Impersonation problem

Hi,

I have an ipl script which adds the extended attribute Expiration_Date to the DCR and to the xml which is being generated from the dcr. I am calling this script on onsavedone event using callserver. The problem is when the script updates/ adds the extended attribute the modified by appears as "system". I have already tried using iw_cgi_wrapper.cgi but when i use it my script doesnt even run, i had placed my script in iw-bin directly and then used wrapper to execute it but no success.

Is there any way that the "modified by" should not appear as system.

Find more posts tagged with

Comments

vaibhav2288

Hi,

I have an ipl script which adds the extended attribute Expiration_Date to the DCR and to the xml which is being generated from the dcr. I am calling this script on onsavedone event using callserver. The problem is when the script updates/ adds the extended attribute the modified by appears as "system". I have already tried using iw_cgi_wrapper.cgi but when i use it my script doesnt even run, i had placed my script in iw-bin directly and then used wrapper to execute it but no success.

Is there any way that the "modified by" should not appear as system.

iw_cgi_wrapper.cgi should work for impersonation of the user.

But if not then, the script will run as SYSTEM, hence it sets the SYSTEM as user. You need to set the owner by using custom code in the script which you are running.

While calling your script you can pass the name of the current user who is going to invoke the script from FormAPI js script as parameter to callserver.

Using the CLT "iwaccess" you can set the owner of the DCR or XML file.

After the extended attribute are set on the DCR or XML, then at the end of the script run the bellow CLT.

iwaccess set-owner vpath user

vpath - path of the DCR or XML file.
user - username

Adam Stoller

Hi,

I have an ipl script which adds the extended attribute Expiration_Date to the DCR and to the xml which is being generated from the dcr. I am calling this script on onsavedone event using callserver. The problem is when the script updates/ adds the extended attribute the modified by appears as "system". I have already tried using iw_cgi_wrapper.cgi but when i use it my script doesnt even run, i had placed my script in iw-bin directly and then used wrapper to execute it but no success.

Is there any way that the "modified by" should not appear as system.

I assume this is a Windows implementation - yes?
If so, I believe you will find that unless the user being impersonated has Logon Locally privileges on the TeamSite server, the impersonation aspect of iw_cgi_wrapper.cgi won't work (I'm pretty sure it used to work up to TS 6.5, but ...)

The easiest way to verify this is [temporarily] make the user a member of the [Windows] Local Administrators group and try using the callServer script with iw_cgi_wrapper.cgi and see if it "works".

Clearly, providing Logon Locally privileges to all TS users is probably not something your security team would want to do, but at least it will give you some verification of issue, and you can try to work out what to do from there (which may be just to let things stay owned as SYSTEM)

swatis

@VAIBHAV - Thanks for the reply but i need to change the modified by attribute this is different from owner and the way suggested by you alters the owner, so its not working for me.

@adam - We can't go ahead with the Local Logon properties, it'll give users the extra rights which will not be acceptable by the admins. I am using windows server and teamsite version in 7.1. Let me know if there is any other approach.

I also tried to do call server and adding the extended attribute Expiration_Date before saving the form as i am using setdcrname and IWDatacapture.save() in the code but the last modifier is still coming as "system" may be till the time the call returned from the call server the save executes before that..

Adam Stoller

...
@Adam - We can't go ahead with the Local Logon properties, it'll give users the extra rights which will not be acceptable by the admins. I am using windows server and teamsite version in 7.1. Let me know if there is any other approach.

I also tried to do call server and adding the extended attribute Expiration_Date before saving the form as i am using setdcrname and IWDatacapture.save() in the code but the last modifier is still coming as "system" may be till the time the call returned from the call server the save executes before that..

As I said - the use of Logon Locally privileges should be tested so that the issue / "resolution" can be validated.

On Unix systems it is possible to set up users with "local" accounts that have no login shell and thus avoid the security issue (but leave a maintenance / administrative issue). I don't believe there is any such option for Windows - the entire security model of Windows is such that it is difficult to do what amounts to a seteuid call there.What's weird is that I'm pretty sure that this kind of thing worked with earlier versions of TeamSite - which would then be an indication that there's a bug in the product code rather than an insurmountable problem in the OS platform -- but I could be wrong about that and no longer have access to old versions of TS to test it.Regardless - I still think you should go through the process of testing the logon locally privilege "fix" - and you should probably open a case with Support (even through they may tell you the exact same thing; there's a chance they might be able to come up with a different "solution").

ISCBorisB

What's weird is that I'm pretty sure that this kind of thing worked with earlier versions of TeamSite...

In 6.7 I have quite a few custom menu items that create files, assign metadata and so on. Impersonation through iw_cgi_wrapper works flawlessly.
Authentication is through ADS, only couple masters have local accounts.

swatis

@adam - This is a cgi wrapper, and the script that i am trying to execute is ipl is it fine to execute ipl using cgi wrapper?

Adam Stoller

@Adam - This is a cgi wrapper, and the script that i am trying to execute is ipl is it fine to execute ipl using cgi wrapper?

Is this your own custom CGI wrapper or the OOTB iw_cgi_wrapper.cgi?

If the former, don't expect impersonation to take place unless you programmed it specifically to perform that function - in which case the question would be why?

If the latter - that's what the iw_cgi_wrapper.cgi is for, so assuming that your IPL script lives directly in IWHOME/httpd/iw-bin (not in a sub-directory therein) - then the impersonation should work - but still may be hampered by the lack of logon locally privileges of the logged in (to TS) user -- which, as I've pointed out before, is something that you should be able to test / verify.