Sunil's Notes: impersonation

Showing posts with label impersonation. Show all posts

Assign user right's to impersonate other users

The WebSphere Portal Server V7.0 allows a user to impersonate other users, but in order to do that a user should have rights to impersonate users.

You can assign the right to user using WPS Admin Console like this

You will have to give Can Run As User rights to the user so that he can impersonate other user

Enabling Impersonation Service in WPS 7.0

By default impersonation is turned off and you will have to follow these steps to turn it on

Log into WAS Admin Console for WebSphere Portal Server

Go to the Resource Environment Provider -< WP_AuthenticationService -< Custom Properties and add a custom property like this

Name: logout.explicit.filterchain Value:com.ibm.wps.auth.impersonation.impl.ImpersonationLogoutFilter

Go to the Resource ENvironment Provier -< WP_PortletServiceRegistryService -< Custom properties page and add a property like this

Name : jndi.com.ibm.portal.portlet.service.impersonation.ImpersonationService Value: com.ibm.wps.portletservice.impersonation.impl.ImpersonationServiceImpl

Save your changes and restart the portal server

Out of box Impersonation portlet with WebSphere Portal 7.0

The WebSphere Portal Server started supporting impersonation from version 6.1.5, but in the V6.1.5 you were supposed to create your own impersonation portlet and use ImpersonationService provided by portal for impersonating.

But starting from Version 7.0, WPS ships a Out of box Impersonation portlet. This portlet is pretty simple, it lets you search for a user and then once you click on the name of the user it starts impersonating that user.

I just created a simple page and added Impersonation portlet to it like this, i want to impersonate "Sunil Patil" so i searched for it

Now when i click on the user name the impersonation session starts, which means the user is logged in as impersonated user which is "Sunil Patil" in my case and it takes user to Home page like this

I will have to logout from the portal before i go back to the impersonation portlet, if i try going to the impersonation portlet i get this error

Creating Impersonation URL in the theme

As per the portal Infocenter, we can create a Impersonation link in the theme by adding following code to the theme


<portal-logic:if loggedIn="yes">  
  <portal-logic:if userImpersonated="false">
    <portal-navigation:urlGeneration contentNode="ibm.portal.Impersonation">
      <li><a href='<% wpsURL.write(escapeXmlWriter); %>'><portal-fmt:text key='link.impersonate' 
      bundle='nls.engine'/></a></li>
    </portal-navigation:urlGeneration>
  </portal-logic:if>
</portal-logic:if>

I tried adding this code to banner_toolbar.jsp in default IBM theme but it does not work, first i got compiler error in portal:logic tag saying the userImpersonated attributed does not exists and when i changed in Info center it seems that portal:logic tag does not have that attribute.

Then i tried without the portal:logic tab and it seems that the ibm.portal.Impersonation content node does not exist either. So portal cant generate url to that page.

Sample Impersonation portlet

WebSphere Portal 6.1.5 has a feature called Impersonation that you can use to create a portlet that will let support person impersonate other users.

I built a sample portlet to demonstrate how to use impersonation service. This sample portlet has a form where you can enter uid of the user that you want to impersonate, once you enter uid and click submit, it will impersonate that user. Once your done and want to switch back to the original user you can click on Switch back to original user link. You can download this sample portlet from here

Important Note: I followed the documentation to build this portlet and i could get impersonation part working but switching back to original user is not working. Even after calling ImpersonationService.loginOriginalUser() method it still keeps showing impersonated user. But when i click on logout, it starts showing the original user. I got this problem on WebSphere Portal Version wp6103_201_01 2009-11-07. I am planning to apply fixpack 6.1.5.1 to my portal and see if it helps

This is how my ImpersonationPortlet.java looks like


package com.webspherenotes.misc;

import java.io.IOException;

import javax.naming.InitialContext;
import javax.naming.NamingException;
import javax.portlet.ActionRequest;
import javax.portlet.ActionResponse;
import javax.portlet.GenericPortlet;
import javax.portlet.PortletException;
import javax.portlet.ProcessAction;
import javax.portlet.RenderRequest;
import javax.portlet.RenderResponse;

import com.ibm.portal.portlet.service.PortletServiceHome;
import com.ibm.portal.portlet.service.impersonation.ImpersonationException;
import com.ibm.portal.portlet.service.impersonation.ImpersonationService;

public class ImpersonationPortlet extends GenericPortlet{

  PortletServiceHome psh;
  public void init() throws PortletException {
    System.out.println("Entering ImpersonationPortlet.init()");
    try {
      InitialContext context = new InitialContext();
      psh= (PortletServiceHome)context.lookup(ImpersonationService.JNDI_NAME);
    } catch (NamingException e) {
      e.printStackTrace(System.out);
    }
    System.out.println("Exiting ImpersonationPortlet.init()");
  }

  protected void doView(RenderRequest request, RenderResponse response)
      throws PortletException, IOException {
    System.out.println("Entering ImpersonationPortlet.init()");
    
    response.setContentType("text/html");
    getPortletContext().getRequestDispatcher("/index.jsp").include(request, response);
    System.out.println("Exiting ImpersonationPortlet.init()");
  }

  @ProcessAction(name="switchUser")
  public void switchUser(ActionRequest request, ActionResponse response)
      throws PortletException, IOException {
    System.out.println("Entering ImpersonationPortlet.switchUser()");
    try {
      String userId = request.getParameter("USER_NAME");
      System.out.println("Value of USER_NAME " + userId);
      ImpersonationService impersonationService = psh.getPortletService(ImpersonationService.class);
      impersonationService.doImpersonate(request, response, userId);
    } catch (ImpersonationException e) {
      e.printStackTrace(System.out);
    }
    System.out.println("Exiting ImpersonationPortlet.switchUser()");
  }

  @ProcessAction(name="originalUser")
  public void originalUser(ActionRequest request, ActionResponse response) throws PortletException, IOException{
    System.out.println("Entering ImpersonationPortlet.originalUser()");
    try {
      
      ImpersonationService impersonationService = psh.getPortletService(ImpersonationService.class);
      System.out.println("Switching back to original user " + impersonationService.getOriginalUser());
      System.out.println("Is User Impersonated " + impersonationService.isUserImpersonated());
      impersonationService.loginOriginalUser(request, response);
      System.out.println("After switching back to original user " + request.getRemoteUser());
    } catch (ImpersonationException e) {
      e.printStackTrace(System.out);
    }
    System.out.println("Exiting ImpersonationPortlet.originalUser()");
  }
}

The ImpersonationPortlet has following two methods that can handle the Action Request,

switchUser: method will get called whenever user enters a uniqueName for the user that you want to impersonate and click submit. In this method i am reading name the value submitted by user and then calling impersonationService.doImpersonate() method with userName submitted by the user. THis method will switch the user and redirect you to the home page for that user

originalUser: THis method will get called when user clicks on Switch back to original user link, at this point i am calling impersonationService.loginOriginalUser(request, response) method to switch back to the original user.

This is the jsp that gets displayed to the user in the VIEW mode and has methods for impersonating and switching back the user.


<%@page language="java" %>
<%@taglib uri="http://java.sun.com/portlet_2_0" prefix="portlet"%> 
<portlet:defineObjects />

<%
  String userId = request.getRemoteUser();
%>
<portlet:actionURL var="switchUserUrl">
 <portlet:param name="javax.portlet.action" value="switchUser" />
</portlet:actionURL>
<h4>Current User - <%=userId %></h4>
<h4>Enter name of the user to impersonate</h4>
<form method="post" action="<%=switchUserUrl %>">
<table>
  <tr>
    <td>User Id</td>
    <td><input type="text" name="USER_NAME" /></td>
  </tr>
  <tr>

    <td><input type="submit" name="submit" /></td>
  </tr>

</table>

</form>
<portlet:actionURL var="originalUserUrl">
 <portlet:param name="javax.portlet.action" value="originalUser" />
</portlet:actionURL>

<h4>Click on URL to switch back to Original User</h4>
<a href='<%=originalUserUrl %>' >Switch back to original user</a>

This is the screen shot of the impersonation portlet

What is impersonation

Websphere Portal 6.1.5 has a new feature called Impersonation, what it does is allow a user, such as a support specialist, to access another user's system to test out a new page, portlet, etc. and to see any issues as they occur on the end user system. Portal Access Control (PAC) controls the ability to impersonate another user. To be able to impersonate another user, the Delegator role on the virtual resource Users, i.e. Delegator@Users must be assigned. You first need to enable the impersonation feature within IBM WebSphere Portal.

The impersonation feature is disabled by default and you will have to follow these steps to enable it

Log on to the WebSphere Application Server Integrated Solutions Console or Network Deployment Administration Console.

Perform the following steps to enable the Impersonation feature:
1. Navigate to Resources > Resource Environment > Resource Environment Providers > WP Authentication Service > Custom Properties.
2. Click New.
3. Enter logout.explicit.filterchain in the Name field.
4. Enter com.ibm.wps.auth.impersonation.impl.ImpersonationLogoutFilter in the Value field.
5. Click Apply and then click Save to save the changes directly to the master configuration.
6. Navigate to Resources > Resource Environment > Resource Environment Providers > WP PortletServiceRegistryService > Custom Properties.
7. Click New.
8. Enter jndi.com.ibm.portal.portlet.service.impersonation.ImpersonationService in the Name field.
9. Enter com.ibm.wps.portletservice.impersonation.impl.ImpersonationServiceImpl in the Value field.
10. Click Apply and then click Save to save the changes directly to the master configuration.
11. Stop and restart the WebSphere_Portal server.
12. Perform the following steps to assign the Delegator role to a user:
  - Log on to WebSphere Portal as the Administrator.
  - Click Administration.
  - Click Access > User and Group Permissions.
  - Click Users.
  - Search for the user you want to assign as Delegator.
  - Click the Select Resource Type icon for the required user.
  - Navigate to the page that contains the Virtual Resources option, using the Page Next button and click that link.
  - Navigate to the page that contains the USERS option and click the Assign Access icon.
  - Select the Explicitly Assign checkbox for the Delegator role.
  - Click OK.
  - Verify that the required user now has User and Delegator access.