nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

How can space based permissions be given to users?

dynamolalit

Hi,

I have various user groups say group1 , group2 etc in which some of users are redundant(group2 is a subset of group1 means users in group2 will be in group1 already).

Also i have some spaces e.g. space1 & space2 etc.

I want group1 to have only limited rights on space1 say only download & view details.

Also i want group2 to have full permissions on space2 say edit/delete n all others.

How can i implement this?

Do any space based evaluators concept exist in Alfresco or something similar to achieve the desired functionality.

I have implemented permission based evaluators which shows all options only to Coordinator only.

Would appreciate for any help!

Find more posts tagged with

Comments

armedia

If you are using Alfresco Explorer, did u research on "Manage Space Users" action available in the space level.

Cheers
Balaji

savic_prvoslav

yes Manage Space Users is great feature you can add groups and users
, you can even send space users email and notify them about some changes, also you can add on this rules makes great thing if you use it right.

I belive that user specific right overrides grups right.

dynamolalit

Hi,

I tried implemented an evaluator & its working as expected.

To implement it, you need to update web-client-config-actions.xml file as below:

<!– Checkout document –>
         <action id="checkout_doc">
            <!–evaluator>org.alfresco.web.action.evaluator.CheckoutDocEvaluator</evaluator–>
      <evaluator>com.xxxx.alfresco.km.evaluator.KmSpaceEvaluator</evaluator>
            <label-id>checkout</label-id>
            <image>/images/icons/CheckOut_icon.gif</image>
            <action-listener>#{CCCheckoutFileDialog.setupContentAction}</action-listener>
            <action>dialog:checkoutFile</action>
            <params>
               <param name="id">#{actionContext.id}</param>
            </params>
        </action>

KmSpaceEvaluator.java

package com.xxxx.alfresco.km.evaluator;

import java.util.Iterator;

import javax.faces.context.FacesContext;

import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.repository.NodeService;
import org.alfresco.service.cmr.repository.Path;
import org.alfresco.service.cmr.repository.Path.Element;
import org.alfresco.service.cmr.security.PermissionService;
import org.alfresco.web.action.evaluator.BaseActionEvaluator;
import org.alfresco.web.app.servlet.FacesHelper;
import org.alfresco.web.bean.NavigationBean;
import org.alfresco.web.bean.repository.Node;
import org.alfresco.web.bean.repository.Repository;
import org.apache.log4j.Logger;



/**
 * @author Lalit Jangra 
 * Class to show all generic actions for spaces other than xxxx Knowledge Management.
 * For each space under xxxx Knowledge Management,it will show all the content options xxxxAdmin only.
 * For all other spaces, it will render content options as per role of logged in user. 
 */
public class KmSpaceEvaluator extends BaseActionEvaluator {

&nbsp;&nbsp;&nbsp;private static final long serialVersionUID = 1L;
&nbsp;&nbsp;&nbsp;private static Logger logger = Logger.getLogger(KmSpaceEvaluator.class);
&nbsp;&nbsp;&nbsp;//private String currentUserName = null;
&nbsp;&nbsp;&nbsp;private NodeService nodeService;
&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;/**
&nbsp;&nbsp;&nbsp; * Method to show all options to xxxxAdmin only.
&nbsp;&nbsp;&nbsp; * It will check for path of content & role of current user.
&nbsp;&nbsp;&nbsp; * If it contains xxxx_x0020_Knowledge_x0020_Management, it will render all content options
&nbsp;&nbsp;&nbsp; * for user with CONTENT_COORDINATOR role only.
&nbsp;&nbsp;&nbsp; * For all other spaces, it will render options depending if current user is CONSUMER or EDITOR
&nbsp;&nbsp;&nbsp; * CONTRIBUTOR or OWNER_AUTHORITY.
&nbsp;&nbsp;&nbsp; */
&nbsp;&nbsp;&nbsp;public boolean evaluate(Node node) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;boolean result = false;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;boolean kMFlag = false;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;FacesContext context = FacesContext.getCurrentInstance();
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//currentUserName = getCurrentUserName(context);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NavigationBean navigationBean = (NavigationBean)FacesHelper.getManagedBean(context, NavigationBean.BEAN_NAME);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NodeRef currNodeRef = navigationBean.getCurrentNode().getNodeRef();
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;String currSpace =&nbsp; navigationBean.getCurrentNode().getName();
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//logger.debug("currNodeRef is : "+currNodeRef);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;logger.debug("Current space is : "+currSpace);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nodeService = Repository.getServiceRegistry(context).getNodeService();
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Path nodePath = nodeService.getPath(currNodeRef);//Path is like /x/y/z
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Iterator<Element> pathItr = nodePath.iterator();//Iterating over path.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;while (pathItr.hasNext()) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Element pathElement = (Element) pathItr.next();//Getting a single path element say x or y or z.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;String pathStr = pathElement.getElementString();//Getting path as a String from element.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// logger.debug("pathStr : " + pathStr);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (pathStr.indexOf("xxxx_x0020_Knowledge_x0020_Management") > 0) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;kMFlag = true;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// logger.debug("Space is inside xxxx Knowledge Management so setting flag to true");
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;logger.debug("kMFlag in KmSpaceEvaluator : " + kMFlag);&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//Now kMFlag is known, it is checking for role of current logged in user.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(kMFlag == true && node.hasPermission(PermissionService.COORDINATOR) == true){ // For Coordinator on xxxx Knowledge Management Space.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;logger.debug(" For Coordinator on JKM ");
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;result = true;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}else if(kMFlag == true && (node.hasPermission(PermissionService.CONTRIBUTOR) || node.hasPermission(PermissionService.EDITOR)&nbsp; ||
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;node.hasPermission(PermissionService.CONSUMER)&nbsp; || node.hasPermission(PermissionService.OWNER_AUTHORITY)) == true ){
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// For all other roles on xxxx Knowledge Management Space.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;logger.debug(" For All other users on JKM ");
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;result = false;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}else if(kMFlag == false && node.hasPermission(PermissionService.COORDINATOR) == true ){// For Coordinator on non xxxx Knowledge Management Spaces.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;logger.debug(" For Coordinator on all other spaces ");
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;result = true;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}else if(kMFlag == false && (node.hasPermission(PermissionService.CONTRIBUTOR) || node.hasPermission(PermissionService.EDITOR)&nbsp; ||
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;node.hasPermission(PermissionService.CONSUMER)&nbsp; || node.hasPermission(PermissionService.OWNER_AUTHORITY)) == true ){
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// For all other roles on non xxxx Knowledge Management Spaces.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;logger.debug(" For all other users on all other spaces ");
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;result = true;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;logger.debug("result in KmSpaceEvaluator() : " + result);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return result;
&nbsp;&nbsp;&nbsp;}
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Now only admin can see all the content options on all the spaces.All other users will see only a set of options on few spaces & on rest of spaces, they will see options as per their roles.

savic_prvoslav

Hardcoding spaces is I thing not a good way to start your day.

May be that putting aspect is better way to go and then you use node service ask if hasAspect and continue …