Page Comparison

...

1. Define the anonymous role. Note that this is already defined by default. If you must change it, change it here. Note also that the username assigned by the anonymous processing filter is not relevant to Pentaho security code that runs later in the request. Only the anonymous role is relevant. In this example, the anonymous username is anonymousUser and the anonymous role is Anonymous. Note where the role Anonymous occurs in subsequent examples. Note finally that role names are case-sensitive.

   Code Block
   xml xml title applicationContext-acegi-security.xml
   <bean id="anonymousProcessingFilter" class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter"> <!-- omitted --> <property name="userAttribute" value="anonymousUser,Anonymous" /> </bean>

2. Allow anonymous access to all web resources by editing the objectDefinitionSource on the FilterSecurityInterceptor to look like the example below.

   Note: Why does Authenticated appear in XML below? Because some client tools (for example, Schema Workbench) require a username and password to publish to the server. If you supply a username and password, then you are no longer anonymous.

   Code Block
   xml xml title applicationContext-acegi-security.xml
   <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor"> <property name="authenticationManager"> <ref local="authenticationManager" /> </property> <property name="accessDecisionManager"> <ref local="httpRequestAccessDecisionManager" /> </property> <property name="objectDefinitionSource"> <value> <![CDATA[ CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON \A/.*\Z=Anonymous,Authenticated ]]> </value> </property> </bean>

3. Use PentahoAllowAnonymousAclVoter as your IAclVoter implementation. See 03. You configure your IAclVoter implementation partially in pentahoObjects.spring.xml and partially in pentaho.xml for a description of how to configure this voter. When configuring this voter, you will define the anonymous user and role. That user and/or role should be used when assigning ACLs.

   Code Block
   xml xml title pentaho.xml
   <pentaho-system> <!-- omitted --> <objects><anonymous-authentication> <IAclVoter scope="global">com.pentaho.security.acls.voter.PentahoAllowAnonymousAclVoter</IAclVoter><anonymous-user>anonymous</anonymous-user> <!<anonymous-role>Anonymous</anonymous-role> omitted --> </objects>anonymous-authentication> <!-- omitted --> </pentaho-system> <anonymous-authentication>

   Code Block
   xml xml title pentahoObjects.spring.xml
   <beans> <!-- omitted <anonymous-user>anonymous</anonymous-user>> <anonymous-role>Anonymous</anonymous-role> </anonymous-authentication><bean id="IAclVoter" class="org.pentaho.platform.engine.security.acls.voter.PentahoAllowAnonymousAclVoter" scope="singleton" /> <!-- omitted --> </pentaho-system>beans>

4. Assign ACLs using the user and role defined in the previous step. Use these steps along with the settings below. Be sure to remove any active override entries.

   Note: Why does Authenticated appear in XML below? Because some client tools (for example, Schema Workbench) require a username and password to publish to the server. If you supply a username and password, then you are no longer anonymous.

   Code Block
   xml xml title pentaho.xml
   <pentaho-system> <!-- omitted --> <acl-publisher> <default-acls> <acl-entry role="Anonymous" acl="ADMIN_ALL" /> <acl-entry role="Authenticated" acl="ADMIN_ALL" /> </default-acls> <!-- remove any active overrides entries --> </acl-publisher> <!-- omitted --> </pentaho-system>

5. Finally, tell Pentaho the role that should be treated as the Pentaho administrator. In this case, it's the anonymous role mentioned earlier.

   Code Block
   xml xml title pentaho.xml
   <pentaho-system> <!-- omitted --> <acl-voter> <admin-role>Anonymous</admin-role> </acl-voter> <!-- omitted --> </pentaho-system>

   If you use global system actions, then you'll need to execute a few extra steps.
6. Compile and deploy the attached GlobalSystemActionsFilter.
Add the filter to applicationContext-acegi-security.xml. Code BlockxmlxmltitleapplicationContext-acegi-security.xml

<bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
  <property name="filterInvocationDefinitionSource">
    <value>
    <![CDATA[CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
    PATTERN_TYPE_APACHE_ANT
    /**=...,globalSystemActionsFilter,pentahoSecurityStartupFilter,...]]>
    </value>
  </property>
</bean>

<bean id="globalSystemActionsFilter" class="com.pentaho.security.GlobalSystemActionsFilter" />

Define your global system actions in pentaho.xml. Code Blockxmlxmltitlepentaho.xml <system-actions> <org.pentaho.core.session.StandaloneSession scope="global">samples/getting-started/HelloWorld.xaction</org.pentaho.core.session.StandaloneSession> </system-actions>