Omni admin for more than one instances!

[MICHAIL MOUDATSOS, modificado hace 12 años.]

Hello all,

to my understanding, Omni-admins could belong to a single liferay instance, the default instance. After digging into forum and discovering how to change the name of my default instance, and found out that it is directed by company.default.web.id property once, at installation of Liferay and first startup, I created my default instance and another instance lets say a.com and b (without .com). I used one DB but TWO application server installation in two DIFFERENT MACHINES.

Here note that after some unsuccessful attempts I realized that the name of the default instance should end with ".com" in order to be applied properly at installation . A rather important detail which is NOT explicitly documented ANYWHERE. (I even came across a thread where a guy was complaining he did everything right and yet liferay.com was set as default instance and not the value he had specified and another guy answered that he tried with A.com and B.com and it worked, and argued that something must be wrong with the first guys setup, and no one ever clarified this!)

Having said that, after some time, since in my code I was accessing those names, and in order to be able to switch those two sites in terms of which one would be the default instance, I decided to change the second instance name from 'b' to 'b.com'. In order to avoid recreating the instance and all of its configuration and deployed portlets (yes I know I can export, however, sometimes this does not work properly) I changed the name directly in db and deployed my new code. Later at some point I changed the value of the company.default.web.id in the portal-ext.properties file of the b.com instance installation, from a.com to b.com. Then I realized that when logging in with the adminstrator user of each site, in both cases users had access to the omni admin control panel capabilities!!!

Is this something that is normally expected in a Liferay installation, or is it something that should NOT happen? I am stating all these because on documentation it is implied that there exist only one default instance and only a user from this instance can be an omni admin. As a side effect note that the following behavior also changed:

Before I changed the company.default.web.id setting at the instance installation, when I was starting up the instance, and the browser was fired up with address http://localhost:8080, even though I was accessing it from the machine whose ip corresponded to the defined virtual host for the instance, aka b, the returned page was that of the default instance, aka a.com. (This was a rather misfortunate feature, a consequence of the fact that if the application server gets an http request with a name that does not correspond to any of the defined virtual host names for each instance the default instance is shown, for which feature I had received bad comments from the IT security dpt of a client). This was highly undesirable.

After the change at the b instance installation (changed name in db from b to b.com and changed name in portal-ext.properties at the installation of the machine whose ip was assigned to b.com instance) http://localhost:8080 did not point any more to the default site, rather it returned the same site with http://ip-of-machine-hosting-b:8080

I would really like to hear some coments on that from the Liferay-team

Thank you in advance

[David H Nebinger, modificado hace 12 años.]

TLDR.

[MICHAIL MOUDATSOS, modificado hace 12 años.]

...which means?

[David H Nebinger, modificado hace 12 años.]

too long, didn't read...

[MICHAIL MOUDATSOS, modificado hace 12 años.]

Yeah thanks, for no...tifying me about it.

In a nut-shell:

Two Liferay application server installations - one db\
Use first installation as default instance, with name,eg, a.com by setting company.default.web.id =a.com
Assign second installation machine's ip as new instance with name b.com
set name of default instance in portal-ext.properties in the b.com machine to company.default.web.id =b.com
administrators of both instances are omni-admins

Is this eligible for reading?

Thank you IN ADVANCE ;)

[David H Nebinger, modificado hace 12 años.]

So how did you define your omni admins? Through the portal-ext.properties file? If it is the same file for both instances, it would make sense that the users would be omnis in both instances....

[MICHAIL MOUDATSOS, modificado hace 12 años.]

Correct me if I am wrong, but I think that a user having the "Administrator" Role and belonging to the default instance, consequently "IS" an omni-admin.
Is this wrong or right?

I have noticed that users with "Administrator" role of instances cannot have access to Control Panel administration functions such as
Server Administration
Portal Instances
Plugins Installation
Update Manager

functions wich are all grouped to a menu with the name Server.

Following the actions described above an administrator user of an instance GAINS access to this functionality. Is this something that should happen?

PS. BTW, you did not read my initial post, nevertheless, it included an important detail which is not documented anywhere and should get more attention. In order to actually make the setting of company.default.web.id value to actually have effect at installation of Liferay the value must end with ".com" otherwise the default liferay.com value is used! (One could spend job-HOURS trying to find out what is going wrong for such a small and counter-intuitive, not to mention undocumented, detail)

[David H Nebinger, modificado hace 12 años.]

Nope, omni-admins are special users that can log in w/o a password (they can access the portal even if the authentication mechanisms are broken). Normally you define them in the portal-ext.properties file.

Separating instance admins from server admins is a good thing, don't you think?

As far as the first post, it is expected that the instance name be tied to your internet host name (whether internal or external) since that's the determining factor for which instance you get directed to. It's unfortunate if that hasn't been made clear, but I'd have to believe it's covered somewhere in the documentation or in training...

[MICHAIL MOUDATSOS, modificado hace 12 años.]

David H Nebinger:

or in training...

I'm sorry to say this but it is sad to hear that it its covered somewhere in training. Having a free and open source community distribution, Liferay should be able to be used without training as long as one follows all existing documentation. Notice that I'm not talking about doing quantum-mechanic science stuff here. Setting the name of your default instance its a simple yet necssary thing everyone would like to do for his/her installation of Liferay.

One more thing. In liferay-portal / portal-impl / src / com / liferay / portlet / admin / util / OmniadminUtil.java

/**
 * Provides utility methods for determining if a user is a universal
 * administrator. Universal administrators have administrator permissions in
 * every company.
 *
 * <p>
 * A user can be made a universal administrator by adding their primary key to
 * the list in <code>portal.properties</code> under the key
 * <code>omniadmin.users. If this property is left blank, administrators
 * of the default company will automatically be universal administrators.
 * </code></p><code>
 *
 * @author Brian Wing Shun Chan
 */
</code>

<br><br>Notice the "If this property is left blank" part of the documentation. So my impression was not entirely false. Therefore, following the scenario I described earlier you can get to have administrators of two different liferay instances (i.e. corresponding to two different companyIds), both having access to the "Server" Control Panel functionality group. So, returning to my initial question. Should this normally happen?