Possibility to disable 'Inherit Parent Space Perm'

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

robses

Is it possible to create a role similar to Coordinator but without the possibility
to adjust the setting "Inherit Parent Space Permissions" of a space.

We want our coordinators to manage the space users themself, but not allow them to enable the "Inherit Parent Space Permissions" setting. This will be a safety measure so Coordinators accidentily do not enable these setting which in our case will open up the Space for Everyone with the role of Consumer rights

Or is maybe another possibility ?

  Regards Rob Sessink

andy

Hi

At the moment, the authorisation layer allows you to set permissions or not.

It would be possible to have different requirements around the methods on the PermissionService API that would do what you want. In public-services-security-context.xml you would need to do over ride …

<bean id="PermissionService_security" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor">
        <property name="authenticationManager"><ref bean="authenticationManager"/></property>
        <property name="accessDecisionManager"><ref local="accessDecisionManager"/></property>
        <property name="afterInvocationManager"><ref local="afterInvocationManager"/></property>
        <property name="objectDefinitionSource">
            <value>
                org.alfresco.service.cmr.security.PermissionService.getOwnerAuthority=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.getAllAuthorities=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.getAllPermission=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.getPermissions=ACL_NODE.0.sys:base.ReadPermissions
                org.alfresco.service.cmr.security.PermissionService.getAllSetPermissions=ACL_NODE.0.sys:base.ReadPermissions
                org.alfresco.service.cmr.security.PermissionService.getSettablePermissions=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.hasPermission=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.deletePermissions=ACL_NODE.0.sys:base.ChangePermissions
                org.alfresco.service.cmr.security.PermissionService.deletePermission=ACL_NODE.0.sys:base.ChangePermissions
                org.alfresco.service.cmr.security.PermissionService.setPermission=ACL_NODE.0.sys:base.ChangePermissions
                org.alfresco.service.cmr.security.PermissionService.setInheritParentPermissions=ACL_METHOD.ROLE_ADMINISTRATOR
                org.alfresco.service.cmr.security.PermissionService.getInheritParentPermissions=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.clearPermission=ACL_NODE.0.sys:base.ChangePermissions
            </value>
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Then only admins can muck around with inheritance. Non admins will get an ugly  error on trying to set this via the UI as it would not protect this….

If this is not enough then you need to read about dynamic authorities and start creating more permissions around the PermissionService.

Cheers

Andy