nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Giving a user access to administration console

p3d3r0s0

Is this possible? Without giving the user the admin role? I want to give a user access to the administration console and be able to do all options there but not be able to access the dictionary path. Is this possible?

Best reguards,
Pedro

Find more posts tagged with

Comments

p3d3r0s0

By changing the titlebar.jsp i was able to give access to the administration console, but i cant add users or do any of the other operations because i dont have permission. Where is the permission verification made?

ebogaard

This is about the same I'm looking for. (http://forums.alfresco.com/en/viewtopic.php?f=9&t=26656)
Couldn't find anything in manuals or forums. Haven't got an answer on my post either.

savic_prvoslav

You can do this by editing :
web.xml
Admin Authentication Filter ( you can remove the usage of admin filter , this would be wrong idea, but you can do this)

class

rg.alfresco.web.app.servlet.AdminAuthenticationFilter , this class checks if current user is admin or not .

you can create some cind of group for "admin" users and checking this in the class adminAuthfilter if they are in this group then give them access.

p3d3r0s0

you can create some cind of group for "admin" users and checking this in the class adminAuthfilter if they are in this group then give them access.

that seems ideal, but i still needed to remove the access to the dictionary space and i think that if i make a user an admin, i cant stop him from accessing a space.

i tried removing these fields:

You can do this by editing :
web.xml
Admin Authentication Filter ( you can remove the usage of admin filter , this would be wrong idea, but you can do this)

class rg.alfresco.web.app.servlet.AdminAuthenticationFilter , this class checks if current user is admin or not .

but i still couldnt create a user using with a user that wasnt an admin.

Am i missing something?

savic_prvoslav

Well , you need to do some coding for this.
for instance:

‍

you have to code in that class ( you would replace that class with your own and inherit it ) next:
if current user in in group : LIKE_ADMIN_GROUP filter it.

and you create in alfresco group LIKE_ADMIN_GROUP and this should do it.**

** this filter like authentification filter filters who has access to what .

if (isAdmin)
      {
//add hire : 
//get all users from that group
authorities = this.getAuthorityService()
         .getContainedAuthorities(AuthorityType.USER,
            "GROUP_NAME_GROUP", immediate);
//get current user
String currentUserName=Application.getCurrentUser(FacesContext.getCurrentInstance()).getUserName();

//check if current user is in this group
for (String authority : authorities) {
NodeRef ref = this.getPersonService().getPerson(authority);

String userName= this.getNodeService().getProperty(ref, ContentModel.PROP_USERNAME);

if(userName.equals(currentUserName))//current user is in this group
{
  chain.doFilter(req, res);
}

}


this sould do it, you would have acces to admin parts, 
 also you can create multiple filters, and define some kind of security for your self. 

So have funn coding this out, but I think this is more or less what you need to make it nice and net .

PS: change classs of filter admin authentification filter according to what you jave coded out.








         chain.doFilter(req, res); //if is admin go to the page like /jsp/admin/….
      }
      else
      {
            httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN); //return 403
         }
        
      }

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ebogaard

It looks like this is what I was looking for, but the problem is that the post isn't complete / is malformed.
And I'm afraid I would like some more detailed instructions on how to do this.

Savic, could you edit your post to make it complete and maybe give some more hints?
Thanks!

savic_prvoslav

I have thought that you are programmer.
I will send you code soon( monday or tuesday) and I guess you will have solved problem. If this time frame is ok, if not you could $$ to someone to get you the code faster.

send me the version of your alfresco.

p3d3r0s0

Just checking, is this coding process made on eclipse? will i have to make a java class for this purpose or can this be done in a jsp or xml file?

savic_prvoslav

This is done in eclipse.

p3d3r0s0

To anyone that might interested in having an example of java code, i have found this site:
http://ecmarchitect.com/archives/2009/07/30/1023

in it theres a link in which you can download the source code for some examples (All of the above, combined (~28.1 MB, Download))

Now, its just a matter of understanding how the class system works and what methods one needs to suit our purposes(hopefully it wont be a horrible experience

savic_prvoslav

you wont go far with this, let me tell you that. These are just basic examples of what you can do in alfresco , but this is god starting point. Buy a book too .

p3d3r0s0

I was trying to do a bit of coding on the AdminAuthenticationFilter class based on what savic.prvoslav put here, but i cant get the current users group, i tried the
this.getAuthorityService().getContainedAuthorities(AuthorityType.USER,"GROUP_NAME_GROUP", immediate); method, but AdminAuthenticationFilter doesnt have that method nor do i know how to implement it. Is there another way to know if a certain user belongs to a group?

savic_prvoslav

package org.alfresco.docassistent.filter;

import java.io.IOException;
import java.util.Set;

import javax.faces.context.FacesContext;
import javax.servlet.FilterChain;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.repository.NodeService;
import org.alfresco.service.cmr.security.AuthorityService;
import org.alfresco.service.cmr.security.AuthorityType;
import org.alfresco.service.cmr.security.PersonService;
import org.alfresco.web.app.Application;
import org.alfresco.web.app.servlet.AdminAuthenticationFilter;
import org.alfresco.web.app.servlet.AuthenticationHelper;
import org.alfresco.web.bean.repository.Repository;
import org.alfresco.web.bean.repository.User;

public class CustomAdminAuthenticationFilter extends AdminAuthenticationFilter {

    @Override
    public void doFilter(ServletRequest httpRequest,
       ServletResponse httpResponse, FilterChain chain)
       throws IOException, ServletException {

   User user = AuthenticationHelper.getUser(
      (HttpServletRequest) httpRequest,
      (HttpServletResponse) httpResponse);
   boolean isAdmin = (user != null && user.isAdmin());

   if (!isAdmin) {

       ServletContext context = ((HttpServletRequest) httpRequest)
          .getSession().getServletContext();
       AuthorityService authorityService = Repository.getServiceRegistry(
          context).getAuthorityService();
       PersonService personService = Repository
          .getServiceRegistry(context).getPersonService();
       NodeService nodeService = Repository.getServiceRegistry(context)
          .getNodeService();

       // Set<String> test = authorityService
       // .getAllAuthorities(AuthorityType.GROUP);
       // for (String authority : test) {
       // System.out.println(authority);
       // }

       Set<String> authorities = authorityService.getContainedAuthorities(
          AuthorityType.USER, "GROUP_NAME_GROUP", true);
       // get current user
       String currentUserName = Application.getCurrentUser(
          FacesContext.getCurrentInstance()).getUserName();

       // check if current user is in this group
       for (String authority : authorities) {

      NodeRef ref = personService.getPerson(authority);

      String userName = (String) nodeService.getProperty(ref,
         org.alfresco.model.ContentModel.PROP_USERNAME);

      if (userName.equals(currentUserName))// current user is in this
      // group
      {
          chain.doFilter(httpRequest, httpResponse);

      }

       }
       super.doFilter(httpRequest, httpResponse, chain);
   } else {
       super.doFilter(httpRequest, httpResponse, chain);
   }
    }

}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

change web.xml,
change /jsp/parts/titlebar.jsp to see action with "dialog:adminConsole". this sould work fine, if not minor fix would do it.

in alfresco create goup "NAME_GROUP" and put "admins" in it.

p3d3r0s0

I added this code in the titlebar.jsp:

<a:stringEqualsEvaluator value="#{NavigationBean.currentUser.userName}" condition="user1@ecm.alfresco.com">
<a:actionLink value="#{msg.admin_console}"
image="/images/icons/admin_console.gif"
showLink="false"
action="dialog:adminConsole"
id="alf_admin_console" />
</a:stringEqualsEvaluator>

it works well, but only for a specific user, i dont know how to access usergroups on a .jsp

Thank you very much for the code savic.prvoslav, I was trying to use it, but from what i know, i have to create a project with the CustomAdminAuthenticationFilter.java make a src/java source folder, config, data, src/web/jsp, src/web/META-INF folders and make a build.properties and a build.xml.

for the build.properties i put in it:
alfresco.sdk.dir=C:/alfresco-community-sdk-3.3
alfresco.web.dir=C:/Alfresco/tomcat/webapps/alfresco

I dont know what to put in the build.xml file

ops:

and as for the web.xml i have changed:
   <filter>
      <filter-name>Admin Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.app.servlet.AdminAuthenticationFilter</filter-class>
   </filter>

to

   <filter>
      <filter-name>Admin Authentication Filter</filter-name>
      <filter-class>org.alfresco.docassistent.filter.CustomAdminAuthenticationFilter</filter-class>
   </filter>

Is everything correct?
What do i put in the build.xml file?

savic_prvoslav

Give me email I will send you jar for this so you do not have to spend time on this.

everything is good except:

<a:stringEqualsEvaluator value="#{NavigationBean.currentUser.userName}" condition="user1@ecm.alfresco.com"> //this means: if current user is user1… then render it.
it is wrong, I will send you the code for this to say: if user is in group for like admin users then render, no problem at all. for now just remove this so all users can see , we will change this letter.
<a:actionLink value="#{msg.admin_console}"
image="/images/icons/admin_console.gif"
showLink="false"
action="dialog:adminConsole"
id="alf_admin_console" />
</a:stringEqualsEvaluator>

p3d3r0s0

Its working at last. (joy!!)
To someone that might want to do something similar, i advise you to import the customLogin project to eclipse from the site i mentioned somewhere in the previous page, then do:

1-Make a MyClass in a org.alfresco.sample with this as its content:

package org.alfresco.sample;

import javax.faces.context.FacesContext;

import org.alfresco.repo.security.authentication.AuthenticationUtil;
import org.alfresco.web.app.Application;

public class MyClass extends org.alfresco.web.bean.users.CreateUserWizard
{

       private static final long serialVersionUID = 1L;
       
       @Override
       protected String finishImpl(FacesContext arg0, String arg1) throws Exception
       {
               //GetSuccessItemsTable getSuccessItemsTable = new GetSuccessItemsTable(this, arg0, arg1);
               String tenant = Application.getCurrentUser(FacesContext.getCurrentInstance()).getUserName().split("@")[1];

               AuthenticationUtil.setRunAsUser("admin@" + tenant);
                     try {
                        return super.finishImpl(arg0, arg1);
                     } catch (Throwable e) {
                  // TODO Auto-generated catch block
                  e.printStackTrace();
               }
               return null;
       }
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

2-Create a build.properties with this as its content:
alfresco.sdk.dir=C:/alfresco-community-sdk-3.3
alfresco.web.dir=C:/Alfresco/tomcat/webapps/alfresco

replace both paths with the ones you use.

3-Right click on your project and export as jar.

4-Place the Jar in the (in my case) "C:\Alfresco\tomcat\webapps\alfresco\WEB-INF\lib" dir

5-Change:
      <managed-bean-name>CreateUserWizard</managed-bean-name>
      <managed-bean-class>
         org.alfresco.web.bean.users.CreateUserWizard
      </managed-bean-class>

to

      <managed-bean-name>CreateUserWizard</managed-bean-name>
      <managed-bean-class>
         org.alfresco.sample.MyLoginClass
      </managed-bean-class>

in the C:\Alfresco\tomcat\webapps\alfresco\WEB-INF\faces-config-beans.xml .

6-Start Alfresco and now, if you have changed the "C:\Alfresco\tomcat\webapps\alfresco\jsp\parts\titlebar.jsp" file to what i have in a previous post then that user, in my case user1@ecm.alfresco.com, will now be able to see the admin console and create users.

7-???

8-PROFIT!!

I have to thank savic.prvoslav for his time and patient, still owe you a beer.

p3d3r0s0

Actually now i just need to know how to do this:
<a:stringEqualsEvaluator value="#{NavigationBean.currentUser.userName}" condition="user1@ecm.alfresco.com">

but instead of only letting user1 see the admin console link i would like to let a whole group see the link. Any hints?

savic_prvoslav

Do not think that I have forgotten.

String username = Application.getCurrentUser(FacesContext.getCurrentInstance()).getUserName();
if(username.contans("@"))
{
String tenant= Application.getCurrentUser(FacesContext.getCurrentInstance()).getUserName().split("@")[1];
AuthenticationUtil.setRunAsUser("admin@" + tenant);
}else {

AuthenticationUtil.setRunAsUser("admin");
}‍‍‍‍‍‍‍‍‍

p3d3r0s0

I was talking about this code in the titlebar.jsp file:

<a:stringEqualsEvaluator value="#{NavigationBean.currentUser.userName}" condition="user1@ecm.alfresco.com">
<a:actionLink value="#{msg.admin_console}"
image="/images/icons/admin_console.gif"
showLink="false"
action="dialog:adminConsole"
id="alf_admin_console" />
</a:stringEqualsEvaluator>‍‍‍‍‍‍‍

i just wanted to change the user1@ecm.alfresco.com to something like MYGROUP
So that only people from the MYGROUP group could see the adminconsole.

What do i have to put in the value field?

savic_prvoslav

You could override NavigationBean and add method where you would check if user is member of some group.

p3d3r0s0

Yes, thats what i want to do. I just dont know what method does that. Ithough i could use AuthorityServiceImpl and the getContainedAuthorities method, but i get an error. Is there any other method that i can use in the jsp to tell me what groups the user belongs to?
Im getting the currentUserName from the TenantAdminConsoleBean. How can i get the user's groups?

I was trying this:

<%@ page import="org.alfresco.web.bean.repository.tenant.TenantAdminConsoleBean" %>
<%@ page import="org.alfresco.web.bean.NavigationBean" %>
<%@ page import="org.alfresco.repo.security.authority.AuthorityServiceImpl" %>
<%@ page import="org.alfresco.service.cmr.security.AuthorityType" %>
<%@ page import="java.util.Set" %>

<% 
TenantAdminConsoleBean tac = new TenantAdminConsoleBean();
String myUserName= tac.getCurrentUserName();
AuthorityServiceImpl asi = new AuthorityServiceImpl();
Set<String> myGroups = asi.getContainingAuthorities(AuthorityType.GROUP, myUserName, false);
boolean isContained = myGroups.contains("myAdmins");
//person.getPerson(teste3);
 %>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

but i get an error on:
Set<String> myGroups = asi.getContainingAuthorities(AuthorityType.GROUP, myUserName, false);
the error is:
Stacktrace:
caused by:
and
Stacktrace:
caused by:
java.lang.NullPointerException

what is wrong with my code?