topic Re: deny delete permision from owner of a space in Alfresco Archive

deny delete permision from owner of a space

mmrs — Sun, 01 Mar 2009 09:19:56 GMT

hi alli want to allow a user to create a space and deny delete permission on that space i tried to assign him the contributor Role on that space but he still can delete the node he createi believe it's about owner ship ,but how can i allow user to create space without ownership!i need some guide her

Re: deny delete permision from owner of a space

ivan_plestina — Mon, 02 Mar 2009 13:56:51 GMT

hi all
i want to allow a user to create a space and deny delete permission on that space
i tried to assign him the contributor Role on that space but he still can delete the node he create
i believe it's about owner ship ,but how can i allow user to create space without ownership!
i need some guide here if possible

i forgot to mention that i want to do that from the permissionDeffinition.xml file if possible

many thanks
mmrs

Add somewhere near top new permissionGroup definition and assign permissions by your needs (http://wiki.alfresco.com/wiki/Default_Permissions_Model_Reference😞

<permissionGroup name="FullWithoutDelete" allowFullControl="false" expose="false">
          <includePermissionGroup type="sys:base" permissionGroup="Read"/>
          <includePermissionGroup type="sys:base" permissionGroup="Write"/>
          <includePermissionGroup type="sys:base" permissionGroup="AddChildren"/>
          <includePermissionGroup type="sys:base" permissionGroup="Execute"/>
</permissionGroup>‍‍‍‍‍‍

then find:

<globalPermission permission="FullControl" authority="ROLE_OWNER"/>‍

and change it to:

<globalPermission permission="FullWithoutDelete" authority="ROLE_OWNER"/>‍

Notice that this will take away delete permissions from owner on ALL content in repository unless he is assigned proper permissions on space.

There is one other option the I think is better than messing with core alfresco configs. You can create a rule on top space that adds cmwnable aspect to whatever you want. By default if ownable aspect i.e. cmwner property is not present (which is the case when adding new content on clean config) then cm:creator property is used as owner. So when you add content and rule gets triggered document receives ownable aspect with cmwner property empty. This in effect removes delete permissions from cm:creator as he is no longer the owner. Note that adding aspects is exposed in rules wizard though you might need to modify web-client-config-custom.xml to expose cmwnable aspect in it.

Hope this helps.

Ivan

Re: deny delete permision from owner of a space

mmrs — Mon, 02 Mar 2009 22:09:02 GMT

Thank you Ivan,
that was a great help, I applied the first way and it's working fine
but i 'm not sure about the other way
if you can explain more, that will be great

please forgive my ignorance, i'm just learning these stuff

mmrs

Re: deny delete permision from owner of a space

ivan_plestina — Mon, 02 Mar 2009 23:03:55 GMT

Uh not sure where to even start so I'll just point you to wiki:
http://wiki.alfresco.com/wiki/Data_Dictionary_Guide
http://wiki.alfresco.com/wiki/UML_Class_Diagrams#Content_Model
http://svn.alfresco.com/repos/alfresco-open-mirror/alfresco/HEAD/root/projects/repository/config/alfresco/model/contentModel.xml

As for the above concept…consider a scenario where user John creates space TEST. By default that space will have cm:creator property set (Which is exposed as 'Creator' when you view space's details in Alfresco web client) but cmwner (aka Space owner) won't be set. Since cmwner is non-existant atm Alfresco uses cm:creator property as the effective owner.

Now aspects come into play. Lets say you have a rule on Company home space that says: "For every new space under company home assign a cmwnable aspect to it". Now when John creates TEST2 space that space will receive cmwner property through that automatically assigned aspect. Value of cmwner is nothing, empty string but notice that property now exists so Alfresco is abandoning cm:creator as owner and starts using cmwner property as a true owner. Now, John created the space but since cmwnable aspect was assigned by rule John will not be listed as cmwner(remember it's an empty string) so when he tries to delete that space Alfresco will just say "go away, you're not listed as my owner".

Re: deny delete permision from owner of a space

mmrs — Tue, 03 Mar 2009 11:31:27 GMT

Thanks for clarification

I review the links you post and alot of things now makes more sence to me
so the rule that i will create should only assign empty ownership to the (space and its sub-spaces )it's applied to; which is done as follows:

1. create the aspect with type "cmwnable" in the "web-client-config-custom.xml " file.
2. from the alfresco web client i will create a rule on the parent of my space that will add cmwner property by assigning ownable aspect to it .

That's how it should be done, am i right Ivan?