3

Is there any way to find if the CurrentUser who is using my console application and interacting with CMS via Core Service is having permission to Impersonate any other user?

  • Are you asking if you can find it out by asking the Core Service? Or how you can see if a particular user can impersonate another (and you happen to want to use the Core Service with that user)? – Peter Kjaer Jul 31 '15 at 14:33
  • I m asking how to find from the core service. – Chakresh Singh Jul 31 '15 at 14:34
1

I do not believe the Core Service exposes that information, so you'll need to call Impersonate in a try/catch block and handle the exception.

| improve this answer | |
  • In SDL Docs it says: Connect to the Core Server as a different user if you do not want to connect as the currently logged-on user. This requires you to provide a password, or for your current user to have impersonation rights. Procedure If your current user does not have impersonation rights, connect another user by using the following code: ....... Alternatively, if the current user does have impersonation rights, you can also connect another user as follows:.... Looking at the statement I feel there must be some way. – Chakresh Singh Jul 31 '15 at 14:38
  • You can certainly connect as a different user if you know their credentials. But that's not what you asked. Obviously, it would be a huge security hole to allow anyone to impersonate any other user just by supplying their name, so that's not an option. – Peter Kjaer Jul 31 '15 at 14:43
  • I think the reason why there isn't a way to ask if you can impersonate is probably just that in most cases you would know if you can or not (or rather, if you need to or not). For instance, if your code is in a Windows service that runs as a system account -- you know you will need to impersonate the end user instead of the system account, and the system account will be an impersonation user. Normal users shouldn't have the ability to impersonate - only system users. – Peter Kjaer Aug 4 '15 at 14:40
0

The user has privileges in CME, not in core service. So, whether an account can be used for core service interaction or not is dependent upon permission in CME.

| improve this answer | |
  • Does it means If an account can be used for Core Service the same account can impersonate other user ? – Chakresh Singh Jul 31 '15 at 14:33
  • 1
    Certainly not. Any user who can access the system can do so using the CME or the Core Service (or any other API) -- but only Impersonation Users can impersonate other users. Impersonation users are configured in the Tridion Content Manager configuration. – Peter Kjaer Jul 31 '15 at 14:37
  • For non-interactive applications you can use service account to access Core Service, like bulk publish or anything similar. For applications with user interaction you should always use the actual user rather than an impersonation user as that will help analyze and debug like who is using the system and making changes – Vipin Kothari Aug 4 '15 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.