Forums

Hi all,

We realize that working with PACL/Security Manager takes some time and experience to build into your apps, so we're going to put together a team to help in answering some of the questions and issues that all of you may be having. We hope to have this ready soon - I'll provide updates as I get them.

Thanks everyone for your comments and feedback.

Hi Brian,

We are really looking forward to help from this team. We have several portlets ready which we would love to publish!

Thanks,
Maarten

Hi all,

As Brian mentions, we have put a team together to help Marketplace Developers work through the PACL issues you are facing. Some issues are configuration issues, others are due to PACL bugs. The triage team can help you figure out whether you simply have missing config, or have found a bug in PACL. I'm going to be on this team, as your community liaison (also known as Chief Pestering Officer) We'll go about it like this:

1. Develop your app following the official developer documentation (and Security Manager disabled)
2. After you're satisfied that your app works with the Security Manager disabled, turn it on
3. Go through the test->edit->repeat cycle to make a best effort at identifying and including all of the PACL resource declarations necessary for your app, using the official Security Manager docs.
4. If you believe you've done everything right, and you're still having issues related to PACL that you cannot solve, post your issue in this forum category (the one where this message is). Our triage team will engage with you and see attempt to determine if there really is a bug, or just missing configuration. You could also post an issue at issues.liferay.com but the triage team will be watching here and it is my hope that most issues are configuration issues and not really bugs in Liferay.

As mentioned, we have seen that most PACL issues fall into two main categories:

1. Missing PACL configuration. PACL is very granular, and requires that you declare all of the protected resources that your app might ever require during its execution. The documentation suggests you first develop your app with PACL disabled, then when you're all done, enable it, and exercise your app to discover which protected resources it requires. This is pretty tedious as of now, requiring multiple test->edit config->repeat cycles (and developers are investigating how to improve the developer experience going forward).

2. PACL Bugs. There are few already. Working with the triage team via this forum is the best way to discover whether you are hitting a bug. If you indeed discover a bug, the triage team will help you to file the issue at issues.liferay.com and get it fixed as quickly as possible.

So please give it a go, and post issues here, and we'll hopefully be able to resolve them as quickly as possible.

When those PACL be fixed, which requires a new Liferay relase, I'll be back to the Marketplace. It has no sense to fight with a poorly documented security environment that doesn't event work.