Randy/David and others,
I enabled Permissions security model (along with constraints security)
and added an entry for PortletPermission with 'view' access on a portlet
- ClientStruts - in the SECURITY_PERMISSION table. I assigned this
permission to the principal "user" in PRINCIPAL_PERMISSION.
+---------------+------------------------------------------------+------
----------------------------+------------+---------------------+--------
-------------+
| PERMISSION_ID | CLASSNAME | NAME
| ACTIONS | CREATION_DATE | MODIFIED_DATE |
+---------------+------------------------------------------------+------
----------------------------+------------+---------------------+--------
-------------+
| 16 | org.apache.jetspeed.security.PortletPermission |
ClientStruts | view | 2005-08-25 23:16:20 |
2005-08-25 21:20:29 |
+---------------+------------------------------------------------+------
----------------------------+------------+---------------------+--------
-------------+
The user "user" has a PSML page which contains this portlet
<fragment id="dp-9-clientstruts" type="portlet"
name="client::ClientStruts">
<property name="row" value="0" layout="TwoColumns"/>
<property name="column" value="1" layout="TwoColumns"/>
</fragment>
And the portlet itself has view, help, and edit modes (in portlet.xml)
<supports>
<mime-type>text/html</mime-type>
<portlet-mode>VIEW</portlet-mode>
<portlet-mode>HELP</portlet-mode>
<portlet-mode>EDIT</portlet-mode>
</supports>
Yet, when the user "user" logs in, the "Edit" button is still enabled. I
tried various combinations, including disabling the Constraints security
model, but with no positive result. I tried Folder/page level security
based on the Permissions Security model, and that seems to be working.
Any ideas?
Thanks,
Prashanth
-----Original Message-----
From: Randy Watler [mailto:[EMAIL PROTECTED]
Sent: Thursday, August 25, 2005 12:54 PM
To: Jetspeed Users List
Subject: Re: [J2] Security - Specifying the policies
Prashanth,
There are two security models available... see this in page-manager.xml:
<bean id="org.apache.jetspeed.page.PageManager"
name="pageManager"
class="org.apache.jetspeed.page.impl.CastorXmlPageManager">
<constructor-arg index="0"><ref bean="IdGenerator"/></constructor-arg>
<constructor-arg index="1"><ref
bean="DocumentHandlerFactory"/></constructor-arg>
<constructor-arg index="2"><ref bean="FolderHandler"/></constructor-arg>
<constructor-arg index="3"><ref bean="PageFileCache"/></constructor-arg>
<!-- permissions security enabled flag, default=false -->
<constructor-arg index="4"><value>false</value></constructor-arg>
<!-- constraints security enabled flag, default=true -->
<constructor-arg index="5"><value>true</value></constructor-arg>
</bean>
You will want to disable the constraints, (PSML), and enable the
permissions, (java.security/FilePermission). Then, look here in
populate-userinfo-for-default-psml.sql:
INSERT INTO SECURITY_PERMISSION
VALUES(1,'org.apache.jetspeed.security.FolderPermission','<<ALL
FILES>>','view, edit','2004-05-22 16:27:12.572','2004-05-22
FILES>>16:27:12.572');
INSERT INTO SECURITY_PERMISSION
VALUES(2,'org.apache.jetspeed.security.FolderPermission','<<ALL
FILES>>','view','2004-05-22 16:27:12.572','2004-05-22 16:27:12.572');
INSERT INTO SECURITY_PERMISSION
VALUES(3,'org.apache.jetspeed.security.FolderPermission','/','view','200
4-05-22
16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(4,'org.apache.jetspeed.security.FolderPermission','/*','view','20
04-05-22
16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(5,'org.apache.jetspeed.security.FolderPermission','/non-java/-','
view','2004-05-22
16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(6,'org.apache.jetspeed.security.FolderPermission','/third-party/-
','view','2004-05-22
16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(7,'org.apache.jetspeed.security.FolderPermission','/Public','view
,
edit','2004-05-22 16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(8,'org.apache.jetspeed.security.FolderPermission','/Public/-','vi
ew,
edit','2004-05-22 16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(9,'org.apache.jetspeed.security.FolderPermission','/anotherdir/-'
,'view','2004-05-22
16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(10,'org.apache.jetspeed.security.FolderPermission','/top-links/-'
,'view','2004-05-22
16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(11,'org.apache.jetspeed.security.PagePermission','/default-page.p
sml','view','2004-05-22
16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(12,'org.apache.jetspeed.security.PagePermission','/rss.psml','vie
w','2004-05-22
16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(13,'org.apache.jetspeed.security.FolderPermission','/_user/user',
'view,
edit','2004-05-22 16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
SECURITY_PERMISSION
VALUES(14,'org.apache.jetspeed.security.FolderPermission','/_user/user/-
','view,
edit','2004-05-22 16:27:12.572','2004-05-22 16:27:12.572'); INSERT INTO
PRINCIPAL_PERMISSION VALUES(3,13); INSERT INTO PRINCIPAL_PERMISSION
VALUES(3,14); INSERT INTO PRINCIPAL_PERMISSION VALUES(6,1); INSERT INTO
PRINCIPAL_PERMISSION VALUES(7,2); INSERT INTO PRINCIPAL_PERMISSION
VALUES(8,3); INSERT INTO PRINCIPAL_PERMISSION VALUES(8,4); INSERT INTO
PRINCIPAL_PERMISSION VALUES(8,5); INSERT INTO PRINCIPAL_PERMISSION
VALUES(8,6); INSERT INTO PRINCIPAL_PERMISSION VALUES(8,8); INSERT INTO
PRINCIPAL_PERMISSION VALUES(8,9); INSERT INTO PRINCIPAL_PERMISSION
VALUES(8,10); INSERT INTO PRINCIPAL_PERMISSION VALUES(10,3); INSERT INTO
PRINCIPAL_PERMISSION VALUES(10,7); INSERT INTO PRINCIPAL_PERMISSION
VALUES(10,8); INSERT INTO PRINCIPAL_PERMISSION VALUES(10,11); INSERT
INTO PRINCIPAL_PERMISSION VALUES(10,12);
This attempts to set similar permissions to the constraints in the PSML
for the demo site. Note that the two models differ slightly and the
constraint model has a few features that cannot be supported here.
HTH,
Randy
Prashanth Gujjeti wrote:
>Hi all,
> We are trying to hook-up our own custom security valve into the
>Jetspeed2 pipeline to bypass the J2's authentication mechanism as
>suggested in the forums. We created the Security Valve and we are able
>to bypass the authentication successfully. Thanks a bunch to Randy and
>others who answered our previous queries.
>
>However, I have a couple of questions regarding the authorization
>policies. How do we define Security permissions, say for a role? One
>way to accomplish this is through the PSML pages/folder metadata/global
>security preferences. But, how do we define a policy that defines the
>security preferences based on a Principal (role/group/user). Here is
>what I could figure out from J2's schema:
>
>- SECURITY_PRINCIPAL defines roles, groups, and users.
>
>- SECURITY_PERMISSION defines security permissions (on folders, and
>pages. I didn't find any for portlets)
>
>- PRINCIPAL_PERMISSION relates the principals and permissions
>effectively providing different permissions based on role/user/group
>
>How could we add permission entries to these tables (effectively
>defining policies per user/group/role)? And how would these permissions
>aggregate. i.e. If a given user's principals (user/role/geoup) have
>conflicting permissions, which one would take precedence?
>
>Essentially, we are trying to create a security policy based on the
>principals, rather than having to manage the distributed security
>constraints under the various PSML/folder.metadata files. The security
>design-doc -
>{JETSPEED-SRC}/design-docs/src/security/SecurityDesignNotes.txt -
>mentions something about granting principals:
>
>###########
>grant principal o.a.j.security.RolePrincipal "theRolePrincipal" {
> permission o.a.j.security.PagePermission "mypage", "view";
> permission o.a.j.security.PortletPermission "myportlet",
>"view,edit,minimize,maximize";
> permission o.a.j.security.TabPermission "mytab", "view";
>};
>###########
>
>Where do we define these security policies/prinicipals? I am not
>well-versed with JAAS - so please excuse my ignorance, if these
>questions are too fundamental. I could provide more details, if
>required.
>
>Your comments/answers are much appreciated.
>
>Thanks
>- Prashanth
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: [EMAIL PROTECTED]
>For additional commands, e-mail: [EMAIL PROTECTED]
>
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
