Display a document without authentification

Question

I am currently developping a java/jee application using alfresco as ged and spring as a framework.I want to display a file in the navigator without authentification requirment.So how can i do that.By the way i have 2 modules in my project:Frontend and backend which are communicating via rest calls.From the backend i tried to pass the byte array of the object but unfortunately i recieved it as string so i can't work with it.So any suggestion to solve this issue?

   public Map<String, Object> getCourrierDetails(String idCourrier) throws Exception {
        Map<String, Object> courriersDetails = runtimeService.getVariables(idCourrier);
courriersDetails.put("idCourrier", idCourrier);
        DocumentDaoImpl dao=new DocumentDaoImpl();

        Document docCmis = (Document) dao.getDocument("workspace://SpacesStore/73871a36-9a6c-42c6-b3e3-7d68362fe9c0");

        byte[] myByteArray = readContent(docCmis.getContentStream().getStream());


        ByteArrayResource resource = new ByteArrayResource(myByteArray) {
            @Override
            public String getFilename() {
                return docCmis.getContentStreamFileName();
            }
        };
        System.out.println(resource.getFilename());
        //courriersDetails.put("resources", myByteArray);
        System.out.println(courriersDetails.get("resources")+" rrrr");
        //courriersDetails.put("contentStream",docCmis.getContentStream().getStream());
        return courriersDetails;
    }

Answer 1

Assuming your front-end and back-end are custom and your back-end communicates with Alfresco, all you need to do is write a proxy that resides in your back-end.

The proxy can establish a session with Alfresco using a pre-configured "service account" that has access to the content. In this way, the person using your custom webapp does not use their own credentials to get the object from Alfresco. Instead, the service account is used and the web app streams that to the requester.

For example, in one of my projects I have an AssetService that uses CMIS to get the InputStream from content given its ID:

public InputStream download(String assetId) {
    CmisObject obj = session.getObject(assetId);
    Document doc = null;
    if (obj.getBaseTypeId().equals(BaseTypeId.CMIS_DOCUMENT)) {
        doc = (Document) obj;
    }
    return doc.getContentStream().getStream();
}

Then, my Controller just asks the service for the asset to get some info about it to make it easy to set some helpful headers, then it gets the input stream from the asset service and returns that:

@RequestMapping(value = "/api/asset/{assetId:.+}/download/{name}", method = RequestMethod.GET)
public ResponseEntity<InputStreamResource> downloadAsset(
        @PathVariable("assetId") String assetId,
        @PathVariable("name") String name) {

    // get the asset so we can get some info about it
    Asset asset = assetService.getAsset(assetId);

    // set the http headers (mimetype and length at a minimum)
    HttpHeaders httpHeaders = new HttpHeaders();
    httpHeaders.setContentType(MediaType.parseMediaType(asset.getMimetype()));
    httpHeaders.setContentLength(asset.getLength());

    // get the content stream
    InputStream inputStream = assetService.download(assetId);
    InputStreamResource inputStreamResource = new InputStreamResource(inputStream);

    return new ResponseEntity<InputStreamResource>(inputStreamResource, httpHeaders, HttpStatus.OK);
}

This example uses Spring MVC within a Spring Boot app but of course you could do something similar with a plain old servlet if you want.

Answer 2

One option is to write your own web script and set it up in a way that it allows guest access.

http://docs.alfresco.com/4.1/concepts/ws-authenticating.html

There's also an option to completely disable permission checking, which I have never tried, though.

https://community.alfresco.com/thread/175381-disabling-permission-checking