Re: Can't get rejected by Lenya
Ben Pracht <[email protected]> Sat, 2 Nov 2013 23:14:37 -0400
| Newsgroups | gmane.comp.cms.lenya.user |
|---|---|
| Message-ID | <CAPB8cd0x+EQ29RDYOLgMG79jRHrAapKT_TiiFUfmD27BZ=RNRA@mail.gmail.com> |
--001a11345d3c126ba004ea3d3351
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Thanks the replies. I understand the delays, as this is not my day job,
probably much like the kind people on this list. I upgraded to 2.0.4 and I
can now create publications wherein I restrict access to a select group of
members. Overall, I think it was an improvement, though I couldn't find a
prebuilt version. Unfortunately, after doing this, it sometimes tells me
that user "lenya" doesn't have access to author a page. I don't recall
doing anything to the lenya user. I'm not sure which XML file needs to be
edited to restore lenya. (I'll switch to real users when I have something
approaching decent). There's two main websites (publications), a public
and a private. So far, the private one seems to work the way I want, it's
just the public one that's giving me fits.
Below is what I have for subtree-policy.acml:
<?xml version=3D"1.0" encoding=3D"UTF-8"?>
<ac:policy xmlns:ac=3D"http://apache.org/cocoon/lenya/ac/1.0"
ssl=3D"false">
<ac:group id=3D"editor">
<ac:role id=3D"edit" method=3D"grant" />
</ac:group>
<ac:group id=3D"reviewer">
<ac:role id=3D"review" method=3D"grant" />
</ac:group>
<ac:group id=3D"admin">
<ac:role id=3D"admin" method=3D"grant" />
</ac:group>
<ac:group id=3D"sitemanager">
<ac:role id=3D"sitemanager" method=3D"grant" />
</ac:group>
<ac:world>
<ac:role id=3D"edit" method=3D"deny" />
</ac:world>
<ac:world>
<ac:role id=3D"sitemanager" method=3D"deny" />
</ac:world>
</ac:policy>
Thanks,
Ben
On Fri, Oct 25, 2013 at 1:01 PM, florent andr=E9 <
[email protected]> wrote:
> Hi,
>
> First, please forgive for the time to answer, my web/mail provider was
> hacked a I lost my mail account.
>
> 1.2.5 is pretty old and I don't have so much knowledge on it.
>
> What I can suggest you is to mimic the configuration in the "authoring"
> publication part that don't allow visitor to view the content.
>
> In 2.0.x version, deny access is done by don't give access more than deny
> access.
>
> Exemple for authoring zone <ac:world><ac:role id=3D"session" method=3D"gr=
ant"/>
>
> ++
>
>
> On 10/17/2013 06:23 AM, Ben Pracht wrote:
>
>> I'm using a prebuilt Lenya 1.2.5. I'm trying to *not* have to write
>> code to do this.
>>
>> I'm doing a non-public site for a local club in my area that I want to
>> have members sign on before even seeing any content. I'd essentially
>> like to deny the world, even localhost, unless they first authenticate.
>>
>> Below is what I'm working with. I'm sorry if I omitted anything, I just
>> could not make sense of the security mechanism enough to know what's
>> relevant.
>>
>> An example URL I'd like blocked is:
>> http://localhost:8888/MembersOnly/live/Welcome.html
>>
>>
>> lenya/pubs/MembersOnly/config/ac/policies/live/Welcome/
>> subtree-policy.acml
>> lenya/pubs/MembersOnly/config/ac/policies/live/subtree-policy.acml
>> lenya/pubs/MembersOnly/config/ac/policies/subtree-policy.acml
>>
>> Each of the above look like this:
>>
>>
>> My ac.xconf looks like:
>>
>> <policy xmlns=3D"http://apache.org/cocoon/lenya/ac/1.0">
>>
>> <world>
>> <role id=3D"visit" method=3D"deny"/>
>> </world>
>>
>> </policy>
>>
>> <access-controller type=3D"bypassable">
>>
>> <accreditable-manager type=3D"file">
>> <parameter name=3D"directory"
>> value=3D"context:///lenya/pubs/MembersOnly/config/ac/passwd"/>
>>
>> <user-manager>
>> <user-type class=3D"org.apache.lenya.ac.file.FileUser"
>> create-use-case=3D"userAddUser">Local User</user-type>
>> <!-- uncomment the following line if you want LDAP support -->
>> <!-- <user-type class=3D"org.apache.lenya.ac.ldap.LDAPUser"
>> create-use-case=3D"userAddUserLdap">LDAP User</user-type> -->
>> </user-manager>
>> </accreditable-manager>
>>
>> <policy-manager type=3D"document">
>> <policy-manager type=3D"file">
>> <parameter name=3D"directory"
>> value=3D"context:///lenya/pubs/MembersOnly/config/ac/policies"/>
>> </policy-manager>
>> </policy-manager>
>>
>> <authorizer type=3D"policy"/>
>>
>> <authorizer type=3D"usecase">
>> <parameter name=3D"configuration"
>> value=3D"context:///lenya/pubs/MembersOnly/config/ac/usecase-
>> policies.xml"/>
>> </authorizer>
>>
>> <authorizer type=3D"workflow"/>
>>
>> </access-controller>
>>
>> ---------- Log file snippet -------
>> 24995 2013-10-12 00:31:35,383 [PoolThread-4] DEBUG
>> lenya.ac.cache.get():161 - Caching object
>> [org.apache.lenya.ac.impl.DefaultPolicy@65089d7] for further requests of
>> [file:/C:/java/eclipse/ClubSoftware/Lenya/lenya/pubs/
>> MembersOnly/config/ac/policies/live/Welcome/subtree-policy.acml].
>>
>> 24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG
>> lenya.ac.policymanager.file.buildPolicy():149 - Policy exists: [true]
>>
>> 24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG
>> lenya.ac.authorizer.policy.saveRoles():156 - Adding roles [ visit ] to
>> request [org.apache.cocoon.environment.http.HttpRequest@2457c24c]
>>
>> 24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG
>> lenya.ac.authorizer.policy.authorize():111 - Authorized: true
>>
>> 24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():121 - Authorizer
>> [org.apache.lenya.ac.impl.PolicyAuthorizer@6566aa35] returned [true]
>>
>> 24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():108 -
>> ---------------------------------------------------------
>>
>> 24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():109 - Invoking
>> authorizer [org.apache.lenya.cms.ac.usecase.UsecaseAuthorizer@26456721]
>>
>> 24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG
>> lenya.ac.authorizer.usecase.authorize():104 - No usecase to authorize.
>> Granting access.
>>
>> 24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():121 - Authorizer
>> [org.apache.lenya.cms.ac.usecase.UsecaseAuthorizer@26456721] returned
>> [true]
>>
>> 24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():108 -
>> ---------------------------------------------------------
>>
>> 24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():109 - Invoking
>> authorizer [org.apache.lenya.cms.ac.workflow.WorkflowAuthorizer@7e1b0beb=
]
>>
>> 24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG
>> lenya.ac.authorizer.workflow.authorize():69 - Authorizing workflow for
>> event [null]
>>
>> 24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():121 - Authorizer
>> [org.apache.lenya.cms.ac.workflow.WorkflowAuthorizer@7e1b0beb] returned
>> [true]
>>
>> 24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():130 -
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D
>>
>> 24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():131 - Authorization
>> complete, result: [true]
>>
>> 24998 2013-10-12 00:31:35,386 [PoolThread-4] DEBUG
>> lenya.ac.accesscontroller.bypassable.authorize():132 -
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D
>>
>> 24998 2013-10-12 00:31:35,386 [PoolThread-4] DEBUG
>> sitemap.decommission():342 - ComponentFactory decommissioning instance
>> of org.apache.lenya.cms.cocoon.acting.DelegatingAuthorizerAction.
>>
>>
>>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>
--001a11345d3c126ba004ea3d3351
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>Thanks the replies.=A0 I understand the delays, as th=
is is not my day job, probably much like the kind people on this list.=A0 I=
upgraded to 2.0.4 and I can now create publications wherein I restrict acc=
ess to a select group of members.=A0 Overall, I think it was an improvement=
, though I couldn't find a prebuilt version.=A0 Unfortunately, after do=
ing this, it sometimes tells me that user "lenya" doesn't hav=
e access to author a page.=A0 I don't recall doing anything to the leny=
a user.=A0 I'm not sure which XML file needs to be edited to restore le=
nya.=A0 (I'll switch to real users when I have something approaching de=
cent).=A0 There's two main websites (publications), a public and a priv=
ate.=A0 So far, the private one seems to work the way I want, it's just=
the public one that's giving me fits.=A0 <br>
<br><br></div><div>Below is what I have for subtree-policy.acml:<br><?xm=
l version=3D"1.0" encoding=3D"UTF-8"?><br><ac:pol=
icy xmlns:ac=3D"<a href=3D"http://apache.org/cocoon/lenya/ac/1.0">http=
://apache.org/cocoon/lenya/ac/1.0</a>"<br>
=A0=A0=A0 ssl=3D"false"><br>=A0=A0=A0 <ac:group id=3D"=
editor"><br>=A0=A0=A0 =A0=A0=A0 <ac:role id=3D"edit" m=
ethod=3D"grant" /><br>=A0=A0=A0 </ac:group><br>=A0=A0=A0=
<ac:group id=3D"reviewer"><br>
=A0=A0=A0 =A0=A0=A0 <ac:role id=3D"review" method=3D"gran=
t" /><br>=A0=A0=A0 </ac:group><br>=A0=A0=A0 <ac:group id=
=3D"admin"><br>=A0=A0=A0 =A0=A0=A0 <ac:role id=3D"admi=
n" method=3D"grant" /><br>
=A0=A0=A0 </ac:group><br>=A0=A0=A0 <ac:group id=3D"sitemanage=
r"><br>=A0=A0=A0 =A0=A0=A0 <ac:role id=3D"sitemanager"=
method=3D"grant" /><br>=A0=A0=A0 </ac:group><br>=A0=A0=
=A0 <ac:world><br>=A0=A0=A0 =A0=A0=A0 <ac:role id=3D"edit&quo=
t; method=3D"deny" /><br>
=A0=A0=A0 </ac:world><br>=A0=A0=A0 <ac:world><br>=A0=A0=A0 =A0=
=A0=A0 <ac:role id=3D"sitemanager" method=3D"deny" /=
><br>=A0=A0=A0 </ac:world><br></ac:policy><br><br><br></div>=
<div>Thanks,<br>Ben<br></div><div>
<br><br><br><br></div></div><div class=3D"gmail_extra"><br><br><div class=
=3D"gmail_quote">On Fri, Oct 25, 2013 at 1:01 PM, florent andr=E9 <span dir=
=3D"ltr"><<a href=3D"mailto:[email protected]" target=3D"_=
blank">[email protected]</a>></span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">Hi,<br>
<br>
First, please forgive for the time to answer, my web/mail provider was hack=
ed a I lost my mail account.<br>
<br>
1.2.5 is pretty old and I don't have so much knowledge on it.<br>
<br>
What I can suggest you is to mimic the configuration in the "authoring=
" publication part that don't allow visitor to view the content.<b=
r>
<br>
In 2.0.x version, deny access is done by don't give access more than de=
ny access.<br>
<br>
Exemple for authoring zone <ac:world><ac:role id=3D"session&q=
uot; method=3D"grant"/><br>
<br>
++<div><div class=3D"h5"><br>
<br>
On 10/17/2013 06:23 AM, Ben Pracht wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
I'm using a prebuilt Lenya 1.2.5. =A0I'm trying to *not* have to wr=
ite<br>
code to do this.<br>
<br>
I'm doing a non-public site for a local club in my area that I want to<=
br>
have members sign on before even seeing any content. =A0I'd essentially=
<br>
like to deny the world, even localhost, unless they first authenticate.<br>
<br>
Below is what I'm working with. =A0I'm sorry if I omitted anything,=
I just<br>
could not make sense of the security mechanism enough to know what's<br=
>
relevant.<br>
<br>
An example URL I'd like blocked is:<br>
<a href=3D"http://localhost:8888/MembersOnly/live/Welcome.html" target=3D"_=
blank">http://localhost:8888/<u></u>MembersOnly/live/Welcome.html</a><br>
<br>
<br>
lenya/pubs/MembersOnly/config/<u></u>ac/policies/live/Welcome/<u></u>subtre=
e-policy.acml<br>
lenya/pubs/MembersOnly/config/<u></u>ac/policies/live/subtree-<u></u>policy=
.acml<br>
lenya/pubs/MembersOnly/config/<u></u>ac/policies/subtree-policy.<u></u>acml=
<br>
<br>
Each of the above look like this:<br>
<br>
<br>
My ac.xconf looks like:<br>
<br>
<policy xmlns=3D"<a href=3D"http://apache.org/cocoon/lenya/ac/1.0" =
target=3D"_blank">http://apache.org/<u></u>cocoon/lenya/ac/1.0</a>">=
;<br>
<br>
=A0 =A0<world><br>
=A0 =A0 =A0<role id=3D"visit" method=3D"deny"/><b=
r>
=A0 =A0</world><br>
<br>
</policy><br>
<br>
<access-controller type=3D"bypassable"><br>
<br>
=A0 =A0<accreditable-manager type=3D"file"><br>
=A0 =A0 =A0<parameter name=3D"directory"<br>
value=3D"context:///lenya/pubs/<u></u>MembersOnly/config/ac/passwd&quo=
t;/<u></u>><br>
<br>
=A0 =A0 =A0<user-manager><br>
=A0 =A0 =A0 =A0 <user-type class=3D"<a href=3D"http://org.apache.le=
nya.ac" target=3D"_blank">org.apache.lenya.ac</a>.<u></u>file.FileUser"=
;<br>
create-use-case=3D"userAddUser"><u></u>Local User</user-typ=
e><br>
=A0 =A0 =A0 =A0 <!-- uncomment the following line if you want LDAP suppo=
rt --><br>
=A0 =A0 =A0 =A0 <!-- <user-type class=3D"<a href=3D"http://org.a=
pache.lenya.ac" target=3D"_blank">org.apache.lenya.ac</a>.<u></u>ldap.LDAPU=
ser"<br>
create-use-case=3D"<u></u>userAddUserLdap">LDAP User</user-=
type> --><br>
=A0 =A0 =A0</user-manager><br>
=A0 =A0</accreditable-manager><br>
<br>
=A0 =A0<policy-manager type=3D"document"><br>
=A0 =A0 =A0<policy-manager type=3D"file"><br>
=A0 =A0 =A0 =A0<parameter name=3D"directory"<br>
value=3D"context:///lenya/pubs/<u></u>MembersOnly/config/ac/<u></u>pol=
icies"/><br>
=A0 =A0 =A0</policy-manager><br>
=A0 =A0</policy-manager><br>
<br>
=A0 =A0<authorizer type=3D"policy"/><br>
<br>
=A0 =A0<authorizer type=3D"usecase"><br>
=A0 =A0 =A0 =A0<parameter name=3D"configuration"<br>
value=3D"context:///lenya/pubs/<u></u>MembersOnly/config/ac/usecase-<u=
></u>policies.xml"/><br>
=A0 =A0</authorizer><br>
<br>
=A0 =A0<authorizer type=3D"workflow"/><br>
<br>
</access-controller><br>
<br>
---------- Log file snippet -------<br>
24995 2013-10-12 00:31:35,383 [PoolThread-4] DEBUG<br>
lenya.ac.cache.get():161 =A0- Caching object<br>
[org.apache.lenya.ac.impl.<u></u>DefaultPolicy@65089d7] for further request=
s of<br>
[file:/C:/java/eclipse/<u></u>ClubSoftware/Lenya/lenya/pubs/<u></u>MembersO=
nly/config/ac/<u></u>policies/live/Welcome/subtree-<u></u>policy.acml].<br>
<br>
24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG<br>
lenya.ac.policymanager.file.<u></u>buildPolicy():149 =A0- Policy exists: [t=
rue]<br>
<br>
24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG<br>
lenya.ac.authorizer.policy.<u></u>saveRoles():156 =A0- Adding roles [ visit=
] to<br>
request [org.apache.cocoon.<u></u>environment.http.HttpRequest@<u></u>2457c=
24c]<br>
<br>
24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG<br>
lenya.ac.authorizer.policy.<u></u>authorize():111 =A0- Authorized: true<br>
<br>
24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():121 =A0- Authorizer=
<br>
[org.apache.lenya.ac.impl.<u></u>PolicyAuthorizer@6566aa35] returned [true]=
<br>
<br>
24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():108 =A0-<br>
------------------------------<u></u>---------------------------<br>
<br>
24996 2013-10-12 00:31:35,384 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():109 =A0- Invoking<b=
r>
authorizer [<a href=3D"http://org.apache.lenya.cms.ac" target=3D"_blank">or=
g.apache.lenya.cms.ac</a>.<u></u>usecase.UsecaseAuthorizer@<u></u>26456721]=
<br>
<br>
24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG<br>
lenya.ac.authorizer.usecase.<u></u>authorize():104 =A0- No usecase to autho=
rize.<br>
Granting access.<br>
<br>
24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():121 =A0- Authorizer=
<br>
[<a href=3D"http://org.apache.lenya.cms.ac" target=3D"_blank">org.apache.le=
nya.cms.ac</a>.<u></u>usecase.UsecaseAuthorizer@<u></u>26456721] returned [=
true]<br>
<br>
24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():108 =A0-<br>
------------------------------<u></u>---------------------------<br>
<br>
24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():109 =A0- Invoking<b=
r>
authorizer [<a href=3D"http://org.apache.lenya.cms.ac" target=3D"_blank">or=
g.apache.lenya.cms.ac</a>.<u></u>workflow.WorkflowAuthorizer@<u></u>7e1b0be=
b]<br>
<br>
24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG<br>
lenya.ac.authorizer.workflow.<u></u>authorize():69 =A0- Authorizing workflo=
w for<br>
event [null]<br>
<br>
24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():121 =A0- Authorizer=
<br>
[<a href=3D"http://org.apache.lenya.cms.ac" target=3D"_blank">org.apache.le=
nya.cms.ac</a>.<u></u>workflow.WorkflowAuthorizer@<u></u>7e1b0beb] returned=
<br>
[true]<br>
<br>
24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():130 =A0-<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D<u></u>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
<br>
24997 2013-10-12 00:31:35,385 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():131 =A0- Authorizat=
ion<br>
complete, result: [true]<br>
<br>
24998 2013-10-12 00:31:35,386 [PoolThread-4] DEBUG<br>
lenya.ac.accesscontroller.<u></u>bypassable.authorize():132 =A0-<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D<u></u>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
<br>
24998 2013-10-12 00:31:35,386 [PoolThread-4] DEBUG<br>
sitemap.decommission():342 =A0- ComponentFactory decommissioning instance<b=
r>
of org.apache.lenya.cms.cocoon.<u></u>acting.<u></u>DelegatingAuthorizerAct=
ion.<br>
<br>
<br>
</blockquote>
<br></div></div>
------------------------------<u></u>------------------------------<u></u>-=
--------<br>
To unsubscribe, e-mail: <a href=3D"mailto:[email protected]=
" target=3D"_blank">[email protected].<u></u>org</a><br>
For additional commands, e-mail: <a href=3D"mailto:[email protected]=
rg" target=3D"_blank">[email protected]</a><br>
<br>
</blockquote></div><br></div>
--001a11345d3c126ba004ea3d3351--