topic Re: How to override the default security ACL to make it case-insensitive to the username ? in Nuxeo Forum

How to override the default security ACL to make it case-insensitive to the username ?

fast_narcis_ — Tue, 01 Nov 2011 09:17:17 GMT

We have a messy AD where not all email addresses are in lower case. Some are capitalized and some are not. Because of this, a user may login with USer@acme.com or user@acme.com . I see in the ACLS table that the permissions are stored both ways, depending on how the user was logged in at the time the documents were created.

So, because of this, sometimes a user doesn't have access to basic functionality like edit it's own profile or access the personal workspace.

Re: How to override the default security ACL to make it case-insensitive to the username ?

Olivier_Grisel — Tue, 01 Nov 2011 10:38:06 GMT

Since Nuxeo 5.4.2, you can force the id case of the directory entries to "lower" or "upper" in the LDAPDirectory configuration with: <idCase>lower</idCase> for instance. The default value for that parameter is "unchanged".

That should fix your issue without having to mess with the ACL system. Nuxeo principal ids are must be unique, not only for the ACL system but also for looking up documents by creator id for instance.

Re: How to override the default security ACL to make it case-insensitive to the username ?

fast_narcis_ — Tue, 01 Nov 2011 14:54:03 GMT

It would be great if it would work like that, but it doesn't.

Re: How to override the default security ACL to make it case-insensitive to the username ?

Olivier_Grisel — Tue, 01 Nov 2011 15:50:09 GMT

I don't see the issue, if you do the change on the LDAPDirectory configuration, the SQLDirectory will naturally fill in it's entries with lowercase ids only.

Re: How to override the default security ACL to make it case-insensitive to the username ?

fast_narcis_ — Tue, 01 Nov 2011 16:20:59 GMT

I've cleared the data folder so I have clean data.

Re: How to override the default security ACL to make it case-insensitive to the username ?

Olivier_Grisel — Tue, 01 Nov 2011 16:38:35 GMT

Alright I think we can say that this qualifies as a bug. Can you please open a jira issue? I think we should make the SQLDirectory and / or MultiDirectory able to handle the idCase param as well to make them behave consistently.

Re: How to override the default security ACL to make it case-insensitive to the username ?

fast_narcis_ — Wed, 02 Nov 2011 08:26:55 GMT

I already tried that but I have contributed a extension to the UserManager overriding the makePrincipal method, but the id is null at that point.

Re: How to override the default security ACL to make it case-insensitive to the username ?

Olivier_Grisel — Wed, 02 Nov 2011 10:14:08 GMT

Indeed overriding makePrincipal is useless since the user entry is already fetched from the user directory when this method is called. Override getPrincipal as I said previously instead

Re: How to override the default security ACL to make it case-insensitive to the username ?

fast_narcis_ — Wed, 02 Nov 2011 10:25:25 GMT

Also I have entered support ticket SUPNXP-4618 for the same.

Re: How to override the default security ACL to make it case-insensitive to the username ?

fast_narcis_ — Wed, 02 Nov 2011 12:00:45 GMT

It worked like this

Re: How to override the default security ACL to make it case-insensitive to the username ?

Olivier_Grisel — Wed, 02 Nov 2011 12:06:08 GMT

Looks good.