I solved it with a work around. But this has problems.
I wrote a sling filter and mapped it to the folder I wanted to restrict access, so if anyone calls for that folder or any sub-folder/file the request passes through my Filter.
In my filter I check if user has logged in or not. But the problem that now appears is that anybody who wants to access this folder must log into my Application, with which the session gets set. And the Admin(CQ main Author can't access the folder itself.)
The Admin has to stop my bundle(the one with above mentioned filter) and then access the DAM folder as the Filter in the Bundle prevents the CQ Admin to access the DAM. Any quick solutions?
Code:
package com.xxx.hiresite.filters;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.apache.felix.scr.annotations.Properties;
import org.apache.felix.scr.annotations.Property;
import org.apache.felix.scr.annotations.Reference;
import org.apache.felix.scr.annotations.sling.SlingFilter;
import org.apache.jackrabbit.api.security.user.Authorizable;
import org.apache.sling.api.resource.ResourceResolver;
import org.apache.sling.api.resource.ResourceResolverFactory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@SlingFilter(order = -1000)
@Properties({
@Property(name="service.pid", value="com.xxx.hiresite.filters.DAMAccessFilter",propertyPrivate=false),
@Property(name="service.description",value="DAM Documents Authentication Filter", propertyPrivate=false),
@Property(name="service.vendor",value="Zensar Tech", propertyPrivate=false),
@Property(name="pattern",value="/content/dam/xxxdocuments/.*", propertyPrivate=false)
})
public class DAMAccessFilter implements Filter{
private final Logger log = LoggerFactory.getLogger(this.getClass());
@Reference
protected ResourceResolverFactory resolverFactory;
public void destroy() {
}
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
// Authentication Filter for the whole application
log.info("DAMAccessFilter Invoked***************************");
HttpServletRequest httpServletRequest = (HttpServletRequest)request;
String path =httpServletRequest.getRequestURI();
log.info("Request URI ::"+path);
HttpSession session = httpServletRequest.getSession(false);
if(session ==null || session.getAttribute("userId")==null)
{
log.info("DAMAccessFilter :: Not Logged in");
HttpServletResponse httpResponse = (HttpServletResponse)response;
httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
}
else
{
log.info("DAMAccessFilter :: Logged in");
chain.doFilter(request, response);
log.info("DAMAccessFilter Done");
}
}
public void init(FilterConfig config) throws ServletException {
}
}
