nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Logon Locally - Impersonation

Rob76

Windows Server 2003 SP2
TS 6.7.2 SP1

Is there a workaround or another approach that allows the utility daemon to impersonate external tasks when specific users of TeamSite are not granted "Logon Locally" permission?

For users that have this right to "logon locally" impersonation works great.

There are security risks and maintenance involved when allowing TS users to logon locally to the TS Server.

Thanks
Robert

Find more posts tagged with

Comments

nipper

Depends on what you are trying to do. OOTB, no. TPL driven templates, no. External tasks in workflows yes, set them to tsadmin or some user that has permission to log on locally.

This would not be too hard to do, but then people would continue to use TPL templates which IWOV is trying hard to discourage. IMHO that is.

Rob76

The requirement is when files are modified by an external task script, the "modifed" user name should be set correctly on the file in the TS UI. Setting the external task user name to "SYSTEM" or "tsadmin" won't work b/c the modifed name will be set to that user. It also defeats the purpose of impersonation.

We need to use iw_user as the owner of the external task and have the util daemon set the correct impersonation modifed id.

However, like I said before, there are security risks and maintenance involved when allowing TS users to logon locally to the TS Server.

Thanks
Robert

Cust_Orders_Payments.rptdesign

nipper

Then you have conflicting requirements and need to choose one.

Rob76

The requirement is clear ... I wish I could choose the requirement, would make things much easier Smiley Happy

I was hoping there was a work around to enabling the "Log On Locally"

Crsb

Windows Server 2003 SP2
TS 6.7.2 SP1

Is there a workaround or another approach that allows the utility daemon to impersonate external tasks when specific users of TeamSite are not granted "Logon Locally" permission?
Robert

is the external task running java program or perl script?

In java, once you finish processing, you can use cssdk to create and set "Modified by" EA with value of iw_user (which is different than the the modified by that you see in the file properties), this EA will get picked up by the UI and it will show in the "last modified by" column.

you can also do the same thing in perl
this is only good if you are dealing with files that are always handled by an external task... if the users have to edit those files manually, then they will be getting some warning messages that the files were modified by somebody else other than "what ever value is in Modified by EA". that is because the UI doesn't update your custom EA "Modifed by".

that is one of the workarounds i can think of, which of course has disadvantages but you can work around them.

Rob76

is the external task running java program or perl script?

In java, once you finish processing, you can use cssdk to create and set "Modified by" EA with value of iw_user (which is different than the the modified by that you see in the file properties), this EA will get picked up by the UI and it will show in the "last modified by" column.

you can also do the same thing in perl
this is only good if you are dealing with files that are always handled by an external task... if the users have to edit those files manually, then they will be getting some warning messages that the files were modified by somebody else other than "what ever value is in Modified by EA". that is because the UI doesn't update your custom EA "Modifed by".

that is one of the workarounds i can think of, which of course has disadvantages but you can work around them.

Yep using Perl.

That's very interesting... I wasn't aware of that feature!

iwextattr -s "Modified by"="domain\user" "/default/main/branch/WORKAREA/wa/someFile.txt"

Setting that attribute actually updates the value in the UI. Cool!

And editing the file through the UI does update the value in the UI. Should not be an issue that the EA did not update.

This should work for us... Thanks for the help!

Rob76

Hi Crsb

I realized after the fact setting that EA actually updated the file with my user account b/c I was running that command to set the EA. The UI was not actually being updated from the EA value I was setting.

My understanding from your description is that you are able to set an EA that is read by the UI which updates the default "Modified By" column in the UI. Correct?

Could you give me the name of the EA to set? Or the command to invoke using iwextattr?

Thanks
Robert