Access Denied when creating content from a scheduled task

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

mark_smithson

We have a scheduled task which imports news from an xml feed into a WCM sandbox.

This works fine on a windows Alfresco instance, but throws an Access Denied error when on our test server (linux).

org.alfresco.repo.security.permissions.AccessDeniedException: Access Denied.  You do not have the appropriate permissions to perform this operation.
   at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:53)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
   at org.alfresco.repo.audit.AuditComponentImpl.auditImpl(AuditComponentImpl.java:256)
   at org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.java:191)
   at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:69)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
   at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:210)
   at $Proxy15.addAspect(Unknown Source)
   at com.dm.alfresco.AlfrescoContentCreatorImpl.saveToAlfresco(AlfrescoContentCreatorImpl.java:79)‍‍‍‍‍‍‍‍‍‍‍‍

The code used to create the content is as follows:

String path = AVMUtil.buildSandboxRootPath(sandbox) + "/ROOT/WEB-INF/resources/content/" + contentPath ;

      createFile(path, name, edit);
      
    String filePath = path + '/' + name;
    NodeRef fileNodeRef = AVMNodeConverter.ToNodeRef(-1, filePath);
    
    // apply the titled aspect - title and description
    Map<QName, Serializable> titledProps = new HashMap<QName, Serializable>(2, 1.0f);
    titledProps.put(ContentModel.PROP_TITLE, name);
    titledProps.put(ContentModel.PROP_DESCRIPTION, "Imported from News Feed");
    this.nodeService.addAspect(fileNodeRef, ContentModel.ASPECT_TITLED, titledProps);
    
    // attach the form is supplied 
    if (StringUtils.isNotEmpty(this.formName)){
       Map<QName, Serializable> formProps = new HashMap<QName, Serializable>(2, 1.0f);
       formProps.put(WCMAppModel.PROP_PARENT_FORM_NAME, this.formName);
       formProps.put(WCMAppModel.PROP_ORIGINAL_PARENT_PATH, path);
       this.nodeService.addAspect(fileNodeRef, WCMAppModel.ASPECT_FORM_INSTANCE_DATA, titledProps);
    }
    
    // get a writer for the content and put the file
    ContentWriter writer = this.contentService.getWriter(fileNodeRef, ContentModel.PROP_CONTENT, true);
    writer.setMimetype("text/xml");
    writer.setEncoding("UTF-8");
    writer.putContent(content);
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

createFile is as follows

private void createFile(String path, String name, boolean edit) {
      try {
         this.avmService.createFile(path, name);
      }
      catch (AVMExistsException e){
         if (!edit){
            createFile(path, randomise(name), edit);
         }
      }
   }‍‍‍‍‍‍‍‍‍‍‍

the calling code does a login using this code

this.authenticationService.authenticate(username, password.toCharArray());‍

The exception stacktrace originates from this line

this.nodeService.addAspect(fileNodeRef, ContentModel.ASPECT_TITLED, titledProps);‍

The user is configured as a content contributor on the web project and the sandbox we are importing to is the sandbox for the user.

Is there anything else we should be checking, or doing?

gavinc

I can't explain why this would work on a Windows instance and not a linux instance, but either way the error is a permission denied error from the Alfresco repository.

The addAspect call requires "WriteProperties" permission which the Contributor role does not have, they can only add new items. Therefore the user performing the import of the news feed will need a higher privileged role i.e. Content Publisher or Manager.

Hope that helps.