OFBiz Security Setup

Last Updated 20230610

Note 20230609: Ran into a problem with using the SUPER admin account when trying to add content to a product. It errored out because the admin account is not associated with a PartyId.

This got me to thinking about best practices for the SUPER administrative permissions group. It should be created on installation, and then locked up and the userid and password only accessible by one responsible party. A business CEO, CFO or other third party should know how to open the safe or get access to the key should the IT guy become incapacitated. The SUPER account should not be used on a regular basis.

So that's when I started to think about security. Which leads to this section. The following code is most of the OOTB security groups and permissions. I have commented out the SECURITY_ groups as for the most part I don't think most employees should have this access. Need to work with security use the SUPER account. Everything else should be another user account.

Final note you should be aware of is that any user that has command line access to your server can shutdown ofbiz and enter the following command which will create a new SUPER user with the password ofbiz.

Command: gradlew loadAdminUserLogin -PuserLoginId=admin

The next steps in this section are to add the core security groups and step 2 is to add an employee with FULLADMIN group permissions.

Select

Web Tools

Select

XML Data Import

Copy

OFBiz Core Security

Paste in Complete XML document

Click on

Import Text

Goto the bottom of this page for step 2

Advanced Tip

Import data with the Web Tools as detailed in OFBiz Facility Setup .

<entity-engine-xml>

<!-- For general ledger accounting transactions. Note that any component that needs to post

accounting transactions should create a permission service SECA to grant

task-specific permissions to post transactions. The following permissions

should be given to accountants only, as that involves changing the books. -->

</entity-engine-xml>

Select

Party

Click on

Create Employee

Fill out all * boxes and 1 telephone number.

States are not selectable until Country is selected.

Click on

Save

Note: Security Question and Security Answer. Looks like it has something to do with when a user creates an account from the website side. You can see discussion on it in MarkLogic. It appears that it will be removed.

https://ofbiz.markmail.org/search/?q=%22Security+Question%22#query:%22Security%20Question%22+page:1+mid:2dhc4al4adwgvl7z+state:results

Click on

Security Groups

Select FULLADMIN Full Admin

Click

Add

The FULLADMIN group is now active

Click

Logout

Log back in using the AdminDave account and password you entered.

From Party Menu

Click on

AdminDave

Notice there is no Security Groups

Select Party

Select Parties

Click on

Security

Notice no permissions.

As of this date I think I have thought it through. We will find out in coming sessions. Remember that I am documenting what I am learning in real time.