I have configured my Opensearch with some indices and able to see the logs in Discover tab using admin user.
Now, the next step is to provide index level permissions to each user.
Current Configuration: I have created one role with full cluster level access and also read+write on Global tenant (where I initially created the index). For index permission, I have provided my index name "myefk*". This role has been attached to one user "user1".
Expected Result: I was expecting to see all the logs in discover tab for myefk index when logged in with user1.
Actual Result: The discover tab is empty, It is not showing anything. However, by using Dev tools, I can search for the logs in this specific index and able to get the result.
So Now, I am confused if my configuration is actually correct or any other permission is required. Is it really possible to see the logs in discover tab when working with index level permissions.
For this to achieve, we would need to create a tenant and a role with the below permissions:
Cluster permissions: cluster_composite_ops
Index permissions: unlimited
map this role the newly created tenant with read and write access
Map the user role to the backend role
and finally map the user to opensearch_dashboards_user role as well..
for any further info. you can look at in to this: https://forum.opensearch.org/t/creating-role-for-having-complete-access-to-only-specified-indices/9945
Related
Is there a way to make admin not able to delete user from Active Directory? I need to disable this feature some how in global properies or else. I want admin only to create users,edit them and disable them, but not delete. The version of Alfresco is Community 5.2. Thanks in advance.
I guess you mean the other way around:
Is there a way to prevent admin from deleting users which have been created by ldap sync?
or do you mean:
Is there a way to revoke permission to delete any user?
Do you understand the difference between a user which has been created by ldap sync and a user manually created in the Alfresco admin UI?
There is no (easy and supported) way I know of to restrict admin permissions or for a member of the group ALFRESCO_ADMINISTRATORS. The ROLE_ADMINISTRATOR has always any permission.
There maybe a way to achieve what you expect in a customization module implementing a new behavior which disallows user deletion in a specific zone or by creating your own permissionGroups/permissions in a customPermissionDefinitions, setting the new introduced permissions on the user zones to specific groups but that kind of customization would be hard to maintain on later updates/upgrades.
EDIT:
What is your use case for allowing (end) users to create new users inside Alfresco although you have an user directory (AD) in place?
If your aim is to support external users, managed by specific internal user groups you may add another directory like samba4 which your internal users may get permissions to create/delete users (that's what we actually do from/thru our CRM system) or if you prefer integrations with OAuth2 providers such as Google, Facebook, Github you may take a look on the Spring Cloud Gateway for the Alfresco platform project
In the PeopleSoft Campus Solutions module, I am using the ADM_APPL_ENTRY1 Component Interface (CI) to fire some data.
The user account I am using is a clone of the PS user (i.e. full permissions). I tried with both my clone account and the actual PS account but it returns the same error {ADM_APPL_ENTRY1.ADM_APPL_PROG.ACAD_PROG}(91,34).
I double-checked security and found all permission lists and progr security are the same for my user. Can anyone help?
Looks like you need to set the row security for your user (which is not copied when you copy the PS).
If you want to, you can manually copy PS row level security on your user on:
Define SACR> Security > Secure Student Administration>Setup>User Security Replacement.
Enter your user on the search page, and enter PS on the page itself.
I have created a secondary User store using LDAP. By default, all users of the secondary store have no permission. Is it a way to assign the suscriber role to all users in one operation or I have to do it manually for each user ?
Thanks
Since by default WSO2 uses groupId('Organization) of the user to share the Application in the Devpotal as mentioned here in the documentation: sharing applications
You can go to the Carbon UI and search for the LDAP users among which you want to share an Application. Next to the User click on the 'User Profile' tab. There you can edit the value next to the 'Organization' column. For this, your secondary user store should be 'ReadWriteLDAPUserStore'. Similarly, edit the value for each user in the secondary user store to the same value to share the Application among them.
In fact, in the ldap user store if you configure LDAP groups there are automatically created as a role and you can apply permissions to a role which will be apply to all users of your LDAP group.
But I didn't find a way to share applications between users of a LDAP group ...
Here is a better way to achieve it. In the official documentation it is mentioned that it allows the Applications to be shared if we have common roles, in as you said WSO2 treats AD groups as roles. Lets assume you have two users user1 and user2 in your LDAP store both of which are the part of AD group 'AD_Group'.
So mention the AD group name common to the users among which application needs to be shared : -
Also change the configuration as following in the deployment.toml file : -
[apim.devportal]
enable_application_sharing = true
#application_sharing_type = "default"
application_sharing_claim=http://wso2.org/claims/role
I have a requirement where, users (with company username and password) should be available in CQ. We have configured LDAP to authenticate the user on the CQ instance based on his company username and password. But, currently, what is happening is, by default, that user is not present in the list of users we see in CQ. Only after he logs in to CQ instance for the first time, his user profile is getting added to the list of users. Is there a way to create/import all the list of users that we have in the company into CQ without asking them to login??? Basically, I should be able to see all the list of users that we have in the company without asking them to login to the CQ instance. Which means, we should be able to import them.
Or, is the scenario above is invalid, since users are being added as and when we login to the CQ instance. I am a bit unclear about this scenario, so any help is appreciated
CQ provides different ways to achieve this,
Manual synchronization of users using felix console.
Using CURL
Creating JMX client that uses LDAP MBean
I am putting the first way to achieve this, you may refer to the link for the detailed answer:
Manual synchronization of users using felix console.
Open the felix jmx console and log in as admin at http://:/system/console/jmx
Click on domain com.adobe.granite.ldap and it displays list of
attributes and operations that can be performed.
Click on operations and pops up with small window to supply parameter
(if required). Ex:- syncUser operation, supply the DN of the single
user (cn=user001,ou=users,dc=day,dc=com) to be synchronized
Click Invoke to transfer appropriate details from the ldap directory
server to CRX.
We want to give users peoplesoft portal access from outside network. But ..that access needs to be read only and very limited.
Has anyone done location based role enabling is peoplesoft.. i.e. disable all roles and enable only particular role based on ip address or web server ?
I have done something similar to that using DNS entries to determine internal/external access. The users wanted to force Self-Service access to all users when they logged into PeopleSoft if they were at home, but give the users full access if they logged in via VPN or at their desk. That way, power users would not have full security unless they were authenticated via VPN or at work.
We accomplished by customizing the USERMAINT component, created a new security table for "self service" security, adding custom Signon PeopleCode, and setting up a 2nd DNS entry that was exposed for external access.
To start, the network admin set up two sets of DNS entries that pointed to the PS web servers. For example, psoft.company.com was the internal DNS and only set for local network access, and selfservice.company.com was the external DNS available for global access.
Next, we customized the USERMAINT component (User Profile). We hid the delivered Roles tab and replaced it with a copy. The new page was pointing to a copy of PSUSERROLE. We did this because we want to use the delivered PSROLEUSER table as the "current" security table. If the Security Admin wants to update a users internal (or day-job) security, we want to store if for long term. (This will make more sense below). So the new custom table, say XXROLEUSER, is now the master table for security.
Then, we added record/page/component for the Security Admin to define "self service" security (XXSSROLES). This record/page just stores Role Names for when users log in externally. This allows the Security Admin to update self service security for seasonal changes, like Open Enrollment. The admin can add a role during Open Enrollment to grant additional access, and then remove it when the period has ended.
Last, we created a custom Signon PeopleCode step that handles the internal/external security switch. The Signon PeopleCode grabs the URL used to log in. The code parses the URL to see with DNS entry was used to access the system. If the DNS entry is "selfservice.company.com", the code will clear our the rows in PSROLEUSER for the user and insert the roles from the XXSSROLES table. If the DNS entry is "psoft.company.com", the code will clear out PSROLEUSER and insert the roles form the XXROLEUSER table.
This code change turns PSROLEUSER into a transaction table. Because the Tools system relies on this table for many different security functions, it is important to create a copy to use as the "master table" for use in the User Profile component.
If this is something you are interested in trying, I'd be happy to post some sample code for the Signon PeopleCode.
I uploaded the Signon PeopleCode function to GitHub (see link below). You can create a custom record to store the PeopleCode and then add it into the Signon PeopleCode page. If you need more information, let me know. I am not able to post the entire tech spec, but I'd be happy to help if you have questions.
http://github.com/iversond/PeopleTools-Dynamic-Login
Recruiting Solutions uses a similar process - when creating the external Candidate Gateway to allow applicants to apply for positions, a 'guest' ID is created for a particular web server that has severely restricted permissions - basically just the external applicant apply objects.
In PS 9 , have a look at PeopleTools > Web Profile > Web Profile Configuration under the security tab. You can definitely secure the system at a web server level.
HTH
Disclaimer: I work for the company.
A bit late to the party, but a useful answer: IntraSee has developed a solution for this exact situation.
The key is that you need to be able to define rules (locations) and then tie those to specific roles. Evaluated at login, the roles are revoked or granted depending on the rules and user location. It can use IP or other attributes to determine roles.
To do this manually is slightly tricky as you need to account for the versioning of the user profile and associated permissions. Signon PeopleCode is the best place to evaluate these rules as you can do it once per session, and you ahve access to the business data to make correlative decisions. E.G. if a person has a huge approval limit, maybe they can't approve remotely, but someone with a small limit can. Same security access, but add or revoked based on location and data.
To your specific case: you would have base roles with read only access to those users, then a set of 'opt-in' roles that gave read/write. When they come in from the correct location, they get the read/write. So, we are only adding the extra access when appropriate.
I would create a separate site ( like the candidate gateway suggestion ), it will need a similar web profile as the one you are currently using, no other changes would be necessary.
Next create a custom menu, then attach all of the components you wish to make read-only.
Register the content references for those custom_menu.components.
Create Roles and Permission Lists adding the custom_menu.components then select "Display Only". Then assign the roles to the users.
Expose that site via the firewall.
That's it.