nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

How to restrict access to user list from outside the site ?

upforsin

Hello,

We would prefer if users from site A would not be able to see users from site B.

How can I restrict access to the users list? Now they can go to People tab and see all users and even their emails.

Both A and B sites are private.

What's even worse, they can see the user's content which is uploaded on the Site on which they are not the members. (It's about the content with permission set to GROUP_EVERYONE, but I'd prefer the "Everyone" mean "Everyone on this site")

Find more posts tagged with

Alfresco Content Services

Comments

angelborroy

You can try this addon:

https://github.com/douglascrp/alfresco-colleagues-picker-form-control

Not sure if that works with 6.1

upforsin

Well.. with Solr i can also find users/content so I think it must be something with the permissions.

roberto_gamiz

Hello,

I asume that you are granting permission on a specifict content to group_everyone manually beacause in a private site this group has no permission asigned by default.

For each site there is a serie of groups that contain all the user and groups invited to the site. This groups are called site_<short name of the site>_SiteCollaborator, site_<short name of the site>_SiteConsumer, site_<short name of the site>_SiteContributor y site_<short name of the site>_SiteManager
Grant a specifc permission to a content to all of this specials groups is equivalent to grant it to "Everyone on this site".

Exist one more group for each site called site_<short name of the site> that include the other four but this group is not available in the permission managment action althought you can use it for example in an script.

With respect to the people tab, this screen is outside the scope of any site so it is design to search people in all Alfresco. If you want to restrict it result to the sites in with the user logged is included you have to implement a customization, making a custom service and calling it from a customized version of the page.

Regards

afaust

Users / person objects in Alfresco are nodes just like any content / folder. They can have permissions applied, to restrict who can view that person's details. In a few (1-2) projects I have actually implemented a behaviour which disabled permission inheritance on person nodes and set specific permissions, as well as used that behaviour to automatically add / remove permissions when a user / group was added to / removed from a site role, in order to ensure all members of a site could see the other members of the site, but users would not be publicly accessible unless one was in at least one common site. It works in principle, but there are a couple of trip wires in Alfresco: not all core functionality and 3rd party addons have been developed in a way that is compatible with such a customisation, i.e. they typically assume person nodes are always accessible and likely will break if custom permissions change that. So you'd have to be prepared to fix issues in Alfresco core and 3rd party addons if you decide to go this route.

upforsin

@afaust @roberto_gamiz Thank you for the replies. So in your opinion it would be hard to implement without unexpected errors and it would be against the Alfresco ideology?

I am only afraid of the GDPR (General Data Protection Regulation) rules abut the privacy. People who are assigned to different sites may not be connected to each other and it might be against the law if they can acquire information about each other's first name, surname and Email.

Yoast

Any updates on this?
Seems indeed a crucial component for GDPR compliance, and warrants easy implementation for users

EddieMay

@upforsin & @Yoast,

Can I clarify what it is you want just so that I understand your GDPR requirement?

1) Each private site member to remain invisible to members of other sites, unless they share membership of a private or belong to a public site.

This to include all PI data and all documents that they author.

2) People search - to only return users who belong to the same private sites that the person searching belongs to and users that belong to a public site.

3) Solr search to behave similarly to people search - only return results from public and shared private sites.

4) Site administrators and users to be able to turn off display of PI data on a case by case basis.

Does that cover what you are looking for?

Yoast

Hi Eddy,

Thank you for your response.
This is indeed the requirement I refered to.

Kind regards