I've created a user role, which doesn't inherit permissions from Guest. I've achieved it through portal-ext.properties with permissions.check.guest.enabled=false param. But now, if I logged in with this new user role, I can't log out, since I can see the User Personal Bar (probably because of some permission settings). Any idea how to enable the User Personal Bar for my custom user role? I'm using Liferay 7.1 CE.
Related
I'm building a sitecore 7.2 using asp.net MVC 5.0. The site will have login and each user will be roles.
We need to show/hide the site menu items based on logged in user Roles. The user detail and roles are stored in SAP backend.
Could someone please advise what's the best way to achieve above?
Essentially you will want to map the roles stored in your backend system to Sitecore Roles. Potentially look into creating a custom Role Provider (see in document below)
Once logged in, requests are made to Sitecore are made in context of that logged in user. Therefore if the user, or their role, does not have permission to view an Item, it will not be returned in the request. This effect means that your Menu will not display items they do not have permission to access.
You and Content Editors can control what users and roles can access via the Security Editor and view their access rights via the Access Viewer in the Content Editor.
This documents will have everything you need - http://sdn.sitecore.net/upload/sitecore6/sc61keywords/security_api_cookbook_usletter.pdf
http://sdn.sitecore.net/upload/sitecore6/securityadministratorscookbook-usletter.pdf
Its also worth noting that Sitecore's seucirty manages roles as Ors. So if one of the user's role has permission to see an Item, then the user can see it.
If you require the roles to be Ands; every role must have permission before its displayed to the user, check this post out - http://www.sitecore.net/learn/blogs/technical-blogs/john-west-sitecore-blog/posts/2015/03/require-membership-in-multiple-roles-in-the-sitecore-aspnet-cms.aspx
You need the roles for the current user from SAP? There is an Odata API for that: http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bde6197817511e10000000a42189b/content.htm
You could query the API in real-time, but it would of course require a login to SAP for the current user.
Or - you could use another API and connect via a service user.
I have created a 'Site User' role which is appropriate for users who will be Viewers on every available portlet. For example a user with this role should be only allowed to view documents in Documents and Media portlet but not allowed to add a new document or edit an existed.
I have defined the proper permissions in my Site role, however users with this Site role are still able to create events or add documents etc.
All these users are also assigned with the Social Office User role but as I'm seeing there is no such permission granted from this role.
I'm wondering if this is a normal behavior or the only solution is to modify portlets in a way that they won't allow users without the 'Site Admin' role to perform certain actions.
They're most likely still assigned to the "User" role (portal wide), or gets the permission from being a "Site Member". As you can't remove permissions, only add them through roles, check these roles for their bundled permissions.
They're assigned as default to Site Member role as Olaf stated. Look this file:
https://github.com/liferay/liferay-portal/blob/master/portal-impl/src/resource-actions/documentlibrary.xml
As Site Member you have :
<site-member-defaults>
<action-key>ADD_DOCUMENT</action-key>
<action-key>ADD_FOLDER</action-key>
<action-key>ADD_SHORTCUT</action-key>
<action-key>SUBSCRIBE</action-key>
<action-key>VIEW</action-key>
</site-member-defaults>
as default action permissions.
In users' personal sites pages(/user/xx/so/dashboard), user bar and dockbar are not accessible from any user without the power user or administrator role. In every other site's page, users can normally access it without these 2 roles.
Why is this happening?
This issue was resolved by creating a hook that assigns automatically the Power User role on every newly created user.
A Liferay staff member told me that Power User role is required for all social office plugins, sites etc. liferay post
I have created web menu item for user control (.aspx page) and assigned it new privilege that is assigned to role of Guest and Anonymous vendor. However, it doesnt not show user control and hides it by default. Please let me know how to detail page and user control public for all users
Try assigning your Managed web content to appropriate privilege.
Please, can you give me your opinion about this issue?
I've done an Autologin which is authenticating the username and password against my legacy system.
Once I've verified the user, I have two choices:
Add the user (if it does not exist) to Liferay ( and assign groups )
or
Map the verified user against 3 or 4 liferay users.
If my database is about 10.000 users, but I only have 3 or 4 roles, I thought the second choice would be better, but, what happens then with the welcome message once the user is logged with the liferay user credentials?
Ivan,
You need to create all the users in liferay because while login either we use the screenName or emailAdress(which must be unique and exsits in DB) ,also before login we can't check what role is assigned to user and we can't fetch the user of same role from the liferay(probably it will effect the security measures of liferay).About the welcome message it's managed by theme (velocity template) which use the name of current loggeIn user,it can't be managed, so we can't show different name with the same user login on the basis of role.
Thanks