topic Problème sur l'utilisation des intercepteurs de sécurité in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/probl%C3%A8me-sur-l-utilisation-des-intercepteurs-de-s%C3%A9curit%C3%A9/m-p/57273#M34790 <HTML><HEAD></HEAD><BODY><SPAN>Bonjour,</SPAN><BR /><BR /><SPAN>Voilà, j'essaye de mettre en place les intercepteurs de sécurité (comme dans le fichier "public-services-security-context.xml") pour nos propres services.</SPAN><BR /><BR /><SPAN>J'ai donc :</SPAN><BR /><BR /><SPAN>1- ajouter l'intercepteur dans le fichier "knowings-resource-services-context.xml" :</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>&nbsp;&nbsp;&nbsp;&lt;bean id="TaxonService"<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;class="org.springframework.aop.framework.ProxyFactoryBean"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;property name="proxyInterfaces"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;list&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;value&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/value&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/list&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;property name="target"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;ref bean="taxonService" /&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;property name="interceptorNames"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;list&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;idref local="ITaxonService_transaction" /&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;idref bean="AuditMethodInterceptor" /&gt;<BR />&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;idref bean="exceptionTranslator"/&gt;&nbsp; <BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;idref bean="ITaxonService_security"/&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/list&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp;&lt;/bean&gt;<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>2- puis dans le fichier "knowings-resource-services-security-context.xml" :</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>&nbsp;&nbsp;&nbsp; &lt;bean id="ITaxonService_security" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor" &gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;property name="authenticationManager"&gt;&lt;ref bean="authenticationManager"/&gt;&lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;property name="accessDecisionManager"&gt;&lt;ref bean="accessDecisionManager"/&gt;&lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;property name="afterInvocationManager"&gt;&lt;ref bean="afterInvocationManager"/&gt;&lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;property name="objectDefinitionSource"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;value&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService.getAvailableTaxons=ACL_ALLOW<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService.getTemporaryTaxons=ACL_ALLOW<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/value&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp; &lt;/bean&gt;<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN>&nbsp;&nbsp; </SPAN><BR /><BR /><SPAN>La conf est bien prise en compte car si je met volontairement une erreur (par exemple j'oublie de fermer une balise), le serveur ne démarre pas.</SPAN><BR /><BR /><STRONG>Le problème est le suivant :</STRONG><BR /><BR /><SPAN>Ce service appelle un autre service custom (pas de problème jusque là) mais ce dernier service appelle le NodeService (avec un grand N)</SPAN><BR /><SPAN>Et à ce moment, il met comme erreur :</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />exception : net.sf.acegisecurity.BadCredentialsException: Bad credentials presented<BR />Bad credentials presented<BR />net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider - authenticate - 290<BR />net.sf.acegisecurity.providers.ProviderManager - doAuthentication - 159<BR />net.sf.acegisecurity.AbstractAuthenticationManager - authenticate - 49<BR />net.sf.acegisecurity.intercept.AbstractSecurityInterceptor - beforeInvocation - 372<BR />net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor - invoke - 77<BR />org.springframework.aop.framework.ReflectiveMethodInvocation - proceed - 176<BR />org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor - invoke - 49<BR />org.springframework.aop.framework.ReflectiveMethodInvocation - proceed - 176<BR />org.alfresco.repo.audit.AuditComponentImpl - audit - 241<BR />org.alfresco.repo.audit.AuditMethodInterceptor - invoke - 69<BR />org.springframework.aop.framework.ReflectiveMethodInvocation - proceed - 176<BR />org.springframework.transaction.interceptor.TransactionInterceptor - invoke - 107<BR />org.springframework.aop.framework.ReflectiveMethodInvocation - proceed - 176<BR />org.springframework.aop.framework.JdkDynamicAopProxy - invoke - 210<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><STRONG>Tests :</STRONG><BR /><BR /><SPAN>Si je met "nodeService" (petit n), là ça passe, mais ce n'est pas la solution car il faut avoir le garde fou et en plus, l'application plante plus loin.</SPAN><BR /><BR /><SPAN>Si dans le fichier "knowings-resource-services-security-context.xml", au lieu de mettre les règles, je met :</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>&nbsp;&nbsp;&nbsp; &lt;!– to test it –&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;bean id="ITaxonService_security" class="org.alfresco.repo.security.permissions.impl.AlwaysProceedMethodInterceptor" <BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>là ça passe aussi jusqu'au bout (le "NodeService" fait son travail et ne m'affiche pas d'erreurs, avec un grand N).</SPAN><BR /><BR /><SPAN>=&gt; je pense plutôt à un problème dans la déclaration des règles :</SPAN><BR /><PRE class="language-none line-numbers"><CODE>com.knowings.kmsj.repo.taxonomy.ITaxonService.getAvailableTaxons=ACL_ALLOW<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService.getTemporaryTaxons=ACL_ALLOW<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>Avez-vous une idée ?</SPAN><BR /><SPAN>Je tourne en rond depuis plusieurs jours, toute idée est bien venue&nbsp; <img id="smileyvery-happy" class="emoticon emoticon-smileyvery-happy" src="https://connect.hyland.com/i/smilies/16x16_smiley-very-happy.png" alt="Smiley Very Happy" title="Smiley Very Happy" /> </SPAN><BR /><BR /><SPAN>Bonne journée,</SPAN></BODY></HTML> Tue, 12 Feb 2008 14:04:45 GMT tcaiati 2008-02-12T14:04:45Z Problème sur l'utilisation des intercepteurs de sécurité https://connect.hyland.com/t5/alfresco-archive/probl%C3%A8me-sur-l-utilisation-des-intercepteurs-de-s%C3%A9curit%C3%A9/m-p/57273#M34790 Bonjour,Voilà, j'essaye de mettre en place les intercepteurs de sécurité (comme dans le fichier "public-services-security-context.xml") pour nos propres services.J'ai donc :1- ajouter l'intercepteur dans le fichier "knowings-resource-services-context.xml" :&nbsp;&nbsp;&nbsp;&lt;bean id="TaxonService"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;class="o Tue, 12 Feb 2008 14:04:45 GMT https://connect.hyland.com/t5/alfresco-archive/probl%C3%A8me-sur-l-utilisation-des-intercepteurs-de-s%C3%A9curit%C3%A9/m-p/57273#M34790 tcaiati 2008-02-12T14:04:45Z Re: Problème sur l'utilisation des intercepteurs de sécurité https://connect.hyland.com/t5/alfresco-archive/probl%C3%A8me-sur-l-utilisation-des-intercepteurs-de-s%C3%A9curit%C3%A9/m-p/57274#M34791 <HTML><HEAD></HEAD><BODY><SPAN>en fait, mes vraies rules sont :</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>&nbsp;&nbsp;&nbsp; <BR />&lt;bean id="ITaxonService_security" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor" &gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;property name="authenticationManager"&gt;&lt;ref bean="authenticationManager"/&gt;&lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;property name="accessDecisionManager"&gt;&lt;ref bean="accessDecisionManager"/&gt;&lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;property name="afterInvocationManager"&gt;&lt;ref bean="afterInvocationManager"/&gt;&lt;/property&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;property name="objectDefinitionSource"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;value&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService.createAdminTaxon=ACL_NODE.0.sys:base.CreateChildren<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService.createUserTaxon=ACL_NODE.0.sys:base.ReadChildren<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService.validateTaxon=ACL_PARENT.0.sys:base.WriteProperties<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService.deleteTaxon=ACL_NODE.0.sys:base.DeleteNode<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService.getAvailableTaxons=AFTER_ACL_NODE.sys:base.ReadProperties<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;com.knowings.kmsj.repo.taxonomy.ITaxonService.getTemporaryTaxons=AFTER_ACL_NODE.sys:base.ReadProperties<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/value&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/property&gt;<BR />&lt;/bean&gt;<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>Mais cela ne fonctionne pas mieux <img id="smileysad" class="emoticon emoticon-smileysad" src="https://connect.hyland.com/i/smilies/16x16_smiley-sad.png" alt="Smiley Sad" title="Smiley Sad" /> … c'était pour préciser ma demander.</SPAN><BR /><BR /><SPAN>Merci,</SPAN></BODY></HTML> Tue, 12 Feb 2008 16:22:46 GMT https://connect.hyland.com/t5/alfresco-archive/probl%C3%A8me-sur-l-utilisation-des-intercepteurs-de-s%C3%A9curit%C3%A9/m-p/57274#M34791 tcaiati 2008-02-12T16:22:46Z Re: Problème sur l'utilisation des intercepteurs de sécurité https://connect.hyland.com/t5/alfresco-archive/probl%C3%A8me-sur-l-utilisation-des-intercepteurs-de-s%C3%A9curit%C3%A9/m-p/57275#M34792 <HTML><HEAD></HEAD><BODY><SPAN>Bonjour,</SPAN><BR /><BR /><SPAN>Finalement, on a trouvé la solution,&nbsp; merci Philippe De RIVAROLA <img id="smileyvery-happy" class="emoticon emoticon-smileyvery-happy" src="https://connect.hyland.com/i/smilies/16x16_smiley-very-happy.png" alt="Smiley Very Happy" title="Smiley Very Happy" /> </SPAN><BR /><BR /><SPAN>en fait, ITaxonService extends IResourceService</SPAN><BR /><SPAN>et IResourceService a 2 méthodes : getResource et getResources, il fallait donc les ajouter dans les règles :</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />com.knowings.kmsj.repo.taxonomy.ITaxonService.createAdminTaxon=ACL_NODE.0.sys:base.CreateChildren<BR />com.knowings.kmsj.repo.taxonomy.ITaxonService.createUserTaxon=ACL_NODE.0.sys:base.ReadChildren<BR />com.knowings.kmsj.repo.taxonomy.ITaxonService.validateTaxon=ACL_PARENT.0.sys:base.WriteProperties<BR />com.knowings.kmsj.repo.taxonomy.ITaxonService.deleteTaxon=ACL_NODE.0.sys:base.DeleteNode<BR />com.knowings.kmsj.repo.taxonomy.ITaxonService.getAvailableTaxons=AFTER_ACL_NODE.sys:base.ReadProperties<BR />com.knowings.kmsj.repo.taxonomy.ITaxonService.getTemporaryTaxons=AFTER_ACL_NODE.sys:base.ReadProperties&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; com.knowings.kmsj.repo.parameter.IResourceService.getResource=ACL_NODE.1.sys:base.ReadProperties,AFTER_ACL_NODE.sys:base.ReadProperties<BR />com.knowings.kmsj.repo.parameter.IResourceService.getResources=ACL_NODE.1.sys:base.ReadProperties,AFTER_ACL_NODE.sys:base.ReadProperties<BR /><BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>et voilà,</SPAN><BR /><BR /><SPAN>Ce qui montre que si notre fichier de conf security est mal écrit, même si le serveur démarre, les services appelés risque de ne pas fonctionner et les messages d'erreurs ne sont pas clairs …</SPAN><BR /><BR /><SPAN>Bonne journée,</SPAN></BODY></HTML> Wed, 13 Feb 2008 09:04:59 GMT https://connect.hyland.com/t5/alfresco-archive/probl%C3%A8me-sur-l-utilisation-des-intercepteurs-de-s%C3%A9curit%C3%A9/m-p/57275#M34792 tcaiati 2008-02-13T09:04:59Z