Is there any way to find if the CurrentUser who is using my console application and interacting with CMS via Core Service is having permission to Impersonate any other user?
2
-
Are you asking if you can find it out by asking the Core Service? Or how you can see if a particular user can impersonate another (and you happen to want to use the Core Service with that user)?– Peter KjaerCommented Jul 31, 2015 at 14:33
-
I m asking how to find from the core service.– Chakresh SinghCommented Jul 31, 2015 at 14:34
Add a comment
|
2 Answers
I do not believe the Core Service exposes that information, so you'll need to call Impersonate in a try/catch block and handle the exception.
answered Jul 31, 2015 at 14:36
-
In SDL Docs it says: Connect to the Core Server as a different user if you do not want to connect as the currently logged-on user. This requires you to provide a password, or for your current user to have impersonation rights. Procedure If your current user does not have impersonation rights, connect another user by using the following code: ....... Alternatively, if the current user does have impersonation rights, you can also connect another user as follows:.... Looking at the statement I feel there must be some way. Commented Jul 31, 2015 at 14:38
-
You can certainly connect as a different user if you know their credentials. But that's not what you asked. Obviously, it would be a huge security hole to allow anyone to impersonate any other user just by supplying their name, so that's not an option. Commented Jul 31, 2015 at 14:43
-
I think the reason why there isn't a way to ask if you can impersonate is probably just that in most cases you would know if you can or not (or rather, if you need to or not). For instance, if your code is in a Windows service that runs as a system account -- you know you will need to impersonate the end user instead of the system account, and the system account will be an impersonation user. Normal users shouldn't have the ability to impersonate - only system users. Commented Aug 4, 2015 at 14:40
The user has privileges in CME, not in core service. So, whether an account can be used for core service interaction or not is dependent upon permission in CME.
answered Jul 31, 2015 at 14:28
-
Does it means If an account can be used for Core Service the same account can impersonate other user ? Commented Jul 31, 2015 at 14:33
-
1Certainly not. Any user who can access the system can do so using the CME or the Core Service (or any other API) -- but only Impersonation Users can impersonate other users. Impersonation users are configured in the Tridion Content Manager configuration. Commented Jul 31, 2015 at 14:37
-
For non-interactive applications you can use service account to access Core Service, like bulk publish or anything similar. For applications with user interaction you should always use the actual user rather than an impersonation user as that will help analyze and debug like who is using the system and making changes Commented Aug 4, 2015 at 11:16