nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Permissions - Controlled based on content aspects

limarin

Hi,

I need to control permissions based on content property values.

For example, if 'State' were a property value (my new aspect), I may want to limit access to folder and content that contains only for a given user or group of users.

How can I do it?

I add two new aspects: state folder (opened/closed) and finish date and I have created a scheduled job to update the state folder.
How do I modify in this process the permissos?

Thanks for your help

Find more posts tagged with

Comments

andy

Hi

You can use a dynamic authority.
See the examples for ower and lock owner.

For any object you can determine if a given user should have a dynamic authority. So you can access the current user information and the accessed node ref and decide, for example, that the AUTH_STATE should be granted to the user, for the given node, if the node state is set to some value. The user has then has that authority and will have the permissions associated with that authority. The permissions would be set globally or set or inherited in the node against AUTH_STATE.

The UI does not support setting permission for dynamic authorities.
So far only global permissions have been required.

Regards

Andy

limarin

Can you say to me where I locate the examples?

Thank you very much

limarin

Hi,

Now I am using the method clearPermission:

public void execUpdateWork() 
{ 
    TransactionWork<Object> updWork = new TransactionWork<Object>() 
    { 
        public Object doWork() throws Exception 
        { 
               ….. search folders 
       
      authenticationComponent.setCurrentUser(authenticationComponent.getSystemUserName()); 
      QName qStFolder = QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, "stateFolder"); 
      for(ResultSetRow row : results) 
      { 
         currentNodeRef = row.getNodeRef(); 
         if (currentDate.compareTo(closeDate)>-1) { 
         this.nodeService.setProperty(nodeRef, qStFolder, "CLOSED"); 
         
         this.permissionService.clearPermission(nodeRef,"GROUP_MyGroup");
         
      } 
       
      ….. results.close(); 
       
                return null; 
        } 
    }; 
    TransactionUtil.executeInUserTransaction(this.transactionService, updWork); 
}‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The users of the group do not have permissions on the folders and now they are not visualized in the browse page…

but the creator user (owner) of the folder (who also belongs to the group GROUP_MyGroup) continues having the permissions and continues seeing the folder.

Is it possible that cannot clean the permissions of access to the folder of the owner user?

I view http://forums.alfresco.com/viewtopic.php?t=3498

Exist a dynamic authority for owner.

I need to assign only the global permissions. I do not want that the user who creates a folder (owner) has all the permissions on the folder.

When the user creates the folder, is possible to disable this dynamic authority?

Thanks.

andy

Hi

You need to set the owner to have the required global permission in the config - or, for no ower permission remove the entry for no permissions in the config or do not register the dyamic owner authority.

Regards

Andy

limarin

ops: sorry, i don't understand it completely.

You can show me a practical example?

Thanks.

dschmalz

You can show me a practical example?

The 'owner' of a document is a global permission which is set in the permissionDefinitions.xml configuration file. By default, the owner of an object (content or space) has full control over it. This means that if you also want to remove the rights of the owner, this global permission has to be removed.

Look at the permissionDefinitions.xml file and comment out at the very bottom the OWNER_AUTHORITY tag. Then restart Alfresco.
The file is located in tomcat\webapps\alfresco\WEB-INF\classes\alfresco\model .

<!– For now, owners can always see, find and manipulate their stuff               –>
   <globalPermission permission="FullControl" authority="ROLE_OWNER"/>‍‍

Then, the owner of the space should not have access anymore.

David