3

I would like to create a Component with a specific User, (e.g admin user) on delete event. If any user deletes a specific Page or Component, the delete event should create a Component in a particular location with admin User account.

Can someone tell me how to add an admin user account information for creating a new Component?

  • Sounds interesting... what component are you creating as a result of a deletion? Just out of interest... – Dylan .. Mark Saunders Aug 16 at 12:34
  • @Dylan..MarkSaunders You're not the only one wondering why! – Dominic Cronin Aug 16 at 15:24
7

I would not try to impersonate an admin user from the event system. It opens up all kinds of vulnerabilities that you probably don't want. Instead, I would create a separate service (e.g. a REST service) that accesses the core service with an admin account, and call that service from the event system.

6

Another option is to temporarily elevate permissions of the current user in the event handler:

using (ElevatedPrivilegesScope scope = new ElevatedPrivilegesScope(nonAdminSession, Privileges.SysAdmin))
{
    // Do your admin tasks
}

In this case, the component will be created on behalf of the current user (even if that user does not have privileges to do so in a normal scenario).

  • Interesting, I didn't know about this. Would the current user have to be configured as an impersonation user? If not, doesn't this constitute a major vulnerability? – Quirijn Aug 21 at 13:37
  • No, there are no extra requirements (like being an impersonation user) for the current user. We do not consider it a vulnerability, but a feature ;) Assumptions here are (1) you have to be a system admin in order to deploy event handler and (2) as a responsible admin, you understand what this extension does. More to that, ElevatedPrivilegesScope API can only be used in the event handler. If you try to use it anywhere else (in stand-alone TOM.NET application, for example), you'll get InvalidActionException. – AntonM Aug 22 at 6:27
  • In that case, I think this is the easiest solution for Arulmozhi's problem. – Quirijn Aug 22 at 7:49
  • For those new to the concept, @RickP answered a few questions I had on ElevatePrivileges. For fun, I "illustrated" the concept using virtual Lego for TDS 2017. – Alvin Reyes Aug 30 at 9:07
2

I think your question is more about how to "change" users instead of where to store the admin user details, right?

In the Core Service API it's possible to directly impersonate other users, but there is no TOM.NET counterpart that I'm aware of.

In TOM.NET (the Event handler code), you need to create a new instance of the Session class for the admin user. Take a look at the API documentation, namely the Session class and its overloaded constructor which takes in an account name. Also take note of the Remarks section about the current user needing to be configured as an impersonation user. You can search the SDL docs or here on SE about what these users are and how to configure them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.