Re: [xwiki-users] How do I get a user to add himself to a group?
Small typo: The check is made on whether the page that holds the groovy script was
saved
*BY* *AN USER* *WHO HAS* programming rights.
Guillaume
The page that contains the Groovy script was create by me, (admin), and it executes without a problem. It returns the expected results. It is not the issue.
On Thu, Jun 11, 2009 at 8:35 PM, Guillaume Lerouge <guillaume@xwiki.com>wrote:
Hi Dean,
On Thu, Jun 11, 2009 at 7:49 PM, Dean G Weber <Dean.G.Weber@raytheon.com>wrote:
I've been struggling for a while with the dilemma of getting a user into a group. Let me supply some background on what we've been trying to do with Xwiki.
We're trying to use Xwiki for an internal collaborative site. Management has decided that users of the wiki must complete proper training. Without the training, the user cannot add to the wiki pages.
For authentication, we've connected the wiki to our LDAP server via the xwik.cfg file. Authenticated users are automatically placed into the XWikiAllGroup by default. In order to accommodate management requirements, I created a new user group... let's call it "TrainedUsersGroup".
Once authenticated, users are placed into the Webhome page of the wiki. I've placed Velocity script on the Webhome page to check if the user is in the TrainedUsersGroup. If the user is not in the group, the user is redirected to the NoAccess.WebHome page.
On the NoAccess.Webhome page another check is made to determine if the user is in the TrainedUsersGroup. If the user is not in the group, a call is made to a Groovy class (on another page in the Groovy namespace). The groovy code executes a system call to grep on the Linux system running the Xwiki against a CSV file pulled from an intranet web report. The passed user's login (which is the same as the LDAP user id) is checked against this file. If the returned grep output shows that the training has been completed, the NoAccess.WebHome page will attempt to add the user to the TrainedUsersGroup. If the user is added to the TrainedUsersGroup as determined after another check, the user is redirected back to the originating WebHome page.
This mechanism works great if the user accessing the pages is an admin. However, if the user is a regular user everything except the addition to the group works. Instead, the code to place the user in the group displays on the page. It does not run and put the user into the TrainedUsersGroup. This is no good for our needs in which we must restrict Xwiki access for non-trained users.
"Instead, the code to place the user in the group displays on the page."
*-> question:* does the wiki receive the grep output in all cases? Can you get the output printed on the screen even if the context user isn't an admin? If not, the problem arises earlier and you'd need to identify exactly where it comes from.
The grep output is received as expected. The Groovy code returns a result that is correct. The Groovy script is working fine and is not the problem. The variable $completed_training is set to the strings "true" or "false" output from the Groovy code in the proper manner. I've displayed these in debugging code to the screen.
*-> observation:* this issue is typical of lacking programming rights. Programming rights are different from other rights in that the check is not made on whether the current user has programming rights. The check is made on whether the page that holds the groovy script was saved with someone holding programming rights. This is why the check you're doing against the visiting user doesn't work.
Programming rights work this way in order to prevent a non-authorized person to create and execute a privileged script. Therefore what matters is the state of the page holding your script at the point when it is being called. What is somehow happening is that the system thinks the page holding the script has been saved by the current user at some point and thus displays its literal content instead of running the code.
I don't understand this. I am admin and I have edited the page. The users have been restricted and not granted edit rights to the page. It is not possible for system to think the page has been saved by the current user. A search on the page shows the last modified was me.
Thus you may want to check whether your application makes XWiki think that the context user is the one who saved the groovy page. You need to make sure that XWiki doesn't think that the NoAccess.WebHome page holding your second script has been saved by the current user. Check for occurences of $doc.save() (velocity) or doc.save() (groovy) in your code and make sure that XWiki thinks the user performing the action is an user with programming rights.
The Groovy page is not the problem. The NoAccess.WebHome page has been shown to be saved by the admin, me. I have even set programming rights for all users to eliminate the potential or problems.
I'm not a developer so I can't do much more for you here, hope it makes things a bit clearer though. Good luck!
(My original goal was to connect to our Oracle database and based upon the
user id determine directly if the user has completed the training. I've had luck with a simple Groovy script running on my desktop and on the Linux server. However, from within the Xwiki Groovy console or on a page, I get no output. Therefore, I have abandoned the Oracle query check via Groovy.)
I've been researching the Xwiki user list for weeks. I've poured over xwiki documentation. I've peeked at wiki page source. I've done all this in an attempt to figure out how to get a user to place himself into a group. I've found a lot of confusing and contradicting information. Programming rights are mentioned. The only place I found the ability to set this right was in the xwiki administration. I can't determine if the problem is even related to programming rights. I've put a debug statement on the NoAccess.WebHome page to print whether the user visiting the page has programming rights. In all cases it display that they do. Yet, only admins can add themselves to the TrainedUsersGroup. This doesn't work for me. I need to automatically add the visiting user to the TrainedUsersGroup once the training has been validated.
Btw, I'm really sorry about you experiencing this frustrating experience. Hope this email will help a bit.
*-> shameless plug:* XWiki SAS (www.xwiki.com) offers development support services to help you when faced with such hurdles. I'm aware you might not be in a position where you can consider this offer, but you'd have the guarantee of getting an appropriate answer in a short timeframe (vs community support, although it's usually pretty fast on these lists) plus it's a great way to help the development of the XWiki project if you like the product + well, it would have saved you days and effort thus making save money in the end ;-)
Unfortunately, I am just a developer and not able to direct the funding. Since this is for an internal project for a govt. contractor, the time it would take to resolve the paperwork to put in a request for the funding for external support would be longer than me to just write the entire wiki myself.
What is the problem? Why won't the user go into the group? Is there a better way of doing this? Any help, code snippets or suggestions would
be
appreciated.
Thanks.
Dean Weber
How exactly are you adding the user to that group? If you create an XWikiGroups object, add it to the group document, then save it, you should use saveWithProgrammingRights() instead of save().
-- Sergiu Dumitriu http://purl.org/net/sergiu/
THis is from the NoAccess.WebHome page. Here is the velocity code segment I am using to try and add a user to the TrainedUsersGroup group. 01 #if($completed_training == "true" or $xwiki.hasAdminRights()) 02 ## 03 ## Add the current user to the TrainedUsersGroup group 04 ## 05 #set($MyGroupDoc = $xwiki.getDocument("XWiki.TrainedUsersGroup")) 06 #if(!$MyGroupDoc.getObject("XWiki.XWikiGroups", "member", $fullName)) 07 #set($GroupObj = $MyGroupDoc.newObject("XWiki.XWikiGroups")) 08 #set($AddingUser = 1) 09 $GroupObj.set("member", $fullName) 10 $MyGroupDoc.save() 11 #end 12 #end I have tested the Groovy code that is responsible for setting the $completed_training variable depending on the user's status. That portion is correct. The Groovy code did its part and is not the problem. All lines execute correctly except for lines # 09 and 10. In the case where the current user is not an admin, those lines display on the page instead of being executed. In the case where the user is an admin, No code is display. It is executed. The admin is added to the TrainedUsersGroup without a problem. I've even changed line #10 to use saveWithProgrammingRights but it behaves the same and just displays on the screen in the case of a regular user. Why can't the user execute the code that adds himself to a group when the page was written and saved by the admin? There must be some way for me to automatically place users into a group based upon their training status. Thanks Dean Weber Sr Software Engineer II Raytheon Technical Services Company LLC
Hi Dean, On Mon, Jun 15, 2009 at 3:46 PM, Dean G Weber <Dean.G.Weber@raytheon.com>wrote:
Small typo: The check is made on whether the page that holds the groovy script was
saved
*BY* *AN USER* *WHO HAS* programming rights.
Guillaume
The page that contains the Groovy script was create by me, (admin), and it executes without a problem. It returns the expected results. It is not the issue.
On Thu, Jun 11, 2009 at 8:35 PM, Guillaume Lerouge <guillaume@xwiki.com>wrote:
Hi Dean,
On Thu, Jun 11, 2009 at 7:49 PM, Dean G Weber <Dean.G.Weber@raytheon.com>wrote:
I've been struggling for a while with the dilemma of getting a user into a group. Let me supply some background on what we've been trying to do with Xwiki.
We're trying to use Xwiki for an internal collaborative site. Management has decided that users of the wiki must complete proper training. Without the training, the user cannot add to the wiki pages.
For authentication, we've connected the wiki to our LDAP server via the xwik.cfg file. Authenticated users are automatically placed into the XWikiAllGroup by default. In order to accommodate management requirements, I created a new user group... let's call it "TrainedUsersGroup".
Once authenticated, users are placed into the Webhome page of the wiki. I've placed Velocity script on the Webhome page to check if the user is in the TrainedUsersGroup. If the user is not in the group, the user is redirected to the NoAccess.WebHome page.
On the NoAccess.Webhome page another check is made to determine if the user is in the TrainedUsersGroup. If the user is not in the group, a call is made to a Groovy class (on another page in the Groovy namespace). The groovy code executes a system call to grep on the Linux system running the Xwiki against a CSV file pulled from an intranet web report. The passed user's login (which is the same as the LDAP user id) is checked against this file. If the returned grep output shows that the training has been completed, the NoAccess.WebHome page will attempt to add the user to the TrainedUsersGroup. If the user is added to the TrainedUsersGroup as determined after another check, the user is redirected back to the originating WebHome page.
This mechanism works great if the user accessing the pages is an admin. However, if the user is a regular user everything except the addition to the group works. Instead, the code to place the user in the group displays on the page. It does not run and put the user into the TrainedUsersGroup. This is no good for our needs in which we must restrict Xwiki access for non-trained users.
"Instead, the code to place the user in the group displays on the page."
*-> question:* does the wiki receive the grep output in all cases? Can you get the output printed on the screen even if the context user isn't an admin? If not, the problem arises earlier and you'd need to identify exactly where it comes from.
The grep output is received as expected. The Groovy code returns a result that is correct. The Groovy script is working fine and is not the problem. The variable $completed_training is set to the strings "true" or "false" output from the Groovy code in the proper manner. I've displayed these in debugging code to the screen.
*-> observation:* this issue is typical of lacking programming rights. Programming rights are different from other rights in that the check is not made on whether the current user has programming rights. The check is made on whether the page that holds the groovy script was saved with someone holding programming rights. This is why the check you're doing against the visiting user doesn't work.
Programming rights work this way in order to prevent a non-authorized person to create and execute a privileged script. Therefore what matters is the state of the page holding your script at the point when it is being called. What is somehow happening is that the system thinks the page holding the script has been saved by the current user at some point and thus displays its literal content instead of running the code.
I don't understand this. I am admin and I have edited the page. The users have been restricted and not granted edit rights to the page. It is not possible for system to think the page has been saved by the current user. A search on the page shows the last modified was me.
Thus you may want to check whether your application makes XWiki think that the context user is the one who saved the groovy page. You need to make sure that XWiki doesn't think that the NoAccess.WebHome page holding your second script has been saved by the current user. Check for occurences of $doc.save() (velocity) or doc.save() (groovy) in your code and make sure that XWiki thinks the user performing the action is an user with programming rights.
The Groovy page is not the problem. The NoAccess.WebHome page has been shown to be saved by the admin, me. I have even set programming rights for all users to eliminate the potential or problems.
I'm not a developer so I can't do much more for you here, hope it makes things a bit clearer though. Good luck!
(My original goal was to connect to our Oracle database and based upon the
user id determine directly if the user has completed the training. I've had luck with a simple Groovy script running on my desktop and on the Linux server. However, from within the Xwiki Groovy console or on a page, I get no output. Therefore, I have abandoned the Oracle query check via Groovy.)
I've been researching the Xwiki user list for weeks. I've poured over xwiki documentation. I've peeked at wiki page source. I've done all this in an attempt to figure out how to get a user to place himself into a group. I've found a lot of confusing and contradicting information. Programming rights are mentioned. The only place I found the ability to set this right was in the xwiki administration. I can't determine if the problem is even related to programming rights. I've put a debug statement on the NoAccess.WebHome page to print whether the user visiting the page has programming rights. In all cases it display that they do. Yet, only admins can add themselves to the TrainedUsersGroup. This doesn't work for me. I need to automatically add the visiting user to the TrainedUsersGroup once the training has been validated.
Btw, I'm really sorry about you experiencing this frustrating experience. Hope this email will help a bit.
*-> shameless plug:* XWiki SAS (www.xwiki.com) offers development support services to help you when faced with such hurdles. I'm aware you might not be in a position where you can consider this offer, but you'd have the guarantee of getting an appropriate answer in a short timeframe (vs community support, although it's usually pretty fast on these lists) plus it's a great way to help the development of the XWiki project if you like the product + well, it would have saved you days and effort thus making save money in the end ;-)
Unfortunately, I am just a developer and not able to direct the funding. Since this is for an internal project for a govt. contractor, the time it would take to resolve the paperwork to put in a request for the funding for external support would be longer than me to just write the entire wiki myself.
What is the problem? Why won't the user go into the group? Is there a better way of doing this? Any help, code snippets or suggestions would
be
appreciated.
Thanks.
Dean Weber
How exactly are you adding the user to that group? If you create an XWikiGroups object, add it to the group document, then save it, you should use saveWithProgrammingRights() instead of save().
-- Sergiu Dumitriu http://purl.org/net/sergiu/
THis is from the NoAccess.WebHome page.
Here is the velocity code segment I am using to try and add a user to the TrainedUsersGroup group.
01 #if($completed_training == "true" or $xwiki.hasAdminRights()) 02 ## 03 ## Add the current user to the TrainedUsersGroup group 04 ## 05 #set($MyGroupDoc = $xwiki.getDocument("XWiki.TrainedUsersGroup")) 06 #if(!$MyGroupDoc.getObject("XWiki.XWikiGroups", "member", $fullName))
07 #set($GroupObj = $MyGroupDoc.newObject("XWiki.XWikiGroups")) 08 #set($AddingUser = 1) 09 $GroupObj.set("member", $fullName) 10 $MyGroupDoc.save() 11 #end 12 #end
I tried a slight modification of your code on a local wiki ##if($completed_training == "true" or $xwiki.hasAdminRights()) ## ## Add the current user to the TrainedUsersGroup group ## #set($MyGroupDoc = $xwiki.getDocument("XWiki.TrainedUsersGroup")) #if(!$MyGroupDoc.getObject("XWiki.XWikiGroups", "member", $context.user)) #set($GroupObj = $MyGroupDoc.newObject("XWiki.XWikiGroups")) ##set($AddingUser = 1) $GroupObj.set("member", $context.user) $MyGroupDoc.save() #end ##end It works fine with an admin. However, I get an "org.apache.velocity.exception.MethodInvocationException: Invocation of method 'save' in class com.xpn.xwiki.api.Document threw exception com.xpn.xwiki.XWikiException: Error number 9001 in 9: Access denied in edit mode on document XWiki.TrainedUsersGroup at Main.TestGroup" error when trying to view the page with a "normal" user. Did you make sure that XWiki.TrainedUsersGroup could be edited by all users? To do so, you can go to .../xwiki/bin/edit/XWiki/TrainedUsersGroup?editor=rights and make sure that the "Edit" checkbox is ticked in the XWikiAllGroup line. This allows all users to modify that page, thus making them able to add themselves to the group. Once I had made the modification, my "normal" user was able to add himself to the TrainedUsersGroup simply by going to the page. Hope this helps, Guillaume
I have tested the Groovy code that is responsible for setting the $completed_training variable depending on the user's status. That portion is correct. The Groovy code did its part and is not the problem. All lines execute correctly except for lines # 09 and 10. In the case where the current user is not an admin, those lines display on the page instead of being executed. In the case where the user is an admin, No code is display. It is executed. The admin is added to the TrainedUsersGroup without a problem. I've even changed line #10 to use saveWithProgrammingRights but it behaves the same and just displays on the screen in the case of a regular user.
Why can't the user execute the code that adds himself to a group when the page was written and saved by the admin?
There must be some way for me to automatically place users into a group based upon their training status.
Thanks Dean Weber Sr Software Engineer II Raytheon Technical Services Company LLC _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Guillaume Lerouge Product Manager - XWiki Skype: wikibc Twitter: glerouge http://guillaumelerouge.com/
Guillaume Lerouge wrote:
How exactly are you adding the user to that group? If you create an XWikiGroups object, add it to the group document, then save it, you should use saveWithProgrammingRights() instead of save().
THis is from the NoAccess.WebHome page.
Here is the velocity code segment I am using to try and add a user to the TrainedUsersGroup group.
01 #if($completed_training == "true" or $xwiki.hasAdminRights()) 02 ## 03 ## Add the current user to the TrainedUsersGroup group 04 ## 05 #set($MyGroupDoc = $xwiki.getDocument("XWiki.TrainedUsersGroup")) 06 #if(!$MyGroupDoc.getObject("XWiki.XWikiGroups", "member", $fullName))
07 #set($GroupObj = $MyGroupDoc.newObject("XWiki.XWikiGroups")) 08 #set($AddingUser = 1) 09 $GroupObj.set("member", $fullName) 10 $MyGroupDoc.save() 11 #end 12 #end
To do so, you can go to .../xwiki/bin/edit/XWiki/TrainedUsersGroup?editor=rights and make sure that the "Edit" checkbox is ticked in the XWikiAllGroup line. This allows all users to modify that page, thus making them able to add themselves to the group.
Once I had made the modification, my "normal" user was able to add himself to the TrainedUsersGroup simply by going to the page.
Hope this helps,
Guillaume, stop confusing. Dean, as I said, replace the save() call with saveWithProgrammingRights(). 10 $MyGroupDoc.saveWithProgramminRights() -- Sergiu Dumitriu http://purl.org/net/sergiu/
Re, On Mon, Jun 15, 2009 at 5:09 PM, Sergiu Dumitriu <sergiu@xwiki.com> wrote:
Guillaume Lerouge wrote:
How exactly are you adding the user to that group? If you create an XWikiGroups object, add it to the group document, then save it, you should use saveWithProgrammingRights() instead of save().
THis is from the NoAccess.WebHome page.
Here is the velocity code segment I am using to try and add a user to the TrainedUsersGroup group.
01 #if($completed_training == "true" or $xwiki.hasAdminRights()) 02 ## 03 ## Add the current user to the TrainedUsersGroup group 04 ## 05 #set($MyGroupDoc = $xwiki.getDocument("XWiki.TrainedUsersGroup")) 06 #if(!$MyGroupDoc.getObject("XWiki.XWikiGroups", "member", $fullName))
07 #set($GroupObj = $MyGroupDoc.newObject("XWiki.XWikiGroups")) 08 #set($AddingUser = 1) 09 $GroupObj.set("member", $fullName) 10 $MyGroupDoc.save() 11 #end 12 #end
To do so, you can go to .../xwiki/bin/edit/XWiki/TrainedUsersGroup?editor=rights and make sure that the "Edit" checkbox is ticked in the XWikiAllGroup line. This allows all users to modify that page, thus making them able to add themselves to the group.
Once I had made the modification, my "normal" user was able to add himself to the TrainedUsersGroup simply by going to the page.
Hope this helps,
Guillaume, stop confusing.
Dean, as I said, replace the save() call with saveWithProgrammingRights().
10 $MyGroupDoc.saveWithProgramminRights()
Well... As Dean stated it in his email this didn't seem to help: "I've even changed line #10 to use saveWithProgrammingRights but it behaves the same and just displays on the screen in the case of a regular user." Guillaume
-- Sergiu Dumitriu http://purl.org/net/sergiu/ _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Guillaume Lerouge Product Manager - XWiki Skype: wikibc Twitter: glerouge http://guillaumelerouge.com/
Re, On Mon, Jun 15, 2009 at 5:21 PM, Guillaume Lerouge <guillaume@xwiki.com>wrote:
Re,
On Mon, Jun 15, 2009 at 5:09 PM, Sergiu Dumitriu <sergiu@xwiki.com> wrote:
Guillaume Lerouge wrote:
How exactly are you adding the user to that group? If you create an XWikiGroups object, add it to the group document, then save it, you should use saveWithProgrammingRights() instead of save().
THis is from the NoAccess.WebHome page.
Here is the velocity code segment I am using to try and add a user to the TrainedUsersGroup group.
01 #if($completed_training == "true" or $xwiki.hasAdminRights()) 02 ## 03 ## Add the current user to the TrainedUsersGroup group 04 ## 05 #set($MyGroupDoc = $xwiki.getDocument("XWiki.TrainedUsersGroup")) 06 #if(!$MyGroupDoc.getObject("XWiki.XWikiGroups", "member", $fullName))
07 #set($GroupObj = $MyGroupDoc.newObject("XWiki.XWikiGroups")) 08 #set($AddingUser = 1) 09 $GroupObj.set("member", $fullName) 10 $MyGroupDoc.save() 11 #end 12 #end
To do so, you can go to .../xwiki/bin/edit/XWiki/TrainedUsersGroup?editor=rights and make sure that the "Edit" checkbox is ticked in the XWikiAllGroup line. This allows all users to modify that page, thus making them able to add themselves to the group.
Once I had made the modification, my "normal" user was able to add himself to the TrainedUsersGroup simply by going to the page.
Hope this helps,
Guillaume, stop confusing.
Dean, as I said, replace the save() call with saveWithProgrammingRights().
10 $MyGroupDoc.saveWithProgramminRights()
Well... As Dean stated it in his email this didn't seem to help:
"I've even changed line #10 to use saveWithProgrammingRights but it behaves the same and just displays on the screen in the case of a regular user."
Guillaume
-- Sergiu Dumitriu http://purl.org/net/sergiu/ _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Guillaume Lerouge Product Manager - XWiki Skype: wikibc Twitter: glerouge http://guillaumelerouge.com/
I've done further testing, here goes: I've inputted the following content in a page: <% def completed_training = "true" %> #if($completed_training == "true" or $xwiki.hasAdminRights()) ## ## Add the current user to the TrainedUsersGroup group ## #set($MyGroupDoc = $xwiki.getDocument("XWiki.TrainedUsersGroup")) #if(!$MyGroupDoc.getObject("XWiki.XWikiGroups", "member", $context.user)) #set($GroupObj = $MyGroupDoc.newObject("XWiki.XWikiGroups")) ##set($AddingUser = 1) $GroupObj.set("member", $context.user) $MyGroupDoc.saveWithProgrammingRights() #end #end It works only if the user looking the page is an Admin. If the user is not in the AdminGroup, he doesn't get added to the group. If I remove "or $xwiki.hasAdminRights()" from the #if it no longer works, in any case. Thus I suspect that the "true" value returned by the groovy call isn't interpreted as it should by the velocity check in the #if call. For instance, if you try to use only the following code in a page: <% def completed_training = "true" %> * First: $completed_training #if($completed_training == "true") * Second: $completed_training #end The First line works fine while the Second never gets displayed. I'm not sure if that's your exact use case (a variable defined in groovy on the page that you try to call from velocity on the same page), but if it is, then for some reason it doesn't work. Here's a workaround that seems to work (though it requires that the user clicks on a link to add himself to the group): #if(!$request.completed_training == "true") #set($MyGroupDoc = $xwiki.getDocument("XWiki.TrainedUsersGroup")) #if(!$MyGroupDoc.getObject("XWiki.XWikiGroups", "member", $context.user)) #set($GroupObj = $MyGroupDoc.newObject("XWiki.XWikiGroups")) $GroupObj.set("member", $context.user) $MyGroupDoc.save() #end #else [Click here to confirm that you have finished the Training>NoAccess.WebHome?completed_training=$completed_training] #end Good luck, Guillaume -- Guillaume Lerouge Product Manager - XWiki Skype: wikibc Twitter: glerouge http://guillaumelerouge.com/
FYI .. the winning answer that solved my user adding self to a group problem was:
To do so, you can go to .../xwiki/bin/edit/XWiki/TrainedUsersGroup?editor=rights and make sure that the "Edit" checkbox is ticked in the XWikiAllGroup line. This allows all users to modify that page, thus making them able to add themselves to the group.
I had to pull up the document and give edit rights to the group document itself. Saving with Programming rights had no impact over the regular save. Thank you very much Guillaume! -- View this message in context: http://n2.nabble.com/How-do-I-get-a-user-to-add-himself-to-a-group--tp306352... Sent from the XWiki- Users mailing list archive at Nabble.com.
participants (4)
-
Dean G Weber -
Dean Weber
-
Guillaume Lerouge -
Sergiu Dumitriu