Community
Participate
Working Groups
We may configure Orion to let only admins to create new accounts. It means we need to have the admin account created when Orion starts the first time. So, if Orion starts the first time, 'admin' account is created with password passed with a system property 'orion.storage.admin.default.password'. If the property is not used, the password is set to 'admin'. Since the user storage is not aware of user access rights, we need to edit Users.prefs manually and add rights to use '/users/*' URLs. During M6, 'admin' account will have Admin role set and roles will be respected in our Authorization service.
On second thought I decided to create the 'admin' account ONLY IF the property 'orion.storage.admin.default.password' is set. If it is not set, the 'admin' account is not created.
Fixed.
(In reply to comment #1) > On second thought I decided to create the 'admin' account ONLY IF the property > 'orion.storage.admin.default.password' is set. If it is not set, the 'admin' > account is not created. +1
There seems to be a missing piece here. If I set the system property, the admin account gets created but it doesn't have permission to manage users. I had to add the following when creating the admin user: AuthorizationService.addUserRight(ADMIN_LOGIN_VALUE, UserServlet.USERS_URI); AuthorizationService.addUserRight(ADMIN_LOGIN_VALUE, UserServlet.USERS_URI+"/*"); //$NON-NLS-1$ Once I make this change, the administrator is allowed to visit: http://localhost:8080/manage-users.html And from here can see all users, delete users, etc.
I have pushed this change for M5. Unless I am missing something, the administrator can't do anything without this change.
(In reply to comment #5) > I have pushed this change for M5. Unless I am missing something, the > administrator can't do anything without this change. As wrote in comment 0: "Since the user storage is not aware of user access rights, we need to edit Users.prefs manually and add rights to use '/users/*' URLs. During M6, 'admin' account will have Admin role set and roles will be respected in our Authorization service." So your change is good for M5, but will be reverted during M6 and Admin role will be added instead to newly created admin account.
