best practices question about portlet permission control

[Tibor Kiss, geändert vor 12 Jahren.]

I am migrating a spring mvc + webflow webapp into liferay and I have to create a portlet which has to be placed on a guest page, so the first landing page of the portlet (with 3 images with portletUrls to start some actions) has to be visible by guests, but when the guest is clicking on some of the urls before going to switch the portlet pages, I would check if it is already logged in. If not, then I would forward to login page, then immediate after login page, I would continue with the previously saved portletUrl.

I'm not sure if this kind of logic is feasible from best practice point of view.

Some other method of controlling the permission it would be that on the page with guest permission, I would place only the first links which once clicked would forward to a hidden page, maintained to be similar from content point of view, going directly into the portlet and preferably activating it with windowState=maximized.
This approach would save me from managing fine granular permissions within the portlet, but it would introduce page manageability overhead, so that I always have to maintain two pages, to look very similar from content point of view.

What would you recommend me?
If you know an example in liferay 6.1ga sourcecode, could you point me to them?
Thanks!

[Juan Gonzalez P, geändert vor 12 Jahren.]

Tibor Kiss:

I am migrating a spring mvc + webflow webapp into liferay and I have to create a portlet which has to be placed on a guest page, so the first landing page of the portlet (with 3 images with portletUrls to start some actions) has to be visible by guests, but when the guest is clicking on some of the urls before going to switch the portlet pages, I would check if it is already logged in. If not, then I would forward to login page, then immediate after login page, I would continue with the previously saved portletUrl.

I'm not sure if this kind of logic is feasible from best practice point of view.

In your case I would do the target portletUrl as separate portlets instead separate pages. In that case, you could control permissions of each portlet separately. If someone wants to access some page of one of those portlets, Liferay would ask for login to user automatically. I didn't test this myself but it should work.

Tibor Kiss:

Some other method of controlling the permission it would be that on the page with guest permission, I would place only the first links which once clicked would forward to a hidden page, maintained to be similar from content point of view, going directly into the portlet and preferably activating it with windowState=maximized.
This approach would save me from managing fine granular permissions within the portlet, but it would introduce page manageability overhead, so that I always have to maintain two pages, to look very similar from content point of view.
Thanks!

I would let always Liferay to control permissions. It's easy to maintain later. AFAIK, Liferay has only one page per view, and this view is dynamically created depending on user permissions, so you have to maintain only one JSP.

[Tibor Kiss, geändert vor 12 Jahren.]

Thank you for the answer.

Finally I created two portlets. A very simple portlet which is publicly accessible, and the complex one with webflow.
Both portlets has similar view in initial state, with the difference, that the simple portlet renders urls by creating it with

LiferayPortletURL secondPortletUrl = PortletURLFactoryUtil.create(...)

If I pass a quickStart parameter, the second portlet, the webflow will interpret that this is a quick start, so it will skip to display the first page which looks similar in both portlets.
Unfortunately, the plid of the second page is currently hardcoded. It would be nice to have a code snippet which can search for pages by its url or directly to find which pages has a specific portlet name.

Juan Gonzalez P:

I would let always Liferay to control permissions. It's easy to maintain later. AFAIK, Liferay has only one page per view, and this view is dynamically created depending on user permissions, so you have to maintain only one JSP.

I was referring to two portlet pages, not two JSP. I have a public page and a hidden one, with restricted permission to view for guests. Both pages are filled with similar content, except this portlets. Since these two portlet's initial view looks identical, from user point of view everything is ok.