Hide portlet based on user role

[Sushruth P, geändert vor 12 Jahren.]

I am using liferay 6.0.6 with Oracle 10g. I did the following steps...

1. I created a new portlet "P" & deployed under liferay.
2. I created a new user "U".
3. Logged in as user "U".
4. I added the portlet "P" to my page.
5. Created a new role "R".
6. I then edited role "R". Gave view permission to portlet "P".
7. Assigned user "U" with role "R".
8. I was able to see the portlet as user "P".
9. I then edited role "R" & removed the view permission to portlet "P".
10. When I login as user "U" I still see the portlet "P" on my screen.

Just info.

1. I do have layout.show.portlet.access.denied=false in my liferay-portlet.xml file & portal-ext.properties file.
2. When I created the portlet the first time I gave role access for only GUEST, POWER UER, ADMINISTRATOR.
3. I recreated the portlet with no roles & repeated steps 1-10 & still see the portlet.

What am I doing wrong?

[jelmer kuperus, geändert vor 12 Jahren.]

Some roles are implicit, like user, power user, guest, community member make sure you removed view permission from those as well for that portlet

also you'll want to set

layout.show.portlet.access.denied=false

in portal.properties

or set the set the "show-portlet-access-denied" parameter in liferay-portlet.xml for that specific portlet

This will make sure the portlet is hidden instead of a permission denied message being shown

[Sushruth P, geändert vor 12 Jahren.]

Thanks for this. I have removed all view permissions for my portlet. In fact I deployed my portlet with no roles associated with it. No luck, if I login as a user who does not have view permission on this portlet it still shows up. This should be a pretty simple operation, hide/show an error message on a portlet if a user does not have view permissions on it.

[jelmer kuperus, geändert vor 12 Jahren.]

Ok i have the feeling i might be misunderstanding you

You can revoke the view permission on a portlet only after you placed it on a page

You drag a portlet on the page then change the permissions.

If you do not want a portlet to show up in the list of available portlets you need to revoke the add to page permission you can co that in control panel > Plugins Configuration

[Sushruth P, geändert vor 12 Jahren.]

My intention is to hide the view permissions for a user on a portlet. I placed the portlet on the page. Then modified the role associated with this portlets permission to hide the portlet. But the portlet is still visible.

When I revoke the "add to page" permission for a portlet, I dont see it in the list of available portlets. But when I revoke the "view" permission on a portlet I still see the portlet on the page. Thats the problem I am facing.

[Raymond Gardner, geändert vor 12 Jahren.]

I'm trying to do the same thing and I'm seeing the same behavior. The portlet keeps showing up on the page.

I'm sure there is a simple approach to handling this.

Can anybody explain the steps involved?

[Raja Nagendra Kumar, geändert vor 12 Jahren.]

Programmatic way to achieve this is check if user in role in the JSP before rendering the view...

See more at http://www.ibm.com/developerworks/websphere/library/techarticles/0703_hesmer/0703_hesmer.html

Yes, this approach is not advised, if support can be enforced through Liferay Adminconsole as per the JSR standards

Regards,
Raja Nagendra Kumar,
C.T.O
www.tejasoft.com

[Raymond Gardner, geändert vor 11 Jahren.]

Raymond Gardner:

I'm trying to do the same thing and I'm seeing the same behavior. The portlet keeps showing up on the page.

I'm sure there is a simple approach to handling this.

Can anybody explain the steps involved?

We got this working for Liferay EE 6.0.

Once I add a portlet to a page, I go into its portlet configuration options found in the portlet's title bar.
The permissions for this portlet are displayed. I grant 'View' access to a specific role, say 'R', I'm using to control whether or not this portlet gets displayed for the user.
The only other settings are for 'Owner' which is granted access to all permissions and for 'User' which is granted 'Add to Page' by default and it is not changable.
Save it.

Now, once a user accesses this page and has role 'R' then this user will see the portlet. If a user accesses this page but does not have role 'R' then the user will not see the portlet.

The problem is we recently upgraded to Liferay EE 6.1 and now this feature does not work. The portlet in question is showing up for everybody. Same setup as with 6.0.
The strange thing is that we do this to many portlets, each having their own 'R`' role, and one of them works as expected while none of the others work properly. They are all configured the same way except that they each have their own role 'R`'.

Is there any knowledge about this feature changing in EE 6.1? Are the permissions handled differently?

My feeling is that this is some kind of Liferay deployment issue because it works for one of our portlets but not the others. Plus, I've seen other strange Liferay deployment issues where we'd deploy a changed, not new, portlet plugin and Liferay would indicate the deployment finished successfully. However, upon inspection, we would not see our new change. In order for it to get picked up we'd have to undeploy the existing plugin and then deploy it again as a new plugin. This would cause Liferay to see our new change. We mostly do our deployments through the Control Panel's Update Manager screen rather than dropping a war file into the deploy folder on the OS.

Thanks!

[Steve Cochran, geändert vor 11 Jahren.]

I'm trying the same thing in 6.1 CE and a portlet in a page is showing for everyone even if only owner has permissions.

Seems like a simple thing, have some portlets appear for some users, not for others.

[Raymond Gardner, geändert vor 11 Jahren.]

After further review ...

It appears to only be an issue with pages that allow customization. We only display the customizable page to the user.
We don't allow them to view the default page or even reset their customizations to the default, as can be done in the Liferay classic theme.

Thus, it seems these customizable pages are not picking up the permissions we set.

[Premek Steidl, geändert vor 10 Jahren.]

Hi,
we are facing the same problem. I found this Liferay issue (https://issues.liferay.com/browse/LPS-28909), hopefully will be fixed soon.

If you have any workarkound, please let me know.

Thank you,
Premek

[David H Nebinger, geändert vor 12 Jahren.]

Sushruth P:

1. I created a new portlet "P" & deployed under liferay.
2. I created a new user "U".
3. Logged in as user "U".
4. I added the portlet "P" to my page.

At this point user U is the owner of portlet P and does not require roles to view it.