Setting permissions for groups

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

anwar

I am trying to give permission to add users to the system to a group of users, not only the admin user(s).

My first naive attempt was the following:

In the NewUserWizard, I noticed the following line:
NodeRef newPerson = this.personService.createPerson(props);

I then created a new group (as admin) using the web-client, called "admingroup". I added a user "auser1" to this group (still through the web-client).

In the file public-services-security-context.xml I then changed the line concerning createPerson to:
org.alfresco.service.cmr.security.PersonService.createPerson=ACL_METHOD.GROUP_admingroup

My hope was then that the users belonging to the group, such as "auser1",  would be able to call the method PersonService.createPerson, but it does not seem to work: I get an AccessDeniedException when the createPerson-line is reached.

Why does this not work, and is there a simpler way of giving users this permission?

anwar

I have done some more experimenting with this, and I have found another result which puzzles me.

Look at the following:

Set<String> authorities1 = authorityService.getAllAuthorities(AuthorityType.USER);‍

This set contains "auser1".

Set authorities2 = authorityService.getContainedAuthorities(null, "GROUP_admingroup", false);‍

This set contains "auser1".

Set authorities3 = authorityService.getContainingAuthorities(null, "auser1", false);
Set authorities4 = authorityService.getContainingAuthorities(null, "USER_auser1", false);‍‍

These sets are both empty!

How can it be that auser1 is contained within the authority admingroup, but admingroup is not one of auser1's containing authorities? It doesn't seem possible. What have I misunderstood?