nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Creating Custom Roles and Permission for certain Scenario

piyush48

Hi All,

I want to make Custom Roles and Permissions for the Following Scenario:-

Users should be able to Search, View metadata, content but not Comment.

Users should be able to Search, View metadata only but not Content.

Since i am using SDK 3.0 and new to topic please do provide me with the path of permissions definition.xml file where i should be able to make changes and what changes i should do to completely work my aboveSceenario.

Thanks and Regards,

Piyush Patel.

Find more posts tagged with

Alfresco Content Services

Comments

EddieMay

Hi @piyush48,

Permissions and roles documentation is here. There is also a reminder of good practice for adding custom permissions and roles from @jpotts here.

That said, there is an important caveat about the limitations inherent in Share outlined by @afaust here. The requirement this user had looks similar to what you are trying to achieve.

HTH,

piyush48

Hi @EddieMay ,

Thanks for providing me correct approach but how can i disable comment which i described in first scenario.

My custom Permission file is like this:--

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE permissions >
<permissions>
    <namespaces>
        <namespace uri="http://www.alfresco.org/model/system/1.0" prefix="sys"/>
        <namespace uri="http://www.alfresco.org/model/content/1.0" prefix="cm"/>
        <namespace uri="http://www.alfresco.org/model/content/1.0" prefix="acme"/>
    </namespaces>

    <permissionSet type="sys:base" expose="selected">
        <permissionGroup name="DisableComments" requiresType="false" expose="true">
            <includePermissionGroup permissionGroup="DeleteChildren" type="sys:base" />
        </permissionGroup>

        <permission name="_DisableComments" expose="false" >
            <grantedToGroup permissionGroup="DisableComments" />
        </permission>
    </permissionSet>

    <permissionSet type="sys:base" expose="selected">
        <permissionGroup name="newcustomer" allowFullControl="false" expose="true" extends="true" >
            <includePermissionGroup type="sys:base" permissionGroup="Read"/>
            <includePermissionGroup type="sys:base" permissionGroup="ReadProperties"/>
            <includePermissionGroup type="sys:base" permissionGroup="ReadContent"/>
            <includePermissionGroup type="sys:base" permissionGroup="DisableComments"/>
        </permissionGroup>
    </permissionSet>
</permissions>

and my bean file that is context file is like:-

<?xml version='1.0' encoding='UTF-8'?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">

    <!-- The bootstrap-context.xml file is used for patch definitions, importers, 
		 workflow, and loading custom content models.  -->

    <!-- Registration of new models -->
    <bean id="custom_permissionDefinition" parent="permissionModelBootstrap">
        <property name="model"
                value="alfresco/module/${project.artifactId}/model/customPermissionDefinitions.xml"/>        
        
    </bean>
</beans>

After Executing all and running my SDK 3.0:--

2020-04-21 20:31:30,385 ERROR [org.springframework.web.context.ContextLoader] [localhost-startStop-1] Context initialization failed
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'custom_permissionDefinition' defined in class path resource [alfresco/module/customrole-platform-jar/context/custom-context.xml]: Invocation of init method failed; nested exception is org.alfresco.repo.security.permissions.impl.model.PermissionModelException: 03210000 There is no parent for permission group :{http://www.alfresco.org/model/system/1.0}base newcustomer

and other error is like:-

2020-04-22 11:57:27,736 ERROR [org.springframework.web.context.ContextLoader] [localhost-startStop-1] Context initialization failed
java.lang.StackOverflowError

Thanks and Regards,

Piyush

piyush48

Please could any one help me out as for disabling comment through permission for new group of users.

I have posted my permission definition file above, as per my understanding.

Thanks,

Piyush

afaust

You will not be able to (properly / 100%) disable commenting by using custom permissions. From an API and ACL / permission check perspective, there is nothing inherently different between adding a comment and adding a new file. The underlying operation only checks for the "AddChildren" / "CreateChildren" default permissions. Even if you were to implement a custom permission for "CreateComment", the underlying operation would not be granular enough to differentiate between different "CreateXY" use cases.

Furthermore, a permission called "DisableComments" does not make sense from a semantical point of view. Permissions are always allowances to perform something, so a permission should never be named in the negative. There should be a permission "CreateComment" which all users may have by default, but could be explicitly denied to others, to "disable" that functionality. Unfortunately, Alfresco Share (and I believe ADF / ACA / ADW as well) does not support negative permissions (which Alfresco core does support), so you could not really assign / revoke the permission in any meaningful way.

You could certainly hack something together which works using the negatively framed permission "DisableComments" and some behaviours, but it would not be a very "clean" solution. And you'd still need to customise the UI to actually disable / remove the default commenting controls in some way, since these will not check your negative permission, only the "CreateChildren" / "AddChildren" ones.

With regards to your custom permission model: You are defining a custom permission model for default Alfresco namespaces. Alfresco itself already provides a permission model for those, and I assume your configuration runs into conflict with this, causing weird side effects (the StackOverflowError), since I doubt Alfresco has put in place any special guards to avoid developers overriding their core permissions, which they clearly did not expect anyone to do that way. Typically, custom permission models can only be defined for custom content models / namespaces, and thus custom types and aspects.