Cambiar los nombres de rol predeterminados

De forma predeterminada, la aplicación incluye dos roles de conexión denominados “ROLE_USER” y “ROLE_ADMIN”. A cualquier usuario de OpenKM se le debe asignar uno de estos roles para poder iniciar sesión.

Cambiar los roles predeterminados

Precaución

Cambiar los roles no suele ser una tarea sencilla; le recomendamos disponer de una copia de seguridad antes de empezar a trabajar en ello.

Es una buena práctica probar primero este tipo de cambios en un entorno de desarrollo antes de intentarlo en su entorno de producción.

Para cambiar los roles predeterminados, deben realizarse tres acciones:

1. Cambiar los nombres de los roles en Administración.
2. Modificar el contenido del fichero appContext.xml dentro de “$TOMCAT/webapp/openkm.war”.
3. Actualizar los roles existentes en la base de datos denominados “ROLE_USER” y “ROLE_ADMIN” a los nuevos nombres.

Precaución

Puede modificar el fichero “appContext.xml” dentro de “$TOMCAT_HOME/webapps/openkm.war” o modificar el war descomprimido en “$TOMCAT_HOME/webapp/openkm/WEB-INF/appContext.xml”.

Tenga en cuenta que cada vez que se modifica el fichero “openkm.war”, el contenido de la carpeta “$TOMCAT_HOME/webapp/openkm” se limpiará por completo.

Nota

Secciones del fichero “appContext.xml” que se deben modificar:

Obligatoria:

<security:intercept-url pattern="/admin/**" access="ROLE_ADMIN" />

Opcional:

<!-- Remove prefix to be able of use custom roles -->
<beans:bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
    <beans:property name="rolePrefix" value="ROLE_"/>
</beans:bean>

• Vaya a Administración > Parámetros de configuración.
• Cambie los valores de los parámetros “default.admin.role” y “default.admin.role”. Esto también se puede hacer desde Consulta a la base de datos; consulte el siguiente script SQL.
• Vaya a Administración > Utilidades > Consulta a la base de datos y ejecute el SQL de actualización de los nombres de rol:

-- Optionally the configuration parameters can be set from SQL
UPDATE OKM_CONFIG SET CFG_VALUE='NEW_ROLE_USER_NAME' WHERE CFG_KEY='default.user.role';
UPDATE OKM_CONFIG SET CFG_VALUE='NEW_ROLE_ADMIN_NAME' WHERE CFG_KEY='default.admin.role';
-- Update security table
UPDATE OKM_NODE_ROLE_PERMISSION SET NRP_ROLE='NEW_ROLE_USER_NAME' WHERE NRP_ROLE='ROLE_USER';
UPDATE OKM_NODE_ROLE_PERMISSION SET NRP_ROLE='NEW_ROLE_ADMIN_NAME' WHERE NRP_ROLE='ROLE_ADMIN';
-- Insert new roles
INSERT INTO OKM_ROLE (ROL_ID, ROL_ACTIVE) VALUES ('NEW_ROLE_USER_NAME', 'T');
INSERT INTO OKM_ROLE (ROL_ID, ROL_ACTIVE) VALUES ('NEW_ROLE_ADMIN_NAME', 'T');
-- Update user roles
UPDATE OKM_USER_ROLE SET UR_ROLE='NEW_ROLE_USER_NAME' WHERE UR_ROLE='ROLE_USER';
UPDATE OKM_USER_ROLE SET UR_ROLE='NEW_ROLE_ADMIN_NAME' WHERE UR_ROLE='ROLE_ADMIN';
-- Remove older roles
DELETE FROM OKM_ROLE WHERE ROL_ID IN ('ROLE_USER', 'ROLE_ADMIN');

• Detenga la aplicación.
• Modifique el contenido del fichero “appContext.xml”.
• Inicie la aplicación.

Ejemplo de fichero appContext.xml

Consejo

El “ROLE_USER” se ha modificado a “OPENKM_ROLE_USER”.

El “ROLE_ADMIN” se ha modificado a “OPENKM_ROLE_ADMIN”.

Precaución

El contenido del fichero “appContext.xml” puede variar; tómelo únicamente como referencia.

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:security="http://www.springframework.org/schema/security"
             xmlns:context="http://www.springframework.org/schema/context"
             xmlns:jee="http://www.springframework.org/schema/jee"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
                                 http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                                 http://www.springframework.org/schema/security
                                 http://www.springframework.org/schema/security/spring-security-3.2.xsd
                                 http://www.springframework.org/schema/context
                                 http://www.springframework.org/schema/context/spring-context-3.1.xsd
                                 http://www.springframework.org/schema/jee
                                 http://www.springframework.org/schema/jee/spring-jee-3.1.xsd">

    <context:component-scan base-package="com.openkm"/>

    <!-- OpenKM API -->
    <beans:import resource="soap.xml" />
    <beans:import resource="rest.xml" />
    <beans:import resource="cmis.xml" />

    <!--
    <beans:bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
        <beans:property name="targetClass" value="org.springframework.security.core.context.SecurityContextHolder" />
        <beans:property name="targetMethod" value="setStrategyName" />
        <beans:property name="arguments" value="_INHERITABLETHREADLOCAL" />
    </beans:bean>
    -->

    <security:global-method-security secured-annotations="enabled"/>

    <!-- Remove prefix to be able of use custom roles -->
    <beans:bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
        <beans:property name="rolePrefix" value="OPENKM_ROLE_"/>
    </beans:bean>

    <!-- Status -->
    <security:http pattern="/Status" create-session="stateless">
        <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
        <security:http-basic />
    </security:http>

    <!-- Download -->
    <security:http pattern="/Download" create-session="stateless">
        <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
        <security:http-basic />
      <security:custom-filter position="PRE_AUTH_FILTER" ref="downloadTokenFilter" />
    </security:http>

    <beans:bean name="downloadTokenFilter" class="com.openkm.spring.DownloadTokenFilter"/>

    <!-- Workflow deploy -->
    <security:http pattern="/workflow-register" create-session="stateless">
        <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
        <security:http-basic />
    </security:http>

    <!-- WebDAV using Basic authentication -->
    <security:http pattern="/webdav/**" create-session="stateless">
        <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
        <security:http-basic />
    </security:http>

    <!-- Syndication using Basic authentication -->
    <security:http pattern="/feed/**" create-session="stateless">
        <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
        <security:http-basic />
    </security:http>

    <!-- OpenCMIS (Browser) using Basic authentication -->
    <security:http pattern="/cmis/browser/**" create-session="stateless">
        <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
        <security:http-basic />
    </security:http>

    <!-- OpenCMIS (AtomPub) using Basic authentication -->
    <security:http pattern="/cmis/atom/**" create-session="stateless">
        <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
        <security:http-basic />
    </security:http>

    <!-- OpenCMIS (AtomPub) using Basic authentication -->
    <security:http pattern="/cmis/atom11/**" create-session="stateless">
        <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
        <security:http-basic />
    </security:http>

    <!-- REST -->
    <security:http pattern="/services/rest/**" create-session="stateless">
        <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
        <security:http-basic />
    </security:http>

    <!-- Additional filter chain for normal users, matching all other requests -->
    <!-- http://info.michael-simons.eu/2011/01/28/disable-jsessionid-path-parameter-in-java-web-applications/ -->
    <security:http access-decision-manager-ref="accessDecisionManager" access-denied-page="/unauthorized.jsp">

        <!-- GWT -->
        <security:intercept-url pattern="/frontend/**" access="IS_AUTHENTICATED_FULLY" />

        <!-- JSPs -->
        <security:intercept-url pattern="/admin/**" access="OPENKM_ROLE_ADMIN" />
        <security:intercept-url pattern="/mobile/**" access="IS_AUTHENTICATED_FULLY" />
        <security:intercept-url pattern="/custom/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />

        <!-- Servlets -->
        <security:intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/RepositoryStartup" access="IS_AUTHENTICATED_FULLY" />
        <security:intercept-url pattern="/TextToSpeech" access="IS_AUTHENTICATED_FULLY" />
        <security:intercept-url pattern="/HtmlPreview" access="IS_AUTHENTICATED_FULLY" />
        <security:intercept-url pattern="/SyntaxHighlighter" access="IS_AUTHENTICATED_FULLY" />
        <security:intercept-url pattern="/WebPageImport" access="IS_AUTHENTICATED_FULLY" />
        <security:intercept-url pattern="/Test" access="IS_AUTHENTICATED_FULLY" />

        <!-- Extensions -->
        <security:intercept-url pattern="/extension/ZohoFileUpload" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/extension/**" access="IS_AUTHENTICATED_FULLY" />

        <!-- Login page -->
        <security:form-login login-page="/login" authentication-failure-url="/login?error=1"/>

    </security:http>

    <!-- Needed for changing default role prefix -->
    <beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
        <beans:property name="decisionVoters">
          <beans:list>
             <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/>
             <beans:ref bean="roleVoter" />
             <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
          </beans:list>
       </beans:property>
    </beans:bean>

    <!-- Security access logger -->
    <beans:bean id="loggerListener" class="com.openkm.spring.LoggerListener" />

    <jee:jndi-lookup id="dataSource" jndi-name="jdbc/OpenKMDS" resource-ref="true" />

    <!-- Security configuration moved to $CATALINA_HOME/openkm.xml -->
    <!-- WINFIX
    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider>
            <security:password-encoder hash="md5"/>
            <security:jdbc-user-service
                data-source-ref="dataSource"
                users-by-username-query="select usr_id, usr_password, 1 from OKM_USER where usr_id=? and usr_active='T'"
                authorities-by-username-query="select ur_user, ur_role from OKM_USER_ROLE where ur_user=?"/>
        </security:authentication-provider>
    </security:authentication-manager>
    WINFIX -->
</beans:beans>

Herramientas

Descargue el fichero changeRolesTools.zip.

Incluye:

• El script change_roles.sh para modificar el fichero appContext.xml.
• La carpeta path para parchear el fichero “openkm.war”.

Nota

Para parchear el fichero “openkm.war”, copie el fichero en la carpeta patch y, a continuación, ejecute el script patch.sh (o el fichero patch.bat en Windows).