

org.apache.chemistry.opencmis.commons.exceptions.CmisRuntimeException: Object Info is missing!‍

This is the post url

http://localhost:8080/alfresco/cmisatom/f05d5224-0f52-484c-a14c-eba64c2f3345/children?id=workspace%3A%2F%2FSpacesStore%2Fe42815c5-f184-4d93-8e43-74829402bf59‍

And here it is the xml I'm sending


{"Content-Type"=>"application/atom+xml;type=entry"}
<?xml version="1.0"?>
<at:entry xmlns:cra="http://docs.oasis-open.org/ns/cmis/restatom/200908/" xmlns:at="http://www.w3.org/2005/Atom" xmlns:c="http://docs.oasis-open.org/ns/cmis/core/200908/" xmlns:cm="http://docs.oasis-open.org/ns/cmis/messaging/200908/" xmlns:app="http://www.w3.org/2007/app">
  <at:author>
    <at:name>admin</at:name>
  </at:author>
  <at:title>heaherhrettr</at:title>
  <at:id>random-garbage</at:id>
  <cra:object>
    <c:properties>
      <c:propertyId propertyDefinitionId="cmis:objectTypeId">
        <c:value>cmis:folder</c:value>
      </c:propertyId>
      <c:propertyString propertyDefinitionId="cmis:name">
        <c:value>NewFolder</c:value>
      </c:propertyString>
    </c:properties>
  </cra:object>
</at:entry>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I'm sorry. I'm pretty sure this must be solved with something similar to the filter I needed in my previous problem, but have no idea what kind of params may I include to the post request. Any help would be very appreciated.

Best regards!

Re: Authentication on CMIS with non-admin user

jpotts — Fri, 24 Feb 2012 20:14:29 GMT

I think this might be a bug. You should create a Jira and reply to this post with a link to the Jira so that I can add it to my watch list.

Jeff

Re: Authentication on CMIS with non-admin user

frank_miller — Mon, 27 Feb 2012 10:52:09 GMT

Hi Jeff,

here you got the Jira url

https://issues.alfresco.com/jira/browse/ALF-13077‍

Again, thanks for your patience and help.

Best regards!

Re: Authentication on CMIS with non-admin user

maqsood — Tue, 27 May 2014 11:47:42 GMT

Hi Jeff, Frank,

Reviving this thread again, to know, if its possible to retrieve the users and groups available in repository using open cmis lib? If not, how to achieve this?
I am currently using chemistry-opencmis-client-impl-0.10.0, alfresco-opencmis-extension-0.7 and Alfresco 4.2.0 (r56674-b4848).

Appreciate your help!

Re: Authentication on CMIS with non-admin user

kaynezhang — Tue, 27 May 2014 15:06:39 GMT

I'm afraid opencmis dose not support user/group operation ,you can use webscript api.

Re: Authentication on CMIS with non-admin user

maqsood — Thu, 29 May 2014 06:07:11 GMT

Thanks for the reply, Kaynezhang!

Otherthan webscript, is there any alternative available? How about using webservices binding with CMIS?

Re: Authentication on CMIS with non-admin user

kaynezhang — Thu, 29 May 2014 09:09:01 GMT

Yes,you can also operate user/group using webservice api.