Develop Reference

Is there a way to provide security and authorization for assets in AEM

Is there a way to provide security and authorization for assets in AEM?
We drop assets to the pages and all of the assets are viewed by the end users after login. we want to restrict that an asset on the page should be displayed only to the specific users(even though they can login). If the user has an URL of the asset and after logging in they are able to view that asset.
The requirement is to restrict the asset to the particular users only even they can login to the page.
Appreciate in your time.

This feature is supported OOTB in AEM. You need to build right groups with right access to the assets. By default on publish instance 'anonymous' user has read rights on the /content/dam. You need to do following -
Remove anonymous user access, also check for all other groups to which you want to disable access and update them accordingly (You need to do this using /useradmin console)
Create the different groups to which you can assign different users based on the required access (its better to govern access via groups than by users)
To these each group provide access to relevant folder under /content/dam
Add users to these group as needed
Now when the user logs-in, they will have access to the assets restricted to their group only.
For more details on user management in AEM read this article.

As you said you want authors to have control over which groups can view the assets. So in author dialog of component populate all user group to make it configurable for author. Then in your code check whether the group has permission against the asset path-
UserManager userManager = resourceResolver.adaptTo(UserManager.class);
Authorizable auth = userManager.getAuthorizable(<<group configured by author>>);
JackrabbitAccessControlManager acm = (JackrabbitAccessControlManager) adminSession.getAccessControlManager();
Set<Principal> principals = new HashSet<Principal>();
principals.add(auth.getPrincipal());
Privilege[] privileges = acm.getPrivileges(<<current assets path>>, principals);
you can check the privilege array for permissions. If group has permission than only render the asset.

How to get a user role

I have a project based on documentum, and after user login I'd like to know what's his role.
The reason is that there is a requirment for a menu-action to be enabled just for users who has the specific role.
Assume I have the username (being taken from the login page), how can I do this?
Do I have to put this data on session once the user logged in? I'd prefer to have a one line code that could be called from the client side (javascript) and on the fly doing the disabling of the menu action.

When you login at that service u can create a JSON which will have value of which all menus are enabled for the logged in user.Now when the screen loads with menus u can use this JSON data to hide/display or enable/disable the menu items.
Or else u can write a scriplet tag in the the disables attribute and in the scriplet tag you can call a class static method which returns true or false based in the user details sent.

You can use the following condition to determine the role of a user. I have provided it as a DQL, but you can use the logic to fit it in your code.
select group_name from dm_group where any i_all_users_names = "user_name"
Hope this helps.

Fetching user name (windows) from a java application

Problem:
I am logging into a virtual machine(RDC) using the below credentials:
The user is part of a domain group called as teldept
user:147852 pass:helloworld
when i try to get the user details from java application it gives me : 147852
but when i click on start menu at the top i can see my Name displayed.
How is this done? i want to access this name from java application
I use the below snippet:
System.getProperty("user.name");
Whatever the above snippet gives me is correct as aper oracle docs.
I am logging in with ID: 147852 and above snippet gives me 14852
but some how in windows this ID:147852 is mapped with my name so only in the start menu in XP i am getting my name displyed instead of 147852. we need to know how this mapping is done between the ID & Name . I am guessing it has something to do with Domain or some network logic which i am not good with .

The name shown on XP's start menu is not the logon name. It's Full Name Corresponding to the Logon Name. Not sure if your login is a local login or a domain login. If it's a local login, go to Admin Tools -> Computer Management -> Users and Groups -> Here against your username (147852), you will find a full name.
If your login is a domain login, you can similarly lookup your name in Active Directory - or search for it at other places.
This is very OS Specific and cannot be found by Java.
You will need to do this using JNI and Windows API - Calling GetUserNameEx or NetUserGetInfo depending on type of user.
If you just want to get your logon name (147852), calling com.sun.security.auth.module.NTSystem().getName is a better way than using System.getProperty("user.name")

From this SO question, you can use:
System.getProperty("user.name");
to return the currently logged in user. This will return the username string. I believe this is what you're asking for, but your question is rather unclear.

Java EE : Prevent application URL hacking

I am working on an existing Web based application.
Now, I need to secure the application against what I think is called url hacking. For instance, if the customer with customerId 1 is logged in and viewing his profile, the following http get variable will be visible in the address field: customerId=1.
I need to prevent a customer from being able to set customerId=2 and see the profile of another customer.
The problem is that, the application is already in production and in good working condition, so the changes should be minimal with respect to this change.
How is this best achieved?
Any sugggestions/comments?

why do you give the id in the URL when the user should only be allowed to change his profile? I don't see any need for this. Rather get the current user from SecurityConext and display its profile on an URL without the id.
with the new information you gave in the comments I suggest sth. like this:
just check if the given orderid in the URL belongs to the current user.
You're saying you use "normal web based Application" so I assume Servlet/jsp based. In your servlet you would do something like this:
int orderId = Integer.parseInt(request.getParameter("orderId"));
String username = request.getUserPrincipal().getName();
/*now you need to check if username match with the username of the order e.g. by using hibernate to get the order by id and check its user and if not throw PermissionDeniedException or similiar*/

95% agree with Korgen's answer above.
5% - if you want to allow administrator access to edit user profiles using the same functionality just switch to UUID to identify edited user.

Cannot get authenticated user info, but can get address book from Google Contacts

I ran into an interesting case where it seems to indicate that the documentation for Google Contacts API is incorrect.
What I'm trying to do is getting the contact information of authenticated user who has already given permission to the app using this URL:
https://www.google.com/m8/feeds/contacts/default/full/contactId
The result of the call is always status 404. However, when I'm trying to get full address book, it seems to be working fine.
https://www.google.com/m8/feeds/contacts/default/full
Is it documented incorrect or I'm doing something wrong? It makes no sense that I can get the whole address book without being able to get contact information of the authenticated user.
The scope I'm using is:
https://www.google.com/m8/feeds
Thanks,
Jack
Additional information. The API documentation shows the following:
public static ContactEntry retrieveContact(ContactsService myService) {
ContactEntry contact =
myService.getEntry(new URL("https://www.google.com/m8/feeds/contacts/default/full/contactId"),
ContactEntry.class);
// Do something with the contact.
return contact;
}
This seems to mean that "contactId" keyword should used as part of URL. It just doesn't work for me.
To clarify this question. The goal is to get information on current authenticated user without having to go through workaround of fetching data multiple times. Even with the workaround of fetching all contact first, I didn't see any contactId of authenticated user coming back with it.

It depends on what you are trying to get. If you call https://www.google.com/m8/feeds/contacts/default/full, then you are looking for all the contacts. Now, when you get back the contacts, you can request the data for a single contact by using https://www.google.com/m8/feeds/contacts/default/full/{contactID} where {contactID} is the last part of the field from the full contact list. It will look like http://www.google.com/m8/feeds/contacts/{user email}/base/{contact id}.
So, if you get back the full contact list, a single contact will have an ID field that looks like: http://www.google.com/m8/feeds/contacts/{user email}/base/{contact id}. If you take that last {contact ID} and append it to the end of the call (https://www.google.com/m8/feeds/contacts/default/full/{contactID} ), you will get back the contact information for just that contact.