Authorization failure in search functionality

[wouterkitsz]

I am using community build 6.2.4 build 8088.

I am trying to make a profile "read-only". The idea is that I let some users just browse and preview some documents in some folder (Map A). All works fine until the user starts searching on keyword or document name. Then that user gets results outside of its authorizations.
If map B is now accessable (not viewable) for this user, and there is a searchterm (keyword or document name) entered that matches a document in Map B, the search result shows extracts and a path that this user is not allowed to see.

So my wish is that there is a security check before showing results in a search (does the user have rights to this document according to user and to role?) Strangely enough the authorization concept *does* work when you search for a map and does *not work* when searching on document names and keywords.

In my opinion this is quite a serious thing when people have sensitive documents on an OpenKM server. I could search for 'Budget' or 'Lay-offs' and get an extract on an document that has information about that..

[jllort]

well I think the problem is with security manager, you should read it http://wiki.openkm.com/index.php/Applic ... figuration

Basically the security can evaluate all path or only it own isolated security. Normally if you propagate changes to folders or add files to folder inherit security without changes the simple evaluation is right for you. But if you make changes in some nodes at the middle then probably you want to evaluate all security path.

Take in mind that has and extra evaluation time, that take some effect in search result time.

[wouterkitsz]

I've read up on the security models and I have tried the

Code: Select all

security.access.manager = recursive
 security.search.evaluation =  am_more 

option. This really did not work for me. Files were generally unaccesable. OpenKM showed random behaviour when I tried to navigate to the Manage tab (!). So when I was logged on as admininstrator I couldn't revert back to the earlier security settings. Maps and files that should be viewable and readable by both user 'readonly' and administator were not viewable at all. Files that should have been viewable to administrator were not either.
Directory structure:

Code: Select all

Root:
-Map A
 |_ file 1  (viewable for users readonly and administrator, viewable for role_users)
 |_ file 2 (viewable for users readonly and administrator, viewable for role_users)
- Map B
 |_ file 3(viewable for administrator, viewable for role_users)
 |_ file 4(viewable for dministrator,viewable for role_users)

I just tried again, setting the parameters and restarting OpenKM. This time I got all sorts of errors (Current error: 1) , where the root node could not even load. Is this a parameter you can only set when installing the server? Without any documents on it? So generally, it seems like this security option needs some more investigating. It doesn't work out of the box for me, at least.

[jllort]

I'm not sure but is probably should restart openkm to take effect. About administrator or other user member of ROLE_ADMIN take in mind these will not have any kind of security restriction appicable. Members of ROLE_ADMIN always will not have security restrictions and can access everything, can not set limit from security for them.

[wouterkitsz]

OpenKM cannot load the root node with these settings. So even the admin role is completely useless with these security settings. It renders OpenKM completely useless.

Code: Select all

OKM-012006(GetRootFolder): Interne programma-fout
null
Communicatiefout met server (getUserLastDownloadedDocuments)
Communicatiefout met server (callbackGetUserLastUploadedDocuments)
Communicatiefout met server (getLastMonthTopDownloadedDocuments)
Communicatiefout met server (getLastWeekTopDownloadedDocuments)
OKM-015006(findUserTaskInstances): OKM-015006
Could not find datasource
Communicatiefout met server (callbackGetLastUploadedDocuments)
OKM-015006(findPooledTaskInstances): OKM-015006
Could not find datasource
OKM-012006(GetCategoriesFolder): Interne programma-fout
null
OKM-012006(GetPersonalFolder): Interne programma-fout
null
OKM-012006(GetMailFolder): Interne programma-fout
null
OKM-012006(GetTrashFolder): Interne programma-fout
null

Any ideas? (i've restarted and rebooted)

[pavila]

Please, try with night build from http://integration.openkm.com/6.2/

[wouterkitsz]

Tried the nightly from a few days ago. Didn't help. Same errors.

[wouterkitsz]

I've used read_recursive and am_more now and the nightly from yesterday. Another thing I ran accross was that the root node contained too few authorizations. Never thought of that. Maybe that's what caused the error messages.
I think it runs like it should now. Thanks for the help!

Edit: ran into the same problems after a reboot. Other parameters than SIMPLE and LUCENE cause massive troubles and lead to unexpected behaviour (the kind of troubles like: works fine -> reboot -> root node will not load).
That's really too bad because it leads to an insecure solution for me. I'll keep trying the nightly builds until I find something more stable. Of course I am really interested in how other parties deal with this. I can not imagine that there are companies out there that use OpenKM with these kind of security/authorization issues.