Content Server user permissions for web services

Hi All,

I've finished some application integration code for Content Server webservices (CS2010) in C# .Net, which does standard type functions, cat and att searches via a search slice, result display, uploading and categorising documents etc.

At the moment I'm running this code on our dev environment as the Cs admin user and all is working fine. I'm now trying to switch this application to use a standard content server account with reduced permissions i.e. only the exact permissions that user needs to carry out the above tasks and no more.

I have made sure the user is set up ok, and has the permissions on all the categories, slices, folders and items where it is searching/retrieving content from and adding to etc, and the user currently has 'public access' enabled (though ideally I want to remove that at some point). If I login to Content Server as this account I can carry out all of the same functions required i.e the same searches, open / add documents etc fine.

However it seems that somewhere I'm missing some extra permissions that this user should have to be able to run the same commands via web services. If i make the named user have 'system administration' rights the code will run fine, but I don't really want to give this integration user such power.

Is there anywhere that documents the minimum permission sets that a user needs to run web services type commands?

many thanks

John

Find more posts tagged with

Comments

John_Henderson

P.S

Should have said that I'm using the client/ token based authentication via

CS.Authentication. OTAuthentication

This itself is not failing for the integration user account, and I can get back a AuthenticationToken fine for the user, just it doesn't seem to have all the permissions to carry out the web service searches and document uploads.

Maybe part of the web services / system configuration model the user will need to have permission on is missing?

cheers

John

Guy_Pomerleau

Does it fail for any type of action thru the web services? Is it livelink account or Directory services account?

John_Henderson

Hi Guy,

The account is a basic livelink account and not via AD etc.

At the moment, the web service methods I'm using here are all failing (search, doc upload etc).

Wondering whether a web services user has to be a system administrator ? (but hoping not!)

cheers

John

Jason_Smith

Hi John,

Any user can interact with the web services as long as they can authenticate. The permissions for the user should be what you would expect (the same as what you would expect in a browser through the GUI interface), and if you try to access something or make a web service call to a function that a user should not have permissions for the call should fail with an appropriate error message.

What are the web service methods that you are calling and what errors are you getting (SOAP Fault Code / Error Message)?

Thanks.

John_Henderson

Hi J,

That's good to hear.

I've managed to sort out the uploading content ok (a stray permission level on a category...my mistake), but my web services search isn't working currently.

However, at least I can now concentrate on double checking specific permissions and not worry about the system admin side.

Will do some more debugging...

cheers

John

John_Henderson

Hi J,

My search is failing because when running the following web services search as a normal user, it doesn't seem to be able to return the property 'OTDataID' in the search result spec

I'm using a standard SingleSearchRequest i.e

SingleSearchRequest request = new SingleSearchRequest ();

But within my ResultTransformationSpec

request.ResultTransformationSpec = csResultSpec;

I have the 'OTDataID' system column specified

Is it possible that this property is not available to non admin users?

cheers

John

Kyle_Swidrovich

Hey John,

That should be accessible as regions are not permissioned – only the objects returned in the results are.

Maybe you’re not getting any matching results?

What checkboxes do you have enabled for OTDataID on the Enterprise Search Manager’s Regions page (in the Enterprise Data Source Folder of the System Object Volume [?func=ll&objtype=148])?

I’m curious to know if OTDataID is marked as Queryable and/or Displayable.

Thanks,

Kyle

John_Henderson

Hi Kyle

Thanks for the reply.

OTDataID wasn't ticked to be queryable or displayable, I've now ticked this and that's fixed that one, OTMIMEType was then an issue, even when ticked in the search manager regions, but I then realised it's display name was 'MIMEType' only and in my code I am reading friendly names from the regionnames, so 'OTMIMEType' would have never been a column in my results so that's sorted that one.

friendlyrgn = regionnames.ContainsKey(originalrgn) ? regionnames[originalrgn] : originalrgn;

Just working on the last few category attributes that aren't now coming through on the search now.

cheers

John

John_Henderson

The only odd thing was that when those regions weren't available to be displayed under the search manager region settings, when running the web service search as a user with system admin rights, it was still able to return those attributes abeit without their friendly names (and that's how thought the results were returned in my code so it was returning the original attribute name as the friendly names i.e 'Attr_' etc.

Now running having made these attributes available to the search manager, it is returning the attribute friendly names ok, so have changed the code to go back to using the original name as the results header.

Either way, sorted now so thanks for everyone's help.

Kyle_Swidrovich

Glad to be of help.
Just a quick comment... dev says that users with bypass privileges (System Admin or "Admin") are allowed to request any region they wish.
Regular users will only be able to request the regions marked as Displayable.

John_Henderson

Thanks Kyle, that would explain it.

One last point, do you know if the user that calls the web services always needs to have 'Public Access' enabled to carry out searches via web services?

If we turn off 'Public Access' for this user, then no search results are returned. What I'm trying to find out is whether that's caused by a dependancy on 'Public Access' itself, or just that 'Public Access' was enabling a permission somewhere that could be added independantly.

cheers

John

Kyle_Swidrovich

Hey John,

In order to perform a search, the user would need permissions to the slice and permissions to the search manager referenced by the slice (e.g., Enterprise Search Manager).

Typically this permission is available via Public Access.

If you decide to turn off Public Access for a user, then an explicit See/See Contents ACL entry would need to be added to those nodes for them to be able to search.

Cheers,

Kyle

John_Henderson

Thanks Kyle, just what was looking for. Think it's the permission on the Search Manager that will be missing. Will add it and give it at try.

John_Henderson

Hi Kyle,

Only just got back to look at if web services searches can be run with a user that has 'Public Access' disabled, I've given the web services user permission on the slice and the Search Manager, but the web services search still fails unless the user has 'Public Access'.

Any idea if there are any other objects that user needs specific 'See/See Contents' permissions added to to be able to run search without Public Access?

many thanks

John