Trouble with Security

Hello,

I am building a online web application using Revolution Beta 5. My main page is a login page, and I want all of the other pages to be hidden until a user I have set up logs in. Here’s what I have so far:

1. created a user in "Manage Users"

2. created a resource group and moved a document into it as a test

3. created a user group where I:

* added my new user to it
* added the context "web" to it
* added my resource group that contains the document to it

4. added the login snippet to the login page

When I go to the web side of the app, I don’t see the secured page (good so far). When I login with the user I set up, the page doesn’t show up on the wayfinder menu that I have in place. So I thought maybe it was the wayfinder that was the problem. However, I am also unable to directly navigate to the resource page either. I have tried different Access Policy levels, and everything I can think of. It seems as though the policy for view, a long with many other access polices should be in place. The only way I can get my page to display again is to remove the page from the resource group.

There must be something I have overlooked!

Ed

Quote from: ehoskins at Feb 14, 2010, 09:47 AM

3. created a user group where I:

* added my new user to it
* added the context "web" to it
* added my resource group that contains the document to it

What Policy did you assign this access control entry? And what Authority (i.e. Role)? Is the user in the Role you picked?

Quote from: ehoskins at Feb 14, 2010, 09:47 AM

When I go to the web side of the app, I don’t see the secured page (good so far). When I login with the user I set up, the page doesn’t show up on the wayfinder menu that I have in place. So I thought maybe it was the wayfinder that was the problem. However, I am also unable to directly navigate to the resource page either. I have tried different Access Policy levels, and everything I can think of. It seems as though the policy for view, a long with many other access polices should be in place. The only way I can get my page to display again is to remove the page from the resource group.

What matters is the Authority level and the Permissions that you assign to the User Group/Resource Group access control entry via a Policy. If you assigned the default Resource Group policy, a) make sure you flush sessions after adding the access control entry (permissions are cached in each user’s session) and b) log out of the manager before viewing or view the Resource in another browser, because by default, managers get their permissions when viewing the front-end (i.e. that’s not a true anonymous view of the Resource when logged into the manager).

I have actually tried every built-in policy that is available. When adding my user to the user group, I have tried both "Member" and "Super User". When adding contexts, I have tried both "Administrator" and "Resource". And when adding the resource group, I have tried both "Administrator" and "Resource".

Now, I have not closed out of the manager and flushed the sessions between these attempts, so I can try these things again. It is quite possible that I had things set up correctly at some point, but did not have a fresh environment to test in.

I will re-post my results later today. Thank you!

Ed

Ok, I have re-test this. I have given the user the role of "Super User", the context has the access policy of "Administrator" and the resource group has the policy of "Administrator" for the context web. I now have access to the protected page. I would imagine that I can now do some testing and find out where the access can be more restricted if needed. The difference was that I did the "Flush all Sessions" before testing. So, thank you, that was a great tip (and to know that being logged into the manager affects the web side).

The only remaining problem is that the latest Wayfinder menu has quite a few problems in displaying what is actually available on the site. Depending upon where I click in the the menu structure, the protected menu appears and disappears whether I click on a menu link or a page link. I would imagine that the wayfinder developers are aware of this problem.

Based on if I am logged in or not, I can directly navigate to the page when it is available.

Thank you for your help!

Ed

I’m not sure you are quite understanding the security model yet; I would read this for a good introduction to Revolution permissions.

Restricting access to Resources in the web Context (or any front-end Context you create) via Resource Groups and User Groups does not involve Context ACLs, just Resource Group ACLs. Also, unless you need to have different permissions for different types of members of a User Group, you do not need to mess with Roles; just use Member.

And re: Wayfinder, there should be no problem with it; make sure you are not caching any calls to Wayfinder to build menus that will show protected Resources conditionally, based on the User that accesses it. Otherwise, the first person to access the page will have their view of the menu cached for everyone else to see, regardless of anyone’s access permissions.