topic Re: Members can't see documents in Nuxeo Forum

Members can't see documents

__3 — Thu, 21 Jan 2016 09:05:48 GMT

Hi!

I have problem with permissions. While Members Group should read all domains, and documents I see information that I can't see any content(logged as user from members group). I tried to change it at permissions settings but regiving permissions for members group or any user isn't working. I'm using Oracle database.

Re: Members can't see documents

vicent — Tue, 26 Jan 2016 11:00:26 GMT

Hi,

I have the same problem. The content is only avalaible for the administrators guys. And nobody else is able to see content. I migated from 5.6 version to the latest LTS. Everythings was working fine with the previous versions (5.6, 5.8; 6.0) . In my case Ihad some problems to link the Nuxeo (version 7.10) with our ldap. (https://answers.nuxeo.com/general/q/f9dec9b209044181a59831014f6aefa3/Nuxeo-7-10-ldap-authentication)

Re: Members can't see documents

ssze_ — Tue, 26 Jan 2016 13:07:23 GMT

Hi,

I have the same issues using LDAP that the permission behavior changed in the 2015 LTS. Now it is not enough for the Members group to have read and version rights by inheritance on the root node to see items (default setup). I had to add the members group locally on the root and other nodes too to make it work.

Stefan

Re: Members can't see documents

vicent — Tue, 26 Jan 2016 14:14:32 GMT

Thanks for you answer,

Did you define the group members in your ldap ? If not, in my case, this group doesn't exist in the application. If defined each time the permissions is check, the answer of the ldap takes a too long time, Ihave to reload the page in my browser (time out).

I never had this problem with previous versions (5.6, 5.8, 6.0) , the members group was not defined in our ldap.

Vincent

Re: Members can't see documents

ssze_ — Tue, 26 Jan 2016 14:55:31 GMT

We don't have the members group defined in LDAP - it's only there in nuxeo by default. And by default, the following permssions are set on the root node

Re: Members can't see documents

vicent — Tue, 26 Jan 2016 16:05:37 GMT

Thanks again for your answer.

Re: Members can't see documents

Olivier_Salaün — Mon, 23 Jan 2017 10:30:16 GMT

We also face the same issue while preparing our migration from Nuxeo 5.8 to Nuxeo LTS2015.

With Nuxeo server in DEBUG mode we notice these log entries while accessing the "Permissions" tab :

017-01-23 11:15:01,305 DEBUG [http-bio-0.0.0.0-8856-exec-21] [org.nuxeo.ecm.directory.ldap.LDAPSession] LDAPSession.getLdapEntry(members, true): LDAP search base='ou=grouper,dc=univ-rennes1,dc=fr' filter='(&(cn={0})(&(&(objectClass=groupOfNames))(cn=*)))'  args='members' scope='1' [LDAPSession '-3831897279493570335' for directory ldapGroupDirectory]
2017-01-23 11:15:01,371 WARN  [http-bio-0.0.0.0-8856-exec-21] [org.nuxeo.ecm.directory.ldap.LDAPSession] The application should not query for entries with an empty id => return no results

If I understand it correctly, the Nuxeo server is not able to load ACEs referring to the "members" group; while Nuxeo 5.8 was behaving well with them.

I noticed the reference to defaultGroup in the Nuxeo documentation https://doc.nuxeo.com/nxdoc/using-a-ldap-directory/ and tried changing our default-ldap-users-directory-bundle.xml as follows, but we still face the same issue:

...
  <extension target="org.nuxeo.ecm.platform.usermanager.UserService" point="userManager">

    <userManager>
      <userCacheName>default-cache</userCacheName>
      <defaultAdministratorId>p-salaun</defaultAdministratorId>
      <defaultGroup>members</defaultGroup>
      <users>
        <directory>ldapUserDirectory</directory>
        <virtualUser id="MyAdministrator" searchable="false">
          <password>secret</password>
          <property name="firstName"></property>
          <property name="lastName"></property>
          <group>administrators</group>
        </virtualUser>
        <anonymousUser id="Anonyme">
          <property name="firstName">Invite</property>
          <property name="lastName">Utilisateur</property>
        </anonymousUser>
      </users>
      <groups>
        <directory>ldapGroupDirectory</directory>
      </groups>
    </userManager>

Any feedback from the Nuxeo team on this? Anyone found a workaround?

Re: Members can't see documents

Olivier_Salaün — Wed, 08 Feb 2017 09:49:07 GMT

Eventually we found a way to fix the issue