Defining a new Role to just add content

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

jlabuelo

Hi all

I am designing a new Role for my Alfresco installation, so all users that belong to a group with this Role will be able to
Read - Update- Write -Add - Lock -UnLock… all possible actions for a conent (document), but I dont want this role to be able to create rules for the space, or manage users, or to create new child spaces.

I have tried to do this in a new role in the permissionDefinitions.xml file as I have seen in other posts, pretty much I have got the Editor Role and addted the Write - Read - Delete and AddChildren Roles.

With this I get the users to be able to add content, and all the other actions I want, but the users are also able to create child spaces, which I dont want.

I think the problem is in the AddChildren role, if I remove it, the users are not able to create new child spaces, but they are not also able to add new conent…

Does anybody know what is the right solution for this one?

Cheers mates

jbarmash

Can you try to set targets to your permissions.  As you can see in permissionDefinitions.xml, most of permissions relate to a type.   You should try to constrain your AddChildren permissions to a type, say cm:folder.  If it works the way I think it does, that should have the effect you desire.

Something along the lines of:

<permissionGroup name="AddChildrenFolder" expose="true" allowFullControl="false">
           <includePermissionGroup type="cm:folder" permissionGroup="CreateChildren"/>
           <includePermissionGroup type="sys:base" permissionGroup="LinkChildren"/>
      </permissionGroup>
‍‍‍‍‍

Let us know if this works out for you.

If this does not work, you may have to go one level lower - to file public-services-security-context.xml, and start changing even lower level permissions on the NodeService.