File permission set as IWUI

Hi ,

TS 6.7.2 SP 1,
Unix,

We are creating few set of html files from the inputs given in DCR on a Save event.
So, we created a formAPI that calls a ipl file (this ipl file is placed under '//TServer/iw-bin' folder ).
We could succesfully able to generate the file but the file's permission are set to iwui (Interwoven TeamSite UI Daemons User).

Below is the code of the forms api , refered in our DCR

IWEventRegistry.addFormHandler("onSaveDone", validateForm);
function validateForm() {

var parameters = new Object();
var server = window.location.hostname;
var dcrpath = IWDatacapture.getDCRPath()

var WORKAREA = IWDatacapture.getWorkarea()
parameters.dcrpath = dcrpath;

parameters.WORKAREA = WORKAREA;
IWDatacapture.callServer("http://"+server+"/iw-bin/iw_cgi_wrapper.cgi/csr.ipl", parameters, true);
return true;
}

Even though we used the iw_cgi_wrapper.cgi (for handling this IWUI permission issue) but still the out put HTML file's permissions are set as IWUI, we tried to do the SU and chown but no use.

more informations on iw_cgi_wrapper.cgi , it runs as root with 4775 permissions (along ith the UID set)

Can any one point out what might be gone wrong in the above approach.

Thanks in advance

Find more posts tagged with

Comments

Adam Stoller

The only thing I can think of off-hand, though I don't think it will have any effect, is to change:

IWDatacapture.callServer("http://"+server+"/iw-bin/iw_cgi_wrapper.cgi/csr.ipl", parameters, true);

to just:

IWDatacapture.callServer("/iw-bin/iw_cgi_wrapper.cgi/csr.ipl", parameters, true);

Actually, you also might want to check into the iwutild.cfg file - it's possible that you may need to configure it to reference your script with explicit settings to do impersonation (and then try with, and without, the iw_cgi_wrapper.cgi in the FormAPI code)

Again - these have slim chances of success, but worth trying and at least excluding them ...

Nawin

thanks ghoti for the suggestion , actually i tried the other way too. but in vain , it was not useful either. I will give a try with iwutild.cfg , I hope if something turns out better I will share it here.

Thanks again ...

ISCBorisB

thanks ghoti for the suggestion , actually i tried the other way too. but in vain , it was not useful either. I will give a try with iwutild.cfg , I hope if something turns out better I will share it here.

Thanks again ...

That's strange... I've used the wrapper successfully in many versions, 6.7 including (btw, use Ghoti's notation, server prefix is redundant). So...
Does your cgi generate/write an output directly? Or perhaps along the way it calls some other process with its own effective uid?

Are you sure that suid is indeed set? Does root own the file? If you run the following, what does it show?
ls -al `iwgethome`/httpd/iw-bin/iw_cgi_wrapper.cgi

Nawin

Thanks Boris ,

as I mentioned earlier the wrapper is owened by root with suid set indeed, any way to just confirm i took this from the server.

-rwsrwxr-x 1 root daemon 5233584 Mar 20 2009

My ipl file runs a iwgen clt in it , which takes the DCR and TPL path , read the inputs to create set of HTML files.

Anil Kumar

I have this
-r-sr-xr-x 1 root root 11826866 Oct 11 2011

Nawin

hey Aneel, r u on TS 6.7.2 or more !

ISCBorisB

hey Aneel, r u on TS 6.7.2 or more !

"root daemon" is correct for unmodified 6.7 install.
Try to contact support. The version is in EOL but who knows, you might get lucky or know someone.

Also, my apologies if I ask the obvious but just in case...
How you authenticate, OS or LDAP? Are users you impersonate actually OS Users?

testClassic.rptdesign

Nawin

Hey Boris, we authenticate by LDAP , and the users are OS users.

Thanks