User Options

[tomw]

Hello,

I'm using Alfresco RC2.1 with JAAS and kerberos Auth.

I don't want to use the user home folder, i want only to use the company home. How can i set this, so that every new user automatically has the company home as home folder?

[andy]

Hi

Change the default home folder provider - see authentication-services-context.xml.

Andy

[rosemaryl]

Namely, in authentication-services-context.xml use:

<bean name="homeFolderManager" class="org.alfresco.repo.security.person.HomeFolderManager">
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="policyComponent">
            <ref bean="policyComponent" />
        </property>
        <property name="defaultProvider">
            <ref bean="companyHomeFolderProvider" />
        </property>
    </bean>‍‍‍‍‍‍‍‍‍‍‍

I've been using http://wiki.alfresco.com/wiki/Security_and_Authentication#Creating_home_spaces_-_from_1.4_onwards as a reference, but I've found that since setting Company Home as the default user space, whenever a new user is created that new user becomes the owner of Company Home.  Currently I have:

<bean name="companyHomeFolderProvider" class="org.alfresco.repo.security.person.ExistingPathBasedHomeFolderProvider">
        <property name="serviceRegistry">
            <ref bean="ServiceRegistry" />
        </property>
        <property name="path">
           <value>/${spaces.company_home.childname}</value>
        </property>
        <property name="storeUrl">
           <value>${spaces.store}</value>
        </property>
      <property name="ownerOnCreate">
         <value>admin</value>
      </property>
      <property name="userPemissions">
         <set>
                <value>Consumer</value>
            </set>
      </property>
        <property name="homeFolderManager">
            <ref bean="homeFolderManager" />
        </property>
    </bean>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Hoping that ownerOnCreate will set the owner to admin,  but it fails.  I've set userPermissions to consumer in the hopes that at least that new user won't be able to modify Company Home.  Any ideas why this won't work?

[andy]

Hi

There was a bug raised recently for this.

Users created via the UI would get all rights to Company Home.

Andy

[qasimh]

How does one make the default home space visible only to the folder owner.  i.e. I don't want EVERYONE as a CONSUMER.

I've tried several combinations, but i just can't find the right setting.

I'm using NTLM authentication and LDAP sync

-Q

[sacco]

I've tried several combinations, but i just can't find the right setting.

Have you remembered to uncheck the box to inherit permissions from the containing space?

[qasimh]

Yes.  More specifically, I set my personalHomeFolderProvider's bean to:

        <property name="inheritsPermissionsOnCreate">
            <value>false</value>
        </property>

Did not help me achieve what I'm trying to do.

[qasimh]

I noticed that this problem only occurs when users log-in using NTLM.  In this case it sets the user as the owner and allows everyone consumer access.

When users are created via LDAP sync, this does not happen.  only the user is set as the owner and nobody else can see it.

The LDAP sync approach seems more correct to me, but both approaches should be using the same homefolderprovider:

NTLM defaults to personalHomeFolderProvider
LDAP is configured to use personalHomeFolderProvider
So why are their different results?

my personalHomeFolderProvider is defined below:

 
    <bean name="personalHomeFolderProvider" class="org.alfresco.repo.security.person.UIDBasedHomeFolderProvider">
        <property name="serviceRegistry">
            <ref bean="ServiceRegistry" />
        </property>
        <property name="path">
           <value>/${spaces.company_home.childname}</value>
        </property>
        <property name="storeUrl">
           <value>${spaces.store}</value>
        </property>
        <property name="homeFolderManager">
            <ref bean="homeFolderManager" />
        </property>
        <property name="inheritsPermissionsOnCreate">
            <value>false</value>
        </property>
        <property name="ownerPemissionsToSetOnCreate">
            <set>
                <value>All</value>
            </set>
        </property>
        <property name="userPemissions">
            <set>
                <value>All</value>
            </set>            
        </property>
        
        <property name="permissionsToSetOnCreate">
            <map>
                <!– Purposely left blank –>
            </map>
        </property>
        
        <!– Clearing just to be on the safe side –>
        <property name="clearExistingPermissionsOnCreate">
            <value>true</value>
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Still waiting to get some clues…

[andy]

Hi

Can you post the config that sets the default home folder provider.
Have you changed this?
This is different from the LDAP settings.

Can you also post the LDAP config for the person import bean.

Have you got the bean over-ride names correct?

Why do you think both are using the same provider and it is giving different behaviour?

I guess it is possible the old version of the bean is wired up as the global default and the new in LDAP - I suggest you also over-ride the default setting if you have not already done this in case there is a Spring config issue here. May be it uses a local bean ref rather than a global one.

Andy