We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 40385
    • 75 Posts
    Hello guys,

    I am working on some kind of difficult workflow. So far everything is working except for one little tiny piece. But no matter what I try or do, I can't figure it out. Here it is:

    I am using the modActiveDirectory plugin to authenticate my users against ldap. Besides that I am running another custom plugin that adds the new user to a certain user group, creates resource groups etc. and finally creating a unique resource for this particular user. This custom plugin is fired OnUserFormSave and is working without any problems when creating the user directly in the MODx backend. Of course when using the modActiveDirectory plugin for creating new users the OnUserFormSave event is not being fired and my custom plugin doesn't do anything. So what I did to bypass this problem, I added the following line to the modActiveDirectory plugin to invoke this event manually:

    $modx->invokeEvent('OnUserFormSave', array(
    'mode'=>'new',
    'id'=>$user->get('id')
    ));


    All steps from my custom plugin (create new user group, resource group, join the new user to these groups) are working except for the creation of a resource. I always receive the error message:

    [2015-08-06 09:54:06] (ERROR @ /manager/index.php) Permission denied!


    Here's the code excerpt for creating the resource:

    /* Create corresponding resource */
    $fields['createdby'] = 1;
    $fields['parent'] = $parentId;
    $fields['template'] = $templateId;
    $fields['pagetitle'] = $title;
    $fields['published'] = 1;
    $response = $modx->runProcessor('resource/create', $fields);
    if ($response->isError()) {
        $modx->log(xPDO::LOG_LEVEL_ERROR,'Error Message: '.$response->getMessage());
        return;
    }
    


    Now my question: Why is the resource creation working when the OnUserFormSave is fired natively and why is it not working when I fire the event manually within the modActiveDirectory plugin? Any ideas?

    Thanks in advance!

    This question has been answered by paul_kemp. See the first response.

    • discuss.answer
      • 40385
      • 75 Posts
      Solution: Since this whole modx installation is protected resp. running on an intranet server I just gave admin rights to the anonymous user group. Now everything is working...

      WARNING: Don't apply this solution if your system is running on the internet without any access restrictions.
        • 3749
        • 24,544 Posts
        FYI, these are the variables expected by OnUserFormSave

         'mode' => modSystemEvent::MODE_NEW,
         'user' => &$user,
         'id' => $user->get('id'), 


        My guess is that because you're not sending the user object reference, the permissions tests for creating a resource fail.

          Did I help you? Buy me a beer
          Get my Book: MODX:The Official Guide
          MODX info for everyone: http://bobsguides.com/modx.html
          My MODX Extras
          Bob's Guides is now hosted at A2 MODX Hosting
          • 40385
          • 75 Posts
          Ohh okay...I see. This makes sense! Thanks @BobRay
            • 40385
            • 75 Posts
            BTW: I just tested @BobRay solution and it is not working. Permission is still denied.
              • 3749
              • 24,544 Posts
              Are you sure you have the $user object at the point that you're invoking the event and that the user is logged into the proper context?
                Did I help you? Buy me a beer
                Get my Book: MODX:The Official Guide
                MODX info for everyone: http://bobsguides.com/modx.html
                My MODX Extras
                Bob's Guides is now hosted at A2 MODX Hosting
                • 40385
                • 75 Posts
                The user is not logged in at this point. The plugin is doing all these steps while syncing with ldap/microsoft active directory.

                What I just don't get is: Why is the resource group creation, user group creation, joining user groups etc. working while the resource creation isn't? The plugin receives the user name and id for the resource group and user group name. So I guess the user object is available... [ed. note: paul_kemp last edited this post 11 years, 1 month ago.]
                  • 3749
                  • 24,544 Posts
                  Presumably, you're LDAP code is in a plugin attached to OnWebAuthentication. At that point, the user gets marked as authorized, but is not logged in.

                  Maybe you could move your other code to OnWebLogin, at which point the user is logged in.

                  Another option is to create the resource directly with $modx->newObject('modResource'), rather than using the resource/create processor. That should bypass the permission checks.

                    Did I help you? Buy me a beer
                    Get my Book: MODX:The Official Guide
                    MODX info for everyone: http://bobsguides.com/modx.html
                    My MODX Extras
                    Bob's Guides is now hosted at A2 MODX Hosting