Obtaining Superuser password in code?

Is there any way to obtain the superuser password rather than hardcoding it in the code? Is the aek.key any use? I am creating a new seesion as the super user in my code by setting the user id and password. However, we now have to change the super user password on a regular basis and need a way to get at it without changing the code everytime the password is changed. We use LDAP authentication. Thank you

Find more posts tagged with

Comments

CláudioGil

Normally, in those situations, I invoke a method in method server to avoid having to know the password. In the method server you can create a session for the installation owner (System.getProperty("user.name")) without a password. With a superuser session we can obtain a login ticket for any other user.

lpotts

I use IDfLoginInfo to set the super user session. I am not sure how this would work with your suggestion. Please elaborate. Thanks!

DCTM_Guru

The same applies. You dont have to pass in a value for password when you use IDfLoginInfo.

lpotts

I tried not passing in the password by commenting out the line but I got a DOes not authenticate error. Below is my code.

String currentDocbase =

null;IDfClient client = DfClient.getLocalClient();

sMgr = client.newSessionManager();IDfLoginInfo login =

new DfLoginInfo();login.setUser(superuser

);

currentDocbase = SessionManagerHttpBinding.getCurrentDocbase();

sMgr.setIdentity(currentDocbase, login);IDfSession session =

sMgr.getSession(currentDocbase);

DCTM_Guru

This only works if you server method is configured to "Run As Server". You cant debug your code locally without passing the password.

CláudioGil

That code needs to be in a method and run in the Method Server. That is flexible in that you can escalate the permissions as you want in you business code but it takes a big amount of work to set up:

Create a jardef with the code
Create a module
Create a dm_method (with run_as_server = true)
Install to content server
Setup the client side invocation
- Includes setting up the arguments and ensuring they are correctly escaped if necessary

I use the following class as a base for dm_method invocation (CollectionBlock is a class that iterates over a collection, calling processCurrent(), and ensures the collection is closed in the end):

public abstract class MethodInvoker {

     public abstract String getMethod(IDfSession session) throws DfException;
     public abstract String getArguments(IDfSession session) throws DfException;
     public abstract void handleFailure(int retVal) throws DfException;
     
     protected class ProcessResultsBlock extends CollectionBlock {
          
          @Override
          protected void processCurrent(IDfCollection collection) throws DfException {
               boolean failed = collection.getBoolean("launch_failed");
               int retVal = collection.getInt("method_return_val");
               
               if (failed) {
                    handleFailure(retVal);
               }
          }
          
     }

     public MethodInvoker() {
          super();
     }

     public void invokeMethod(IDfSession session) throws DfException {
          checkResults(createCommand(session, getArguments(session)).execute(session));
     }

     private IDfApplyDoMethod createCommand(IDfSession session, String args) throws DfException {
          IDfApplyDoMethod command = (IDfApplyDoMethod) DfAdminCommand.getCommand(IDfAdminCommand.APPLY_DO_METHOD);
          
          command.setMethod(getMethod(session));
          command.setArguments(args);
          command.setLaunchAsync(false);
          command.setRunAsServer(true);
          
          return command;
     }

     private void checkResults(IDfCollection results) throws DfException {
          new ProcessResultsBlock().execute(results);
     }
     
}

Note: You can start the method server in debug mode (uncomment the relevant line in the bin/run.bat) and debug the code remotly by attaching the debugger in the 8787 port (default value).

lpotts

Thank you for your posts. I just found out that our installer account ins't the same as the superuser I need to set my session to, so I will have to continue investigating.

DCTM_Guru

If you implement your code using IDmMethod class, you dont have worry about passing in the username. The install owner will come from parameters that the server will pass to the method as part of the execute method:

public void execute(Map params, OutputStream ostream) throws Exception