How to prevent propagation/inheritance of permissions

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

juha

Hi,

I would need to automatically (or scheduled) prevent the ACLc being inherited from the parent folder to created subfolders. While I can form the UI prevent te ACLs inheritance, I need a solution where wither the ACLs would not be automatically propagated to the new subfolders or a way to schedule a task to prevent the ACL inheritance in subfolders under a specific folder/site.

The CMIS allows to read and modify the permissions, however, there seems to be no way to prevent the inheritance of ACLs from the parent folder?

Best,
Juha

loftux

This can easily be done using a javascript. Problem is that running this script using rules is that when rules fires on spaces, the space object is the space where the rule resides, not the actual space triggering the rule. So instead, do a simple javascript behaviour.
In tomcat/shared/classes/alfresco/extension create mybehaviour-context.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
   <bean id="onCreateChild_ChangeSpacePermission"
            class="org.alfresco.repo.policy.registration.AssociationPolicyRegistration" 
            parent="policyRegistration">   
           <property name="policyNames">
              <list>
                <value>{http://www.alfresco.org}onCreateChildAssociation</value>
              </list>
           </property>     
         <property name="className">
            <value>{http://www.alfresco.org/model/content/1.0}folder</value>
         </property>
         <property name="associationType">
               <value>{http://www.alfresco.org/model/content/1.0}contains</value>
           </property>  
         <property name="behaviour">
            <bean class="org.alfresco.repo.jscript.ScriptBehaviour" parent="scriptBehaviour">
               <property name="notificationFrequency">
                  <value>TRANSACTION_COMMIT</value>
               </property>
               <property name="location">
                  <bean class="org.alfresco.repo.jscript.ClasspathScriptLocation">
                     <constructor-arg>
                        <value>alfresco/extension/onCreateChild_SetSpacePermission.js</value>
                     </constructor-arg>
                  </bean>
               </property>
               <property name="serviceRegistry">
                     <ref bean="ServiceRegistry"/>
                 </property>
            </bean>
         </property>
      </bean>
</beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Create the file onCreateChild_SetSpacePermission.js in extension folder

var nodeRef = behaviour.args[0];
var isNew = behaviour.args[1];
if(isNew)
{     
    logger.log("LX IsNew");
    //If this is not a folder, then just bail out
    if(nodeRef.child.isContainer)
    {
       try {
          nodeRef.child.setInheritsPermission(false);
          //Set local permissions
          nodeRef.child.setPermission("Coordinator", "GROUP_ITGurus");
          nodeRef.child.setPermission("Consumer", "GROUP_Managers");
      } catch (e) {
         //Do nothing about the error, except logg
         if (logger.isWarnEnabled()) {
            logger.warn("FAILED Setting permission: " +e.description);   
         }
      }
        
    }
} ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Of course you can do more test in your javascript code to make sure the folder meets certain criteria, before doing anything. Read more http://wiki.alfresco.com/wiki/3.4_JavaScript_API.
Note that I haven't tested this code, so you may have to alter it a bit.