[JBoss JIRA] Created: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
8:06 a.m.
CMSAdminPortlet should use Users/Roles Module and not direct HQL query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6.CR2
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
When separating the CMS tables and the Users/Roles tables in two datasources, I found this
:
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not execute
query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership m,jbp_roles
roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name AND
m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix the
tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:25 p.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=all ]
Julien Viet updated JBPORTAL-1499:
----------------------------------
Fix Version/s: 2.6.1 Final
2.8 Final
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6.CR2
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.1 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:42 p.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=all ]
Julien Viet updated JBPORTAL-1499:
----------------------------------
Due Date: 11/Jul/07
Complexity: Low
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6.CR2
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.1 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:36 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=comments#action_1236... ]
Sohil Shah commented on JBPORTAL-1499:
--------------------------------------
> is the CMSAdminPortlet working with a LDAP user repository ?
>I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables
(no replication between ldap and the usual portal u/r tables).
Actually, in the LDAP environment, the cms security system still works becuase it falls
back to data extraction via the UserModule/RolesModule Identity components.
The issue with the cms security engine is performance. Security is dynamic and is enforced
on all cms requests, so the security system kicks in all the time.
So, if we don't use security meta data caching in a cluster safe manner (which we get
by the use of Hibernate), our performance would suffer greatly under heavy loads.
Hence, for the core DB Identity Module, the permission lookup for a user, is done via an
optimized hibernate query. The query is optimized to deal with the many-to-many relation
between Permission/Role, Permission/User, and Role/User.
Without that, it results in multiple calls to the Identity Module to grab the same
information which does not scale in a high load environment
Having said that, for the non DB Identity Module like LDAPUserModule, your custom
UserModule which splits data into different databases, we dont have a choice but to reply
on the IdentityModule interfaces to extract this data.
However, I am not too sure about the scalability of these since, any data caching etc now
becomes an implementation detail of the Modules, so if they don't do that, performance
will suffer
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6.CR2
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.1 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:48 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=comments#action_1236... ]
Sohil Shah commented on JBPORTAL-1499:
--------------------------------------
For details on whats going here you can take a look at the cms security code in the
org.jboss.portal.cms.security package, and the class where the security data is queried is
the org.jboss.portal.cms.security.AuthorizationProviderImpl.
I did notice that there is a small bug in the logic, which uses optimized Hibernate Query
when the IdentityModule being used is not the LDAPModule.
Instead this logic should be: Use optimized Hibernate Query only when the IdentityModule
the the core DB Module.
I will fix that bug.
So as far your requirement is concerned, you just need to provide your own implementation
of the Identity Module which takes the approach of splitting the data between multiple
databases
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6.CR2
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.1 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:55 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=comments#action_1236... ]
Antoine Herzog commented on JBPORTAL-1499:
------------------------------------------
If I understand well :
- the users and roles are synchronised from the LDAP to the DB
- then, we use hibernate to have the cache feature on users and roles requests
so we get good performance, thanks to this replication of data + hibernate caching
feature.
I still think that is quiet a heavy way to have some cached users and roles.
May be it could be interesting to have a cache (jboss cache) on the users and roles
directly.
with clustered HA feature to.
It could rely also from the events of LDAP synchronisation.
This would be an enhancement (for performance) of the identity service, while keeping the
(nice) independance of users and roles from the implementation behind (DB, LDAP... EJB3
later ?).
And also avoid a heavy drawback : in High Availability, having a replication of data from
LDAP to a DB is not a nice thing, if the purpose is just "caching with
hibernate".
One more DB in HA is a lot of prod work, and a weak part more.
I guess this is new and will evolved when it is time.
I can customize a users and roles module too.
I wish I can and contribute with it.
but I don't see any opportunity (and time) to do that before... a long time.
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6.CR2
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.1 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:11 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=comments#action_1236... ]
Thomas Heute commented on JBPORTAL-1499:
----------------------------------------
Antoine, in the future, it would be good to start the discussion in the forums, then if
all agree create a Jira task that *synthesize* what has to be done for several reasons:
- more people read the forums and can participate
- it's easier to manage (Too often the work to do has nothing related to the title of
the task or the description)
- sometimes it is just a misunderstanding and the Jira task shouldn't exist
- Jira is a PITA to manage :)
Thanks !
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6.CR2
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.1 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:57 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=comments#action_1236... ]
Antoine Herzog commented on JBPORTAL-1499:
------------------------------------------
ok
this seem to need a forum topic.
If needed, we follow on the forum.
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6.CR2
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.1 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:55 a.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=all ]
Thomas Heute updated JBPORTAL-1499:
-----------------------------------
Fix Version/s: 2.6.2 Final
(was: 2.6.1 Final)
Affects Version/s: 2.6 Final
2.6.1 Final
(was: 2.6.CR2)
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6 Final, 2.6.1 Final
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.2 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:57 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=comments#action_1237... ]
Thomas Heute commented on JBPORTAL-1499:
----------------------------------------
Sohil, Antoine,
What's the conclusion of this ?
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6 Final, 2.6.1 Final
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.2 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:46 p.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=comments#action_1237... ]
Antoine Herzog commented on JBPORTAL-1499:
------------------------------------------
I opened a design forum post :
http://jboss.org/index.html?module=bb&op=viewtopic&t=115999
and put a post on this one :
http://jboss.org/index.html?module=bb&op=viewtopic&t=112843
hope that something will get out.
For the time being : can't use the CMS full feature with security constraint on each
docs, if you want a CMS repo datasource different from the Identity Hibernate datasource.
And can't say for a prod environnement : let's mix the tables of CMS and Identity
in the same database...
The prod admin will manage to backup, move from dev to prod... checking each time what
table to take, what not to touch etc...
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6 Final, 2.6.1 Final
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.2 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:59 p.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=all ]
Sohil Shah updated JBPORTAL-1499:
---------------------------------
JBoss Forum Reference:
http://jboss.org/index.html?module=bb&op=viewtopic&t=115999
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6 Final, 2.6.1 Final
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.2 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:18 p.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=comments#action_1237... ]
Sohil Shah commented on JBPORTAL-1499:
--------------------------------------
Based on the discussion,
looks like what we need to do is fix the small bug I mentioned in my earlier comments.
With this the HSQL based queries will be used by the Security Engine as a performance
optimization, only for the DB based Identity Module that ships with the
Portal out-of-the-box. This module stores data inside the Portal database.
For other implementations of the Identity API which stores data in different stores like
LDAP, another database etc, the CMS Security Engine will fall back to use the generic
Identity API to gets its information.
In this case however. all performance optimizations will be resposibility of the Identity
Module Implementation itself.
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6 Final, 2.6.1 Final
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.2 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:57 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=comments#action_1237... ]
Thomas Heute commented on JBPORTAL-1499:
----------------------------------------
Sohil,
could you close this case as "Won't fix" and open a new one with a correct
name and description for it with the planned target release please.
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6 Final, 2.6.1 Final
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.8 Final, 2.6.2 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:09 p.m.
New subject: [JBoss JIRA] Resolved: (JBPORTAL-1499) CMSAdminPortlet should use Users/Roles Module and not direct HQL query
[ http://jira.jboss.com/jira/browse/JBPORTAL-1499?page=all ]
Sohil Shah resolved JBPORTAL-1499.
----------------------------------
Resolution: Done
The bug in logic is fixed where HSQL based optimized query is used only when the Portal is
setup such that the Identity related data are stored in the core Portal database.
For a Portal setup where this information is stored in some other store like LDAP, it uses
the generic Identity API to extract information
CMSAdminPortlet should use Users/Roles Module and not direct HQL
query
----------------------------------------------------------------------
Key: JBPORTAL-1499
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1499
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS, Portal Identity
Affects Versions: 2.6 Final, 2.6.1 Final
Environment: JBP2.6 CR2 (bundle package with JBoss AS 4.0.5)
Reporter: Antoine Herzog
Assigned To: Sohil Shah
Fix For: 2.6.2 Final, 2.8 Final
When separating the CMS tables and the Users/Roles tables in two datasources, I found
this :
when trying to go to the CmsAdmin (CMSAdminPortlet), I got "access denied" and
this exception :
2007-06-22 13:56:11,015 DEBUG [org.hibernate.jdbc.ConnectionManager] releasing JDBC
connection [ (open PreparedStatements: 0, globally: 0) (open ResultSets: 0, globally: 0)]
2007-06-22 13:56:11,015 DEBUG [org.hibernate.util.JDBCExceptionReporter] could not
execute query [SELECT * from jbp_cms_perm p,jbp_cms_perm_role r,jbp_role_membership
m,jbp_roles roles,jbp_users users WHERE p.id=r.cms_perm_id AND r.role_id=roles.jbp_name
AND m.jbp_rid=roles.jbp_rid AND m.jbp_uid=users.jbp_uid AND users.jbp_uname=?]
com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Table
'jbptl_cms.jbp_role_membership' doesn't exist
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2870)
and also :
13:56:11,015 WARN [JDBCExceptionReporter] SQL Error: 1146, SQLState: 42S02
13:56:11,015 ERROR [JDBCExceptionReporter] Table 'jbptl_cms.jbp_role_membership'
doesn't exist
Datasource for Users/Roles : jbptl_users
Datasource for CMS : jbptl_cms
I did not look precisely to the CMSAdminPortlet code, but obviously, the HQL query mix
the tables of the CMS and the tables of the Users/Roles.
Every thing works fine in the native version of portal, but it can't work with my
production or architectures needs. I guess usual needs : separation of what is not really
tied up.
I guess the CMS service should check the security using the Users and Roles Modules, with
some java level code,
and not directly the Hibernate queries that manipulate the data.
With this, we cannot have a specific Users/Roles Module, with other persistence than in
the same database as the CMS.
=> is the CMSAdminPortlet working with a LDAP user repository ?
I guess not, if the LDAP Users/Roles Module does not use the JBossPortal users tables (no
replication between ldap and the usual portal u/r tables).
=> if we need a specific user database (legacy), with a home made Users/Roles Module
that take the data from another legacy datasource, the CMSAdminPortlet and CMS Security
won't work
=> general architecture design : the users data are in a database, the cms data are in
another one : more clean for managing all that stuff (backup, restore if crash,
maintenance against user data or cms data, etc...).
Feature :
- Enhance the CMSService with some Security API that provide all the basic security
features to check the permission, doing it with java and Users/Roles Module, not with
hibernate.
- Or (I think is better) provide a Users/Roles Security service, that provide the usual
security checking features (isInRole(), etc...). This would be above the Users/Roles
Module
I guess the portal needs the same kind of service : set a common service interface for
both needs.
Even if there are no time to decide and build these security interfaces for 2.6, it would
be great to have the CMSAdminPortlet working with some CMS and Users/Roles separate
DataSources.
I will manage with only one DS for dev, but would be great to have it for the upgrade of
our prod version (now in JBP2.4.1).
Unfortunately, I have no time to do this now (huge work to have the next version of our
portal ready asap... and I'd rather use right now the 2.6 than keep 2.4 for all
this...).
Thanks,
Antoine
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6893
days inactive
6968
days old
14 comments
4 participants
participants (4)
-
Antoine Herzog (JIRA) -
Julien Viet (JIRA)
-
Sohil Shah (JIRA)
-
Thomas Heute (JIRA)