nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Simple Workflow Permissions and Roles

sassenach

New Alfresco user here having trouble with errors when assigning permissions on simple workflow and out-of-the-box permissions. Any help is appreciated.

I have 2 questions:

1) What permission role must a user have on the space they are sending content to via the simple workflow approve/reject action? I am assuming contributor since they are 'adding content'. Is a custom permission configuration the only way to limit authority in the destination space to simply moving content via the simple workflow?

2) I am getting the following error on the simple workflow when the user is coordinator of the space where the content is currently and contributor of the space where the approval workflow moves the content:

Failed to approve the document due to system error: Unknown Exception in Transaction.

Note this is not the error given when the user is restricted by persmission:

Failed to approve the document due to system error: Access Denied. You do not have the appropriate permissions to perform this operation.

As admin I can move the document completely through the workflow but when assigning permissions - even when making all the parties coordinators I can't make it work.

Here is the info in the tomcat box (I am NOT 'technically confident' so this is prolly more than needed):

Caused by: org.alfresco.repo.security.permissions.AccessDeniedException: Access

Denied. You do not have the appropriate permissions to perform this operation.

        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethod

Interceptor.invoke(ExceptionTranslatorMethodInterceptor.java:53)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.j

ava:238)

        at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInte

rceptor.java:69)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.springframework.transaction.interceptor.TransactionInterceptor.in

voke(TransactionInterceptor.java:107)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynami

cAopProxy.java:210)

        at $Proxy2.addAspect(Unknown Source)

        at org.alfresco.repo.action.executer.SimpleWorkflowActionExecuter.execut

eImpl(SimpleWorkflowActionExecuter.java:108)

        at org.alfresco.repo.action.executer.ActionExecuterAbstractBase.execute(

ActionExecuterAbstractBase.java:120)

        at org.alfresco.repo.action.ActionServiceImpl.directActionExecution(Acti

onServiceImpl.java:537)

        at org.alfresco.repo.action.executer.CompositeActionExecuter.executeImpl

(CompositeActionExecuter.java:72)

        at org.alfresco.repo.action.executer.ActionExecuterAbstractBase.execute(

ActionExecuterAbstractBase.java:120)

        at org.alfresco.repo.action.ActionServiceImpl.directActionExecution(Acti

onServiceImpl.java:537)

        at org.alfresco.repo.action.ActionServiceImpl.executeActionImpl(ActionSe

rviceImpl.java:472)

        at org.alfresco.repo.action.ActionServiceImpl.executeAction(ActionServic

eImpl.java:399)

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.

java:39)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces

sorImpl.java:25)

        at java.lang.reflect.Method.invoke(Method.java:597)

        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflecti

on(AopUtils.java:281)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJo

inpoint(ReflectiveMethodInvocation.java:187)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:154)

        at org.alfresco.repo.security.permissions.impl.AlwaysProceedMethodInterc

eptor.invoke(AlwaysProceedMethodInterceptor.java:40)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethod

Interceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.alfresco.repo.audit.AuditComponentImpl.auditImpl(AuditComponentIm

pl.java:256)

        at org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.j

ava:191)

        at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInte

rceptor.java:69)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.springframework.transaction.interceptor.TransactionInterceptor.in

voke(TransactionInterceptor.java:107)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynami

cAopProxy.java:210)

        at $Proxy19.executeAction(Unknown Source)

        at org.alfresco.repo.rule.RuleServiceImpl.executeRule(RuleServiceImpl.ja

va:918)

        at org.alfresco.repo.rule.RuleServiceImpl.executePendingRule(RuleService

Impl.java:886)

        at org.alfresco.repo.rule.RuleServiceImpl.executePendingRulesImpl(RuleSe

rviceImpl.java:857)

        at org.alfresco.repo.rule.RuleServiceImpl.executePendingRules(RuleServic

eImpl.java:830)

        at org.alfresco.repo.rule.RuleTransactionListener.beforeCommit(RuleTrans

actionListener.java:69)

        at org.alfresco.repo.transaction.AlfrescoTransactionSupport$TransactionS

ynchronizationImpl.beforeCommit(AlfrescoTransactionSupport.java:626)

        at org.springframework.transaction.support.TransactionSynchronizationUti

ls.triggerBeforeCommit(TransactionSynchronizationUtils.java:48)

        at org.springframework.transaction.support.AbstractPlatformTransactionMa

nager.triggerBeforeCommit(AbstractPlatformTransactionManager.java:821)

        at org.springframework.transaction.support.AbstractPlatformTransactionMa

nager.processCommit(AbstractPlatformTransactionManager.java:637)

        at org.springframework.transaction.support.AbstractPlatformTransactionMa

nager.commit(AbstractPlatformTransactionManager.java:624)

        at org.springframework.transaction.interceptor.TransactionAspectSupport.

commitTransactionAfterReturning(TransactionAspectSupport.java:307)

        at org.alfresco.util.transaction.SpringAwareUserTransaction.commit(Sprin

gAwareUserTransaction.java:420)

        … 32 more

Caused by: net.sf.acegisecurity.AccessDeniedException: Access is denied.

        at net.sf.acegisecurity.vote.AffirmativeBased.decide(AffirmativeBased.ja

va:86)

        at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvo

cation(AbstractSecurityInterceptor.java:394)

        at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInter

ceptor.invoke(MethodSecurityInterceptor.java:77)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethod

Interceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)

Find more posts tagged with

Comments

sassenach

One more bit of info. The workflow is trying to execute.

The destination space of the workflow has a rule on all inbound items to send an email notification. Although the content is NOT moved to the destination space due to the error an email is generated every time the attempt to approve the workflow is made.

More tomcat box info:

ReflectiveMethodInvocation.java:154)

        at org.alfresco.repo.security.permissions.impl.AlwaysProceedMethodInterc

eptor.invoke(AlwaysProceedMethodInterceptor.java:40)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethod

Interceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.alfresco.repo.audit.AuditComponentImpl.auditImpl(AuditComponentIm

pl.java:256)

        at org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.j

ava:191)

        at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInte

rceptor.java:69)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.springframework.transaction.interceptor.TransactionInterceptor.in

voke(TransactionInterceptor.java:107)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynami

cAopProxy.java:210)

        at $Proxy19.executeAction(Unknown Source)

        at org.alfresco.repo.rule.RuleServiceImpl.executeRule(RuleServiceImpl.ja

va:918)

        at org.alfresco.repo.rule.RuleServiceImpl.executePendingRule(RuleService

Impl.java:886)

        at org.alfresco.repo.rule.RuleServiceImpl.executePendingRulesImpl(RuleSe

rviceImpl.java:857)

        at org.alfresco.repo.rule.RuleServiceImpl.executePendingRules(RuleServic

eImpl.java:830)

        at org.alfresco.repo.rule.RuleTransactionListener.beforeCommit(RuleTrans

actionListener.java:69)

        at org.alfresco.repo.transaction.AlfrescoTransactionSupport$TransactionS

ynchronizationImpl.beforeCommit(AlfrescoTransactionSupport.java:626)

        at org.springframework.transaction.support.TransactionSynchronizationUti

ls.triggerBeforeCommit(TransactionSynchronizationUtils.java:48)

        at org.springframework.transaction.support.AbstractPlatformTransactionMa

nager.triggerBeforeCommit(AbstractPlatformTransactionManager.java:821)

        at org.springframework.transaction.support.AbstractPlatformTransactionMa

nager.processCommit(AbstractPlatformTransactionManager.java:637)

        at org.springframework.transaction.support.AbstractPlatformTransactionMa

nager.commit(AbstractPlatformTransactionManager.java:624)

        at org.springframework.transaction.interceptor.TransactionAspectSupport.

commitTransactionAfterReturning(TransactionAspectSupport.java:307)

        at org.alfresco.util.transaction.SpringAwareUserTransaction.commit(Sprin

gAwareUserTransaction.java:420)

        … 32 more

Caused by: net.sf.acegisecurity.AccessDeniedException: Access is denied.

        at net.sf.acegisecurity.vote.AffirmativeBased.decide(AffirmativeBased.ja

va:86)

        at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvo

cation(AbstractSecurityInterceptor.java:394)

        at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInter

ceptor.invoke(MethodSecurityInterceptor.java:77)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(

ReflectiveMethodInvocation.java:176)

        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethod

Interceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)

        … 78 more

sassenach

Just fyi, in case anyone else has the same problem. I have made a little progress - I found that if the user 'takes ownership' of the content that they are then able to 'approve' the simple workflow.

The ability to take ownership only comes with the Coordinator permission, however.

This may not be the best solution but it is the only solution I have found thus far.

jneeve

You can define a custom Permission group in permissionsDefinitions.xml and then modify the permissions in web-client-config-actions.xml for the action 'approve_doc' which is the approve action of the simple workflow rule.

See the last part of this post for more info: http://forums.alfresco.com/viewtopic.php?t=3466&highlight=

I'm just trying to figure out myself if this is the best way or if theres a simpler way to do this.

sassenach

Thank you!