By taking reference from this post and I am successful in authenticating the user. But this post does not authenticate new users that are not present in alfresco. I have also explored SSOAuthenticationFilter.java to find how alfresco creates user when external authentication subsystem is used but not able figure out how the creation of user takes place in the mentioned subsystem. It would be great if anyone could provide the way to create and authenticate user that are not present in alfresco.
Which version of Alfresco do you use ?
Recent version provide a similar function, please take a look to : http://docs.alfresco.com/community/concepts/auth-basics.html
The only thing you need to need is define the header name in your global properties files.
About the new user creation, in Alfresco behaviour it's based on the synchronization.syncWhenMissingPeopleLogIn properties : http://docs.alfresco.com/community/concepts/sync-props.html
When an unknown user try to loggin Alfresco will trigger a synchronization.
Y.
Related
Is there a way to make admin not able to delete user from Active Directory? I need to disable this feature some how in global properies or else. I want admin only to create users,edit them and disable them, but not delete. The version of Alfresco is Community 5.2. Thanks in advance.
I guess you mean the other way around:
Is there a way to prevent admin from deleting users which have been created by ldap sync?
or do you mean:
Is there a way to revoke permission to delete any user?
Do you understand the difference between a user which has been created by ldap sync and a user manually created in the Alfresco admin UI?
There is no (easy and supported) way I know of to restrict admin permissions or for a member of the group ALFRESCO_ADMINISTRATORS. The ROLE_ADMINISTRATOR has always any permission.
There maybe a way to achieve what you expect in a customization module implementing a new behavior which disallows user deletion in a specific zone or by creating your own permissionGroups/permissions in a customPermissionDefinitions, setting the new introduced permissions on the user zones to specific groups but that kind of customization would be hard to maintain on later updates/upgrades.
EDIT:
What is your use case for allowing (end) users to create new users inside Alfresco although you have an user directory (AD) in place?
If your aim is to support external users, managed by specific internal user groups you may add another directory like samba4 which your internal users may get permissions to create/delete users (that's what we actually do from/thru our CRM system) or if you prefer integrations with OAuth2 providers such as Google, Facebook, Github you may take a look on the Spring Cloud Gateway for the Alfresco platform project
I have a set of API endpoints which is redirected to the respective Xquery modules using a custom rewriter(that uses rest:rewrite) and custom error handler (that uses $error:errors). The HTTP calls are of GET and POST methods.
When I try to access the API with a non-admin user(app specific user without admin role), I'm getting 404 not found error.
But when I assign the admin role to this user, I'm able to get the results.
As per my understanding, we should not assign the admin roles to app specific user in ML.
I need to know whether I'm missing any execute privileges or roles to be assigned for this user. Or what could be done to resolve this issue?
I suspect you have uploaded your modules with document permissions causing the user you are using to not be able to execute the required code, which likely includes rewriter and error handler as well.
Check which modules database is behind the app-server that you are using, and use QConsole to check permissions of the modules you loaded. Compare the roles mentioned there with those of the user that you are using. Solution is then to either apply different permissions to your modules, or add extra role to your user.
HTH!
After referring so many forums, I am able to authenticate and sync active directory users to alfresco. The problem is we have more than 25,000 users and rite now we are planning to open alfresco only for selected users. Whenever someone search people they will be finding all the 25,000 users who are not even using alfresco. My It team is not willing to create seperate group for these selected members. Is it possible to sync only users who are logged in.
I am using alfresco 4.2e Binary Installation. Windows 7 64 bit.
The most easiest way would be to distinct users to sync via LDAP query.
You could find this link useful.
This scenario should do it:
enable ldap authentication
configure the authenication chain to include Alfresco and LDAP. This will ensure to try to authenticat against both systems. e.g.
authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap-ad1:ldap-ad
disable sync
# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=false
If you start Alfresco the very first time there is no user in Alfresco. Depending on your strategy how to control the user creatioin you could ether:
create user manual
If you're running on linux the easiest way would be to use the alfresco-shell-tools otherwise you could use the csv-import feature in the user admin. The trick is to use the same username so Alfresco will try to authenticat against both systems before it fails.
create user on first login
Another way is to enable implicit user creation on first login. This isn't my recommendation since you will get trouble later because the user has no email address configured / no user info is synced. (This way is not tested - if this doesn't work you may define a sync query which doesn't return users to enable sync)
synchronization.autoCreatePeopleOnLogin=true
you will get the auto-creation of people who were successfully authenticated but weren't brought in by the sync
you need to add/change this line also on ldap-authentication.properties :
ldap.authentication.active=true
ldap.synchronization.active=false
ldap.synchronization.autoCreatePeopleOnLogin=false
synchronization.syncOnStartup=false
synchronization.syncWhenMissingPeopleLogIn=false
and add on alfresco-global.properties :
create.missing.people=false
I'm a new to Drupal but I just want to hack/customize the login function of Drupal 7, like hardcoding. As i have discovered that Drupal 7 login process is handling by user.module and its associated files.
I just wanna know which kinds of values or properties are returning or providing when a user logging/authentication process is done by providing just Username/Password.
The final properties it returns, to provide back to Drupal (along the whole authentication process) that I just noticed so far are:
{uid} of the attempted user
{rid} role id of the user
user email
user is blocked or not
then .. ?
The point is .. what other else?
Can i replace/modify the whole existing authentication process? (as i need)
For example, one of the default auth functions in user.module:
function user_authenticate($name, $password) {
..
return $uid;
}
For example, if i modify (hardcode) that function to connect to my other external database(s) and return {user id}, the Drupal will get one auth requirement {uid}. Then what other else to provide? User Role and .. etc etc ?
Like that .. what other functions and properties else should i touch and provide back to Drupal along the authentication process?
This is not an actual answer but I cannot post this as a comment.
Basically we do not hack core. So looking at the user.module's code will not help you very much than learning the hooks. For an example, It's difficult to get an idea about how to add some magic when a node is created by looking at the code of hook_nodeapi(). But if you check the docs and the return/input arguments, it's much easier to do the job.
I'd start by adding an extra submit handler to login form using hook_form_alter(). I have seen some other threads from you about your use case but unfortunately it's difficult to provide a sample code for you.. You can see how other modules implement extra authentication (e.g: http://bit.ly/LdRcm6). (See how Remember Me module adds a checkbox to login form and twitter module that allows twitter login).
Then, you can have Drupal to authenticate the user as normal, and your new custom functionality in addition the Drupal's authentication.
Drupal can even connect to external databases no matter if it's Drupal or not.
As you can see in many functions, they returns a Boolean value or sometimes, the user ID. user_load() is the function that loads a basic user object.
Remember it's modular. Some modules can include/remove/alter these values using hook_user_load(). user terms module and profile module is a perfect example here. It includes profile field information when other modules require user information.
A single user is not just a set of information. It can be modified during any part of the process. So do that. Use your module to provide information that your external site has.
{uid} of the attempted user
{rid} role id of the user
user email
user is blocked or not
user last login time.
user register date.
...
To see the entire object for your site, enter the following.
<pre>
<?php
$user_account = user_load (1);
print_r($user_account);
?>
</pre>
You can enter this code in a node create page where you have php filter used.
Without hardcoding, you can allow other modules to make use of these values. Even if your source database has no role ID, you can ive them a role ID, a user ID, and such.
Good luck!
Drupal is an extensible system. There is no need to do "hardcoding" in core modules like the "user" module. You should rather explore the hook system that allows extending the core (and also contributed) modules.
And in case you want to fetch user id's from a different database (I am not clear about this usecase), you can still use the roles, and other user data, from Drupal's database.
My users access Drupal through SSO and everytime the server authorizes them, it returns a set of permissions (groups/roles), according to which I need to dynamically set the User's forum permissions.
So for example if a User logs in and the SSO says that he has enrolled in a course, I need to give him specific permissions for that course's forum.
Obviously I need a custom module for that, but it's a little hard to start.
I'm thinking of using the ACL module's API, but I can find any documentation or tutorial online. Is there any?
Is there a better way to get around this?
I'd appreciate any help :)
(note: I know there are modules with GUI that have similar functionality but I need to do it programmatically)
We just put something exactly like this into place - we used the Rules module (with the User logged in trigger), checking the LDAP groups that the user is enrolled in, and assigned the role accordingly.
Check out Forum Access. It can restrict users based on their roles.
You could have your roles be something like "CSC221 Student". If a user has this role, they will be able to access the CSC221 forum.
Create a hook_user function ( see http://api.drupal.org/api/function/hook_user ) in your module.
Then using http://drupal.org/project/permissions_api set the appropriate permissions on the user.