nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

[HOWTO] Custom Permissions in ALF Community 5.0.d

deajan

[EDIT]
I've managed to get stuff working for me !
Please see https://forums.alfresco.com/comment/156540#comment-156540 for a howto on custom Permissions
[/EDIT]

Hello,

I am trying to add a custom role to Alfresco based on Consumer role, with some modifications (basically i want a role that can comment but can't start a workflow).

I've followed the tutorial here: https://wiki.alfresco.com/wiki/Custom_Permissions_in_Share
I've double checked everything, but it seems that my modified file in <alfresco_root>/tomcat/shared/classes/alfresco/extension/sitePermissionDefinitions.xml never gets loaded.

My file contents:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE permissions >

<permissions>

    <!– Namespaces used in type references –>

   <namespaces>
      <namespace uri="http://www.alfresco.org/model/system/1.0" prefix="sys"/>
      <namespace uri="http://www.alfresco.org/model/content/1.0" prefix="cm"/>
      <namespace uri="http://www.alfresco.org/model/site/1.0" prefix="st"/>
   </namespaces>

   <!– ============================================ –>
   <!– Permissions specific to the wiki integration –>
   <!– ============================================ –>

   <permissionSet type="st:site" expose="selected">

      <permissionGroup name="SiteManager" allowFullControl="true" expose="true" />

      <permissionGroup name="SiteCollaborator" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Collaborator" type="cm:cmobject" />
      </permissionGroup>

      <permissionGroup name="SiteContributor" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
      </permissionGroup>

      <permissionGroup name="SiteConsumer" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
      </permissionGroup>

      <permissionGroup name="SiteCommentator" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
      </permissionGroup>

   </permissionSet>

</permissions>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Maybe my sitePermissionDefinitions.xml should go in another path ?

Any advices please ?

Regards,
Ozy.

Find more posts tagged with

Comments

kavilash23

Hello,

Did you make a context file to register your custom permission model?

deajan

Hello,
Well i must admit i didn't find anything about a context file in the documentation i've read.
Thanks for the tip. I've finally moved my sitePermissionsDefinition.xml to <alf_root>/tomcat/shared/classes/alfresco/extension/model and created a context file for my model as follows in <alf_root>/tomcat/shared/classes/alfresco/extension/custom-sitepermissions-context.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>
    <bean id="myModule_permissionBootstrap" parent="permissionModelBootstrap">
      <property name="model" value="alfresco/extension/model/sitePermissionDefinitions.xml"/>
    </bean>
</beans>
‍‍‍‍‍‍‍‍‍‍

Now i have a new problem, my custom model loads, but i get the following error (where SiteCommentator is the role i added):
<blockquote>
03230000 Wrapped Exception (with status template): 03230018 An authority was not found for GROUP_site_exploitation_SiteCommentator
</blockquote>

Is there any better documentation than the one i stated in my first post to achieve custom permissions ?

Regards,
Ozy.

deajan

Found out that the error only appears on already existing sites. New ones created after the role exists work great with the new role.
Any idea how to post create the missing authority for an existing site ?

Regards,
Ozy.

mauricio_neto

Hi friends,

I'm new with Alfresco, so I can't found the sitePermissionDefinitions.xml. I'm using Community 5.0.d.

Does anyone can help me, please?

Thks
Mauricio

deajan

Hello Mauricio,

You have to unzip <alfresco_root>/tomcat/webapps/alfresco/WEB-INF/lib/alfresco-repository-5.0.d.jar and find the file there.
Regards,
Ozy.

mauricio_neto

Thanks Ozy.

Regarding the problem over existing sites did you tried this fix? (https://issues.alfresco.com/jira/browse/MNT-2456)

Also how did your custom role can comment but can't start a wf? To my case I need to allow comment and not allow donwload.

Thanks
Regards

deajan

Hello Mauricio,
I actually read about the fix provided on jira, but the url description was false so i had fun time to make it work ( & instead of ? in the url, but when you're tired you don't pay attention to this level of detail). I've corrected the desc.xml file and made a quick and dirty howto for the fix, but it seems i can't add anything to MNT-2456, a shame ! Anyway, got the fix to work for me.

I have finished my customPermission models, i'll write the whole thing down very soon.

Regards,
Ozy.

deajan

Now that i've taken some time to investigate how to achieve custom permissions, i'll write down my findings.

My goal is to setup two custom permissions, one called "WriteOnly" which allows a user to write new content without being able to see other files, and a site role called "Commentator" that basically has the same rights than a Contributor, except that he can't accept or approve simple workflows.

So here's my full setup:

Extract (using unzip) the file <zip_path>/alfresco/model/permissionDefinitions.xml from <alfresco_path>/tomcat/webapps/alfresco/WEB-INF/lib/alfresco-repository-5.0.d.jar
Copy it to <alfresco_path>/tomcat/shared/classes/alfresco/extensions/model/permissionDefinitions.xml (if model directory doesn't exist, create it).

We'll add some dummy low level permission "WorkFlowPermissions" to the file which should then look like

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Groups for low level permissions –>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="ReadProperties" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="ReadChildren" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="WriteProperties" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="ReadContent" expose="false" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="WriteContent" expose="false" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="ExecuteContent" expose="false" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="DeleteNode" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="DeleteChildren" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="CreateChildren" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="LinkChildren" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="DeleteAssociations" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="ReadAssociations" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="CreateAssociations" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="ReadPermissions" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="ChangePermissions" expose="true" allowFullControl="false" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Permission to start a Workflow –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="WorkFlowPermissions" expose="true" allowFullControl="false" />
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

We'll also add this permission to the following bloc:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– ==================================================== –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Permissions related to the management of permissions –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– ==================================================== –>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– The permission to read the permissions on a node&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permission name="_ReadPermissions" expose="false" >
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <grantedToGroup permissionGroup="ReadPermissions" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Commented out parent permission check …
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <requiredPermission on="parent" name="_ReadChildren" implies="false"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permission>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– The permission to the change the permissions associated with a node&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permission name="_ChangePermissions" expose="false" >
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <grantedToGroup permissionGroup="ChangePermissions" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Commented out parent permission check …
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <requiredPermission on="parent" name="_ReadChildren" implies="false"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permission>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– ======================================= –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Permission to start a WorkFlow –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– ======================================= –>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permission name="_WorkFlowPermissions" expose="false" >
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <grantedToGroup permissionGroup="WorkFlowPermissions" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permission>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Now we have to add this dummy permission to every role we want to allow to approve / reject workflows.
Note that i also added two new roles, which are "Commentator" and "WriteOnly".
Role "Commentator" has basically the same rights as "Contributor", except for the WorkFlowPermissions we created.
Role "WriteOnly" has only write permissions based on low level perms.

&nbsp;&nbsp; <!– ================================================ –>
&nbsp;&nbsp; <!– Permissions available to all content and folders –>
&nbsp;&nbsp; <!– ================================================ –>

&nbsp;&nbsp; <permissionSet type="cm:cmobject" expose="selected">

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Kept for backward compatibility - the administrator permission has&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– been removed to avoid confusion –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Administrator" allowFullControl="true" expose="false">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Add WorkFlow permission because it's needed to allow action id –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="WorkFlowPermissions" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– A coordinator can do anything to the object or its children unless the&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– permissions are set not to inherit or permission is denied.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Coordinator" allowFullControl="true" expose="true">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Add WorkFlow permission because it's needed to allow action id –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="WorkFlowPermissions" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– A collaborator can do anything that an editor and a contributor can do –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Collaborator" allowFullControl="false" expose="true">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Editor" type="cm:cmobject" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Add WorkFlow permission because it's needed to allow action id –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="WorkFlowPermissions" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– A contributor can create content and then they have full permission on what –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– they have created - via the permissions assigned to the owner.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Contributor" allowFullControl="false" expose="true" >
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Contributor is a consumer who can add content, and then can modify via the –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– owner permissions.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Add WorkFlow permission because it's needed to allow action id –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="WorkFlowPermissions" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– An editor can read and write to the object; they can not create&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– new nodes. They can check out content into a space to which they have&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– create permission.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Editor"&nbsp; expose="true" allowFullControl="false" >
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="cm:cmobject" permissionGroup="Consumer"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="Write"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="cm:lockable" permissionGroup="CheckOut"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="ReadPermissions"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– The Consumer permission allows read to everything by default.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Consumer" allowFullControl="false" expose="true" >
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Read" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Commentator permission is same as Contributor except i didn't add workflow permissions&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Commentator" allowFullControl="false" expose="true" >
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Document Library permission for uploads only –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="WriteOnly" allowFullControl="false" expose="true" >
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Write" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="AddChildren" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– records permission –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Should be tied to the aspect –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– ownership should be removed when using this permission –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="RecordAdministrator" allowFullControl="false" expose="false">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="ReadProperties"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="ReadChildren"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="WriteProperties"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="ReadContent"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="DeleteChildren"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="CreateChildren"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="LinkChildren"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="DeleteAssociations"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup type="sys:base" permissionGroup="CreateAssociations"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Add WorkFlow permission because it's needed to allow action id –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="WorkFlowPermissions" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp; </permissionSet>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Finally, we need to expose these roles to the GUI so they can be used.

&nbsp;&nbsp; <!– =============================== –>
&nbsp;&nbsp; <!– Permissions specific to content –>
&nbsp;&nbsp; <!– =============================== –>

&nbsp;&nbsp; <permissionSet type="cm:content" expose="selected">

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Content specific roles.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Coordinator" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Collaborator" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Contributor" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Editor" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Consumer" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="RecordAdministrator" extends="true" expose="false"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Expose Commentator Permission on content –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Commentator" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Expose WriteOnly Permission on content –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="WriteOnly" extends="true" expose="true"/>
&nbsp;&nbsp; </permissionSet>


&nbsp;&nbsp;&nbsp; <permissionSet type="cm:folder" expose="selected">

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Content folder specific roles.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Coordinator" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Collaborator" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Contributor" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Editor" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Consumer" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="RecordAdministrator" extends="true" expose="false"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Expose Commentator Permission on folders –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="Commentator" extends="true" expose="true"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Expose WriteOnly Permission on folders –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="WriteOnly" extends="true" expose="true"/>
&nbsp;&nbsp; </permissionSet>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Now that we've setup new permissions, we need to allow them to be exposed to the site UI.
In the extracted zip file, you'll find file <zip_path>/alfresco/models/sitePermissionDefinitions.xml which you must copy to <alfresco_path>/tomcat/shared/classes/alfresco/extensions/model

Modify it and add the two new created roles like:

&nbsp;&nbsp; <!– ============================================ –>
&nbsp;&nbsp; <!– Permissions specific to the wiki integration –>
&nbsp;&nbsp; <!– ============================================ –>

&nbsp;&nbsp; <permissionSet type="st:site" expose="selected">

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="SiteManager" allowFullControl="true" expose="true" />

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="SiteCollaborator" allowFullControl="false" expose="true">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Collaborator" type="cm:cmobject" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="SiteContributor" allowFullControl="false" expose="true">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="SiteConsumer" allowFullControl="false" expose="true">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Expose SiteCommentator –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="SiteCommentator" allowFullControl="false" expose="true">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Commentator" type="cm:cmobject" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– MOD OZY: Expose SiteWriteOnly –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissionGroup name="SiteWriteOnly" allowFullControl="false" expose="true">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="Write" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <includePermissionGroup permissionGroup="AddChildren" type="sys:base" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissionGroup>

&nbsp;&nbsp; </permissionSet>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

We'll need to create a ressource file called <alfresco_path>/tomcat/shared/classes/alfresco/web-extension/messages/invitation-service.properties containing the following:

invitation.invitesender.email.role.SiteWriteOnly=Write Only
invitation.invitesender.email.role.SiteCommentator=Commentator
‍‍‍‍

The ressource file will be loaded by the following bootstrap file <alfresco_path>/tomcat/shared/classes/alfresco/web-extension/invitation-service-context.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <bean id="invitationResourceBundles" class="org.alfresco.i18n.ResourceBundleBootstrapComponent">
&nbsp;&nbsp;&nbsp;&nbsp; <property name="resourceBundles">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <list>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <value>alfresco.web-extension.messages.invitation-service</value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </list>
&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp; </bean>
 
</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Another ressource file <alfresco_path>/tomcat/shared/classes/alfresco/web-extension/messages/slingshot.properties needs to be created containing

## Custom roles
role.SiteWriteOnly=Write Only
role.SiteCommentator=Commentator
‍‍‍‍‍

Finally, copy the file <alfresco_path>/tomcat/shared/classes/alfresco/web-extension/custom-slingshot-application-context.xml.sample to custom-slingshot-application-context.xml and edit by adding the following bean definition

&nbsp;&nbsp; <bean id="webscripts.resources" class="org.springframework.extensions.surf.util.ResourceBundleBootstrapComponent">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="resourceBundles">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <list>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <value>alfresco.messages.common</value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <value>alfresco.messages.slingshot</value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <value>alfresco.web-extension.messages.slingshot</value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </list>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp; </bean>
‍‍‍‍‍‍‍‍‍‍‍

Both files permissionDefinitions.xml and sitePermissionDefinitions.xml have to be loaded by a bootstrap file <alfresco_path>/tomcat/shared/classes/alfresco/extensions/custom-permissions-context.xml containing

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>
&nbsp;&nbsp;&nbsp; <bean id="CustomPerm_permissionBootstrap" parent="permissionModelBootstrap">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="model" value="alfresco/extension/model/permissionDefinitions.xml"/>
&nbsp;&nbsp;&nbsp; </bean>
&nbsp;&nbsp;&nbsp; <bean id="CustomSitePerm_permissionBootstrap" parent="permissionModelBootstrap">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="model" value="alfresco/extension/model/sitePermissionDefinitions.xml"/>
&nbsp;&nbsp;&nbsp; </bean>
</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍

From here, the role WriteOnly exists and works.
Now we need to restrict "approve" and "reject" to roles that have the WorkFlowPermissions permission.

Open file <alfresco_path>/tomcat/shared/classes/alfresco/web-extension/share-config-custom.xml to edit the config bloc that should look like

<!– Custom DocLibActions config section –>
&nbsp;&nbsp; <config evaluator="string-compare" condition="DocLibActions">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <actionGroups>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <actionGroup id="document-browse">

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Simple Repo Actions –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!–
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="340" id="document-extract-metadata" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="350" id="document-increment-counter" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Dialog Repo Actions –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!–
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="360" id="document-transform" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="370" id="document-transform-image" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="380" id="document-execute-script" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="160" id="document-approve">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissions>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permission allow="true">WorkFlowPermissions</permission>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissions>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </action>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="170" id="document-reject">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permissions>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <permission allow="true">WorkFlowPermissions</permission>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </permissions>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </action>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </actionGroup>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </actionGroups>
&nbsp;&nbsp; </config>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

This will not prevent the menu from showing up, but will restrict it's usage.
Here's a quick list of action indexes you can add permissions to:

<actionGroup id="document-details">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="100" id="document-download" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="110" id="document-view-content" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="120" id="document-edit-metadata" /
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="130" id="document-upload-new-version" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="140" id="document-view-original" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="150" id="document-view-working-copy" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="160" id="document-approve" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="170" id="document-reject" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="180" id="document-inline-edit" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="190" id="document-edit-online" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="200" id="document-edit-offline" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="210" id="document-view-googledoc" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="220" id="document-checkout-to-googledocs" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="230" id="document-checkin-from-googledocs" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="240" id="document-copy-to" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="250" id="document-move-to" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="260" id="document-delete" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="270" id="document-assign-workflow" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="280" id="document-cancel-editing" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="290" id="document-manage-site-permissions" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="300" id="document-manage-repo-permissions" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="310" id="document-manage-aspects" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="320" id="document-change-type" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="330" id="document-view-in-source-repository" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="340" id="document-publish" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <action index="350" id="document-view-googlemaps" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </actionGroup>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Note: if someone has found a better way to also hide the menu, please be my guest and comment

Fix for already existing sites:
Download the file https://issues.alfresco.com/jira/secure/attachment/54733/fixsiteauthorities.zip and extract it to <alfresco_path>/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/fixsiteauthorities (create the path [..]/templates/webscripts/fixsiteauthorities)

Restart Alfresco and go to the following URI
http://your_alfresco_url

ort/alfresco/s/index/package/fixsiteauthorities

You can then fix a site like "testsite" to add both groups we created earlier by going to the following URIs

http://your_alfresco_url

ort/alfresco/s/fixsiteauthorities?customgroup=SiteWriteOnly&sitename=testsite&fix=true
http://your_alfresco_url

ort/alfresco/s/fixsiteauthorities?customgroup=SiteCommentator&sitename=testsite&fix=true

Note: I guess this howto could be improved for multilanguage support too, please feel free to help it become better.
Regards,
Ozy.

imaneesse

Hi deajan

Thanks for this [HOWTO], it's very helpful but i have a little problem, that when i add workflowPermissions on "share-config-custom.xml" , no one can have tha right to approve something even the Administrator.

plzz can u help me if u have an idea how to fix it

thanks for advance

sandeepreddy

Hi deajan,
Thank you for [HOWTO], Craete Custom role with No download Permission., please help me deajan.

huyenvtus

Hi, I am a newbie, so maybe step by step I do it wrong. Now my alfresco is fail, can't login. If you have video step by step is very good

huyenvtus

I do it again in 5.0.c but lost log in screen

agg

Hi ImaneEsse!

I had the same problem! If you follow all the given instructions no one will have permissions.

I'm affraid that deajan missed one configuration in his helpful instructions:

You must put the file 'script-services-context.xml' in tomcat/shared/classes/alfresco/extension/script-services-context.xml

(In Alfresco 5.0.c this file must be inside a .jar… but you can find its content in https://github.com/Alfresco/community-edition/blob/master/projects/repository/config/alfresco/script-services-context.xml)

Once the file is placed in the mentioned directory you must edit it and find the tag:

<property name="userPermissions">‍

and put the new permission value (WorkFlowPermissions)


<bean id="baseJsonConversionComponent" abstract="true">
        <property name="nodeService" ref="NodeService"/>
        <property name="publicServiceAccessService" ref="PublicServiceAccessService" />
        <property name="namespaceService" ref="NamespaceService" />
        <property name="fileFolderService" ref="FileFolderService" />
        <property name="lockService" ref="LockService" />
        <property name="permissionService" ref="PermissionService" />   
        <property name="contentService" ref="ContentService" />
        <property name="userPermissions">
            <list>
                <value>Unlock</value>
                <value>CancelCheckOut</value>
                <value>ChangePermissions</value>
                <value>CreateChildren</value>
                <value>Delete</value>
                <value>Write</value>
           <value>WorkFlowPermissions</value>
            </list>
        </property> 
    </bean>


‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

After doing that and the other instrucctions given by deajan… you will see that it works!

townsend

I guess the problem in selinux, but I don't know how to set selinux to solve it. So, I just disable the selinux, and alfresco is running now. My environment: centos7x64 + alfresco communicate 201604

saif

hello,

I'm following your configuration but not for workflowPermission, is for create a new permission CanDownload but the role commentator is created with succes but the permission CanDownload is not visible in liste of action role administrator,

Can you help me for result this probleme,

thanks in advanced