topic Re: SiteService_security bean override causes SEVERE error in Alfresco Archive

SiteService_security bean override causes SEVERE error

gerryr — Sun, 12 Jan 2014 00:46:54 GMT

I'm trying to restrict ability to create/delete Sites to just admins.So I copy the SiteService_security bean from tomcat/webapps/alfresco/WEB-INF/classes/alfresco/public-services-security-context.xml and put it into a custom file: tomcat/shared/classes/alfresco/web-extension/custom-public-services

Re: SiteService_security bean override causes SEVERE error

afaust — Sun, 12 Jan 2014 13:41:18 GMT

Hello,

the custom-public-services-security-context.xml is in the wrong directory. It should be in the tomcat/shared/classes/alfresco/extension directory instead, since it affects the Repository. All files in web-extension are meant to affect Share and since the security configuration contains elements that are particular to the Repository (Share doesn't know about), this may cause your error.

Regards
Axel

Re: SiteService_security bean override causes SEVERE error

gerryr — Sun, 12 Jan 2014 17:17:21 GMT

Yes, makes perfect sense. Thanks.

I placed the file into tomcat/shared/classes/alfresco/extension and it's trying to load the bean definition but now it's giving me an initialization error about 'afterInvocationManager' not being in document.

11:53:08,405 ERROR [org.springframework.web.context.ContextLoader] Context initialization failed
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Failed to import bean definitions from URL location [classpath:alfresco/application-context.xml]
Offending resource: ServletContext resource [/WEB-INF/web-application-context.xml]; nested exception is org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Failed to import bean definitions from URL location [classpath*:alfresco/extension/*-context.xml]
Offending resource: class path resource [alfresco/application-context.xml]; nested exception is org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 47 in XML document from file [C:\Alfresco\tomcat\shared\classes\alfresco\extension\custom-public-services-security-context.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 47; columnNumber: 9; An element with the identifier "afterInvocationManager" must appear in the document.
        at org.springframework.beans.factory.parsing.FailFastProblemReporter.error(FailFastProblemReporter.java:68)
        at org.springframework.beans.factory.parsing.ReaderContext.error(ReaderContext.java:85)
        at org.springframework.beans.factory.parsing.ReaderContext.error(ReaderContext.java:76)‍‍‍‍‍‍‍

I then changed the following two lines in the bean declaration:

        <property name="accessDecisionManager"><ref local="accessDecisionManager"/></property>
        <property name="afterInvocationManager"><ref local="afterInvocationManager"/></property>‍‍

to:

        <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
        <property name="afterInvocationManager"><ref bean="afterInvocationManager"/></property>‍‍

and now this appears to be working properly. The Create and Delete Sites authority is restricted to admins.

Re: SiteService_security bean override causes SEVERE error

nwali — Tue, 04 Apr 2017 17:05:25 GMT

I have created the custom-public-services-security-context.xml and placed it in tomcat/shared/classes/alfresco/extension. Still I'm able to see the create site option for all the users.

Below is custom-public-services-security-context.xml file:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
<bean id="SiteService_security" class="org.alfresco.repo.security.permissions.impl.acegi.MethodSecurityInterceptor">
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
<property name="afterInvocationManager"><ref bean="afterInvocationManager"/></property>
<property name="objectDefinitionSource">
<value>
org.alfresco.service.cmr.site.SiteService.cleanSitePermissions=ACL_NODE.0.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.createContainer=ACL_ALLOW,AFTER_ACL_NODE.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.createSite=ACL_METHOD.Group_Site_Creator
org.alfresco.service.cmr.site.SiteService.deleteSite=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.findSites=ACL_ALLOW,AFTER_ACL_NODE.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.getContainer=ACL_ALLOW,AFTER_ACL_NODE.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.listContainers=ACL_ALLOW,AFTER_ACL_NODE.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.getMembersRole=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.getMembersRoleInfo=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.resolveSite=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.getSite=ACL_ALLOW,AFTER_ACL_NODE.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.getSiteShortName=ACL_ALLOW,AFTER_ACL_NODE.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.getSiteGroup=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.getSiteRoleGroup=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.getSiteRoles=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.getSiteRoot=ACL_ALLOW,AFTER_ACL_NODE.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.hasContainer=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.hasCreateSitePermissions=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.hasSite=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.isMember=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.listMembers=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.listMembersInfo=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.listMembersPaged=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.listSites=ACL_ALLOW,AFTER_ACL_NODE.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.listSitesPaged=ACL_ALLOW,AFTER_ACL_NODE.sys:base.ReadProperties
org.alfresco.service.cmr.site.SiteService.removeMembership=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.canAddMember=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.setMembership=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.updateSite=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.countAuthoritiesWithRole=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.isSiteAdmin=ACL_ALLOW
org.alfresco.service.cmr.site.SiteService.*=ACL_DENY
</value>
</property>
</bean>
</beans>

Please let me know if anything else needs to change.

Re: SiteService_security bean override causes SEVERE error

idwright — Wed, 05 Apr 2017 08:12:46 GMT

I recommend GitHub - jpotts/share-site-creators: An Alfresco add-on that limits site creation to those in a specific group.

Even if you don't want to use it as is, then it will give a guide as to what to do.

Re: SiteService_security bean override causes SEVERE error

nwali — Wed, 05 Apr 2017 14:10:59 GMT

Thank you for quick reply.

I know about this plugin and that targets for Alfresoc 5.1.f where as I'm using Alfresco 5.0.d

But my main concern is why is the above changes not running properly. What reason is behind this unsuccessful runnning? Is there any step or file missed out to be modified?

Appreciate your help!

Re: SiteService_security bean override causes SEVERE error

idwright — Wed, 05 Apr 2017 15:37:11 GMT

There is an older version for 5.0.d

The change you have made will prevent the user from making the change however it's running on the back end alfresco/repo/platform (whatever it's called these days!)

If you want to hide the menu option as well, then you'll have to look at the share side code as well.

I think you'll find that it is working but only to the extent that if somebody without permission tries to create a site then they will get an error message.