nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Action with setRunAsUser

dranakan

Hello,

It is useful to clear the permissions if we use the setRunAsUserbefore the end of an action (security reason) ?

MyAction

String currentUser = AuthenticationUtil.getRunAsUser();
…
AuthenticationUtil.setRunAsUser(AuthenticationUtil.getAdminUserName());
AuthenticationUtil.setFullyAuthenticatedUser(AuthenticationUtil.getAdminUserName());
…
// Create some directories
…
AuthenticationUtil.setRunAsUser(currentUser );
AuthenticationUtil.setFullyAuthenticatedUser(currentUser);
// or AuthenticationUtil.clearCurrentSecurityContext();?‍‍‍‍‍‍‍‍‍‍‍

Helped by http://blogs.captechconsulting.com/blog/ron-difrango/alfresco-impersonation

Find more posts tagged with

Comments

mrogers

Its much safer to use AuthenticationUtil.runAs which will always clean up after itself.

And yes you should clean up after yourself after fiddling with the authentication context so your code above needs try/finally blocks.

dranakan

Thank you mrogers.

My action move a file and creates some directories. I would like that the user that start the action have no access to theses directories file.
I used setFullyAuthenticatedUser and the creator was admin. But now… how can I do with runas ?

public void executeImpl(final Action actionF, final NodeRef actionedUponNodeRefF) {
      if (logger.isDebugEnabled()) {
         logger.debug("Action : OrganizeFileInDirectory");
      }
      // Check that the node still exists
      if (this.nodeService.exists(actionedUponNodeRefF) == true) {

         try {         
            AuthenticationUtil.runAs(
                  new AuthenticationUtil.RunAsWork<Object>() {
                  public Object doWork() throws Exception {
                  
            
            UserTransaction trx_A = serviceRegistry.getTransactionService()
                  .getUserTransaction();
            try {
               trx_A.begin();
               // Move files
                moveFile(…);
               trx_A.commit();
            } catch (Throwable e) {
               try {
                  if (trx_A.getStatus() == Status.STATUS_ACTIVE) {
                     trx_A.rollback();
                  }
               } catch (Throwable ee) {
                  // Handle double exception in whatever way is
                  // appropriate eg. log it
                  logger.error("", e);
               }

               logger.error("", e);
            }
            return null;
         }},"admin");

         } catch (Exception e) {
            if (logger.isDebugEnabled()) {
               logger.error("", e);
            }
         }

         if (logger.isDebugEnabled()) {
            logger.debug("End");

         }
      }
   }‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

mrogers

That code looks on the right sort of lines. What's the problem?

And while you are at it you should be using the same pattern with the RetryingTransactionHelper rather than attempting to manage the transactions yourself. In fact do you need the transaction handling at all?

dranakan

That code looks on the right sort of lines. What's the problem?

The directories and the files that the method creates have properties "creator" and "modifier" by the user. He has all rights on theses directories/files and I want he can not have access.
I can also set owner = admin but could I do by another way ? (avoid to set owner on each nodes)

And while you are at it you should be using the same pattern with the RetryingTransactionHelper rather than attempting to manage the transactions yourself. In fact do you need the transaction handling at all?

I used this before but I got problems… I have never found but using another method (with UserTransaction) and all was working…

mrogers

You may want to run your code as "system" rather than "admin".

AuthenticationUtil.getSystemUserName()

dranakan

Thank you.

UsingAuthenticationUtil.runAs(…, "system")… does not change the properties "Creator" and "Modifier" on the new directories/files.

However, if I set the owner, (in the action) the propertie on the file is "system". I would like to avoid using setting the owner. Only set "creator" and "modifier". Or this is the recommanded way in this situation ? (remove right on nodes)

dranakan

Instead of adding the owner on each node to remove user permissions, I use "setFullyAuthenticatedUser" inside the runAs. New node created in my method "moveFile" will have "system" as "creator" and "modifier".

AuthenticationUtil.runAs(
                  new AuthenticationUtil.RunAsWork<Object>() {
                  public Object doWork() throws Exception {
            UserTransaction trx_A = serviceRegistry.getTransactionService()
                  .getUserTransaction();
            try {
               trx_A.begin();
               AuthenticationUtil.setFullyAuthenticatedUser(AuthenticationUtil.getSystemUserName());
               // Move files
                moveFile(…);
               trx_A.commit();
            } catch (Throwable e) {
               try {
                  if (trx_A.getStatus() == Status.STATUS_ACTIVE) {
                     trx_A.rollback();
                  }
               } catch (Throwable ee) {
                  // Handle double exception in whatever way is
                  // appropriate eg. log it
                  logger.error("", e);
               }

               logger.error("", e);
            }
            return null;
         }},AuthenticationUtil.getSystemUserName());
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍