Help on permissions

[supni]

Hi

I was trying to add some permissions to the helloworld.war.
So i added the following to the jboss-portlet.xml file

<portlet-app>
<portlet-name>MyPortlet</portlet-name>
security>
model>
<permission-description>
<permission-name>read</permission-name>
description>Reading permission</description
</permission-description>
scheme>
item>
path>/ /path>
permission>
<permission-name>read</permission-name>
<role-name>Admin</role-name>
/permission>
/item>
/scheme>
/model>
/security>
/portlet>
</portlet-app>




But these permissions are not getting listed in the
admin->portal permissions management->HelloworldPortlet section.
Is there any other place where i should add these permissions.
what is the use of "content-provider-class" tag? Is it manadatory and should i write a class for my own application?

If i replace the security part of the above xml with the fragment below, which i copied from the jboss-portal.xml of portal-core.sar The permissions for hellowworld are getting listed in the admin page.

<content-provider-class>org.jboss.portal.core.portlet.user.security.UserModelContentProvider</content-provider-class>
<permission-description>
<permission-name>Admin</permission-name>
description>Global Admin Privilege
</permission-description>
scheme>
item>
path>/

<permission-name>Admin</permission-name>
<role-name>Admin</role-name>

/item>
/scheme>
/model>


And If i assign some roles to a permission, where are those info getting stored ?
When I add or remove roles the jboss-portlet.xml is not getting updated but the values are retained in the application.

There is some problem in the post..there may be some "<" charecters missing.kindly ignore

Can anyone help?

[supni]

I use Jboss AS 4.0.2 and jboss portal 2.0

[jdemilner]

Also, there is no mention of <content-provider-class> in the documentation for security. Can someone explain this element?

[supni]

hi jdemilner

Finally i got it working.
And the content provider class is mandatory.
I started using the UserModelContentProvider.

For adding new permissions you have to add some constants to org.jboss.portal.core.portlet.user.security.UserSecurityConstants.

And add those permissions to a set in the getPermissions method of the org.jboss.portal.core.portlet.user.security.RootItemImpl class.

Then you can refer the permissions in your portlet through jboss-portlet.xml. You can even go for your own implementation of Model contentProvider.

Thanks to jboss team...

[julien1]

the reason why the provider class is not documented a lot is that this feature is reserved for jboss specific portlets in order to provide authorization managed by the portal.

it is subject to changes in 2.2 but the principle with stay the same.

[jdemilner]

So if I am understanding this correctly, the
Permissions Management Module is only for use with
JBoss specific portlets? Because the only way
portlets work with that modules is if here is an
implementation of a provider class?

According to the last post the provider class is
reserved for jboss specific portlets to provide
authorization managed by the portal.

So how do I provide portal managed authorization for
my custom portlets?

I read the limited documentation on security and
understand the concept of and
attributes.

This leaves me with two questions:
1. If you can't use the Permissions Management Module
for non JBoss portlets, how to you change portlet
permissions on the fly? I'm guessing that you can't
and that all has to be specified in the
, attributes, correct?
2. Is the only way to implement security in custom
portlets is to use the and
attributes and check those with the .hasPermission()
method? <then you display a specific view based on
those calls?>

[jdemilner]

some of my previous words got omitted from my previous post.

This is a partial repost:

I read the limited documentation on security and
understand the concept of security and model
attributes.

This leaves me with two questions:
1. If you can't use the Permissions Management Module
for non JBoss portlets, how to you change portlet
permissions on the fly? I'm guessing that you can't
and that all has to be specified in the
security, model attributes, correct?
2. Is the only way to implement security in custom
portlets is to use the security and model
attributes and check those with the .hasPermission()
method? (then you display a specific view based on
those calls?)

[supni]

Hi
Think you can't expect all jboss functionalities to work on non Jboss portlets.

Converting non-Jboss protlets to JBoss compliant is not a big deal.

SUPNI

[julien1]

Hello jdelminer,

we said that it is used internally that does not prevent you to use it though. The main concern now is that the API is not stable and will be probably change in 2.2. If you decide to use it, it is fine, because it means that your portlet integrates better with JBoss Portal. But you need to be aware that it will change. However we can help you on the forums to migrate to the new API.

"jdemilner" wrote:
some of my previous words got omitted from my previous post.

This is a partial repost:

I read the limited documentation on security and
understand the concept of <b>security</b> and <b>model</b>
attributes.

This leaves me with two questions:
1. If you can't use the Permissions Management Module
for non JBoss portlets, how to you change portlet
permissions on the fly? I'm guessing that you can't
and that all has to be specified in the
<b>security</b>, <b>model</b> attributes, correct?
2. Is the only way to implement security in custom
portlets is to use the <b>security</b> and <b>model</b>
attributes and check those with the .hasPermission()
method? (then you display a specific view based on
those calls?)