Need solution on rendering problem

Question

Hi..
I have two queries.
1)Say if i have 3 portlets in a page.
If a user have access to any one portlet ,that page should be displayed.But if user dont have access to all the 3 portlets then the entire page should not be displayed.
Similarly..In a book...if all the pages dont have entitlement to the user,then book should not be displayed dynamically.
2)In the main menu,say we have 3 books.
Book1 have 4 pages as dropdown menu...in which one page1 is entitled to user B.
When user login..in the main menu..book1 name is shown ..but the drop down menu to display page 1 is not coming..but when i visit the other pages and come back..it is correctly showing the drop down..
Do any one have an idea..of why this rendering problem is comming and how to achieve both 1 and 2 of above problems.
A quick response is much appreciated...
Thanks
Joshika

Answer 1

1) BookBackingContext bbc = BookBackingContext.getBookBackingContext(request);
List children = bbc.getPageBackingContexts(); // this returns only entitled children
check the size of the list and if zero set the book as not visible / not active / return false from pre-render (i cant recollect which one works now). As before setting the union of the entitlements on the book is the easiest soln
Do you mean given a userName get his entitlements ? I dont think this is easily possible - there is no direct api anyway(especially considering the fact that say entitlements can depend on session values so how would you get the entitlements for a different user given that he may not have logged in, much less know the current values in his session)
If your entitlements are only based on Groups/ Users then you can essentially derive this information.
If it is based on UUP then you can derive this information if you are willing to hardcode the knowledge of the entitlement rule in code.
If it is complete dynamic and uses all the features
You might try
a. Use HTTPServletRequestWrapper to spoof the request especially its principal and pass it to the API's. This probably might not work because it depends on the bea implemention whether it gets the subject from the thread and not from the request
b. Use IdentityAssertion and make a Separate HTTPRequest to say a custom servlet/jsp which will return you the logged in user's entitlements. the identity assertion spoof's the user you are interested in . Again this wont work for entitlements that are defined using Session / Request Property Sets.
regards
deepak
regards
deepak