ACLs on a content type and metadata basis

ranjeetsi

Hi all,

We can have ACLs on the basis of folders in Alfresco but we need to have ACLS(allow and deny content access) requirement.

For a user OR group - 

a) How can we restrict allow or deny access to a content type or folder type(defined in content model) for eg claim is a document type in content model, expense report is a content type. 

b) How we can allow or deny content access on the basis of metadata properties . For eg . If metadata says sensitive=true , then deny access to all and allow access to only admin. If sensitive value is made false then , the content can be accessible by a service user / group.

Note: We can set permissions on a content/folder type but the minimum pemissions is consumer and the content can be read/accessible.

Please suggest.

afaust

Alfresco does not support such kind of ACL management out-of-the-box with any of their high-level services. There aren't even any (simple) alternative approaches that I could readily recommend, due to being untested/unverified and having potentially significant side effects on other parts of the application. Technically, something like this "should" be possible if one were to hijack the low-level handling of ACL inheritance via behaviours / service extensions, but for reasons stated I won't go into any details about this idea of mine...

A rather simple / limited solution I implemented for a customer of mine once handled a somewhat similar requirement by adding a service extension for the permission service, which post-processed metadata check for the custom sensible state after the basic read permission was already checked, and another service extension to the search service which transparently rewrote FTS / CMIS queries to include filter queries for the relevant metadata, so that the query already selected only the accessible nodes and there was no need for any further post-processing.