CODEWITHSUNDEEP
xpages
Marc Jonkers
Marc Jonkers

Reputation: 506

use acl protected nsf in website

I 've some nsf (let's call them one.nsf and two.nsf)files for which anonymous doesn't have access. Another nsf for example website.nsf contains unid's and filenames for some pictures and documents from those nsf files (one.nsf and two.nsf) . How can I show( I mean access) those pictures and documents in an "xpage" website ? Do I have to create a kind of fictitious user on the server ?

Upvotes: 0

Views: 87

Answers (1)

Sven Hasselbach
Sven Hasselbach

Reputation: 10485

You can do this by creating an Agent or an XAgent which acts like a proxy to access the images / documents etc. in a different user context.

The agent runs in the context of the user / ID who has signed the agent - and this is the user who needs access to one.nsf and two.nsf. The XAgent could access the data with sessionAsSigner or sessionAsSignerWithFullAccess and return the result.

But keep in mind that this would create a security hole in your current application security: Why has only a limited user group access to your pictures? Why not allow access to these images / documents for public access users? Maybe it would be better to create a three.nsf which only contains the data which is accessible for every user and give access to public users to this db instead.

EDIT: A while ago I have created a DocumentDataSource with allows higher access, but this bring you into the same security trouble: http://hasselba.ch/blog/?p=723

Upvotes: 2

Related Questions