Form Builder Access in 4.0

Sirs:

I am trying to restrict the building of forms in certain applications to specified users.  I followed the instructions in “Documentation > II. Developer and Administration Guide > Form Runner > Form Runner Access Control > 4 Access control for editing forms” at http://wiki.orbeon.com/forms/doc/developer-guide/form-runner/access-control.  I am working with orbeon-4.0.0.201302221940-PE.

I want only users who have the role “argo-app1-form-editor” to be able to create or modify forms in application “ArgoApp1” and only users who have the role “argo-app2-form-editor” to be able to create or modify forms in application “ArgoApp2”.  This seems to work. 

One problem I am having is, when I assign the same user to both roles, the Form Builder Summary Screen shows only the forms in one application.  So, by looking at this Summary Screen, the user does not see that he can modify forms in the other application he has permission to modify.  If I click “Show search options”, the Application Name box drop-down-list does show both application names, and selecting the second application makes the forms in that application appear in the list.  The statement in the documentation, “The Form Builder summary page will only show forms the users have access to” is correct; however, the summary page does not show all the forms the user has access to.  So the user does not have an overall view of which  forms he can modify.  My first question is, how do I show the user all the forms he has permission to update?  Or, how do I prompt him to search for more?

The second problem I am having is, when this user clicks the “New” button on the Form Builder Summary Screen, the pop-up that appears lists both applications the user has permission to change, but it limits him to just those applications.  The user has no way to create a new application or forms in a new application.  Defining that a user has permission to create/update forms in specified applications should not prevent his creating a new application to contain new forms.   I guess it would be possible to set up the  user’s permission to create/update forms in the new application before the new application is created, but this seems backwards.  The form author should be able to create a new application and forms, and then set the security that applies to them.  My second question is, how do I allow a user who has permission to create/update forms in a specified application to create a new application and forms in a the new application?

I tried adding another “overall-editor” role and assigning the user to it with the following entries:

In tomcat-users.xml         <role rolename="argo-overall-form-editor"/>

<user username="thomacha" password="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" roles="orbeon-user,orbeon-form-builder-role1,argo-app1-role,argo-app2-role,argo-app1-form-editor,argo-app2-form-editor,argo-overall-form-editor"/>

In form-builder-permissions.xml

<role name="argo-overall-form-editor" app="*" form="*"/>

But, it did not solve my problem.

Thank you.

Here are my form-builder-permissions.xml entries:

               <role name="argo-app1-form-editor" app="ArgoApp1" form="*"/>

               <role name="argo-app2-form-editor" app="ArgoApp2" form="*"/>

Here are my tomcat-users.xml entries:

               <role rolename="orbeon-user"/>

               <role rolename="orbeon-form-builder-role1"/>

               <role rolename="argo-app1-role"/>

               <role rolename="argo-app2-role"/>

               <role rolename="argo-app1-form-editor"/>

               <role rolename="argo-app2-form-editor"/>

               <user username="thomacha" password="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" roles="orbeon-user,orbeon-form-builder-role1,argo-app1-role,argo-app2-role,argo-app1-form-editor,argo-app2-form-editor"/>

               <user username="formUser1" password=" xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx " roles="orbeon-user,argo-app1-role"/>

               <user username="formEditor1" password=" xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx " roles="orbeon-user,argo-app1-role,orbeon-form-builder-role1,argo-app1-form-editor"/>

Here are my properties-local.xml entries:

               <!-- Enable Container-Driver security roles -->

               <property as="xs:string" name="oxf.fr.authentication.method" value="container"/>

               <!-- Specify possible security roles -->

               <property as="xs:string" name="oxf.fr.authentication.container.roles"

                                             value="orbeon-user argo-app1-role argo-app2-role orbeon-form-builder-role1 argo-app1-form-editor argo-app2-form-editor"/>

Here are my /orbeon/WEB-INF/web.xml entries:

    <security-constraint>

               <web-resource-collection>

                              <web-resource-name>Form Runner pages</web-resource-name>

                              <url-pattern>/fr/*</url-pattern>

               </web-resource-collection>

               <auth-constraint>

                              <role-name>orbeon-user</role-name>

               </auth-constraint>

    </security-constraint>

    <!-- Try limiting access to Form Builder to user orbeon-form-builder-role1 -->

    <security-constraint>

               <web-resource-collection>

                              <web-resource-name>Form Builder</web-resource-name>

                              <url-pattern>/fr/orbeon/builder/*</url-pattern>

               </web-resource-collection>

               <auth-constraint>

                               <role-name>orbeon-form-builder-role1</role-name>

               </auth-constraint>

    </security-constraint>

    <!-- Try limiting access to ArgoApp1 in Form Runner to user argo-app1-role -->

    <security-constraint>

               <web-resource-collection>

                              <web-resource-name>ArgoApp1</web-resource-name>

                              <url-pattern>/fr/ArgoApp1/*</url-pattern>

               </web-resource-collection>

               <auth-constraint>

                              <role-name>argo-app1-role</role-name>

                              </auth-constraint>

    </security-constraint>

    <!-- Try limiting access to ArgoApp2 in Form Runner to user argo-app2-role -->

    <security-constraint>

               <web-resource-collection>

                              <web-resource-name>ArgoApp2</web-resource-name>

                              <url-pattern>/fr/ArgoApp2/*</url-pattern>

               </web-resource-collection>

               <auth-constraint>

                              <role-name>argo-app2-role</role-name>

                              </auth-constraint>

    </security-constraint>

    <security-role>

               <role-name>orbeon-user</role-name>

               <role-name>orbeon-form-builder-role1</role-name>

               <role-name>argo-app1-role</role-name>

               <role-name>argo-app2-role</role-name>

    </security-role>

Here are my Tomcat server.xml entries:

<Realm className="org.apache.catalina.realm.LockOutRealm">

               <!-- This Realm uses the UserDatabase configured in the global JNDI

                              resources under the key "UserDatabase".  Any edits

                              that are performed against this UserDatabase are immediately

                              available for use by the Realm.  -->

                              <Realm className="org.apache.catalina.realm.UserDatabaseRealm"

                                                            digest="MD5"

                                                            resourceName="UserDatabase"/>

               </Realm>