topic Permissions, Role incorrectly assigned for user on space? in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/permissions-role-incorrectly-assigned-for-user-on-space/m-p/205329#M158459 <HTML><HEAD></HEAD><BODY><SPAN>Hi Guys,</SPAN><BR /><BR /><SPAN>I've been scouring the web/wiki/forums etc and I'm trying to obtain some clear answers on how permissions work in Alfresco.&nbsp; Hopefully with you assistance you can give me a clear direction on why I am experiencing the issues I'm facing.&nbsp; I have provided a the custom fragment for the permissionDefinitions.xml file if anyone can assist it would be greatly appreciated.</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;!– A collaborator can do anything that a contributor can do –&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;permissionGroup name="LMRM_RecOfficer" allowFullControl="false" expose="true"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;includePermissionGroup permissionGroup="Contributor" type="cm:cmobject"/&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/permissionGroup&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;!– records permission –&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;!– Should be tied to the aspect –&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;!– onwership should be removed when using this permission –&gt; <BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;permissionGroup name="LMRM_RecAdministrator"&nbsp; allowFullControl="false" expose="true"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;includePermissionGroup permissionGroup="LMRM_RecOfficer" type="cm:cmobject"/&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp; &lt;/permissionGroup&gt;<BR /><BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN style="text-decoration: underline;">Problem:-</SPAN><BR /><SPAN>There are two permission groups defined for assignment (by role) in the samples permissions file.&nbsp; These are LMRM_RecOfficer and LMRM_RecAdministrator respectively.&nbsp; Note that these permissions extend from the Contributor permission group.</SPAN><BR /><BR /><SPAN>1. Create a folder "Test Space" in company home</SPAN><BR /><SPAN>2. Set the "Test Space" space not to inherit permissions and invite a test user rmadmin to have LMRM_RecAdministrator permissions and another user rmofficer to have LMRM_RecOfficer permissions on the space.</SPAN><BR /><SPAN>3. Set the "Test Space" to inherit permissions to the children</SPAN><BR /><SPAN>4. Using the rmofficer user create a space "Test Term" under "Test Space", the permissions should inherit to the child.</SPAN><BR /><BR /><SPAN>This is what I'm observing and believe to be correct (if this isn't what you would expect please comment):-</SPAN><BR /><SPAN>1. rmofficer should have full access (including delete) on "Test Term" as they are the owner?</SPAN><BR /><SPAN>2. rmofficer should not have delete access on "Test Space" as they only have the LMRM_RecOfficer role.</SPAN><BR /><BR /><SPAN>The issue I have is this.&nbsp; When I use the permissionService.hasPermission(&lt;Test_Term NODEREF&gt;, "LMRM_RecAdministrator")&nbsp; this returned "AccessStatus.ALLOWED".&nbsp; I would expect this to be "AccessStatus.DENIED" but this is not the case.&nbsp; I have not explicitly assigned any other permissions to either of the test spaces in question.</SPAN><BR /><BR /><SPAN>The ultimate goal I am trying to achieve is to allow a user to create a space, but if they do not have a particular role they SHOULDN'T have delete access to the node.&nbsp; Hence I'm trying to revoke delete permissions.&nbsp; The problem is that I can't ascertain whether I should revoke the permission at this stage.</SPAN><BR /><BR /><SPAN>Cheers</SPAN><BR /><SPAN>Jamen</SPAN></BODY></HTML> Fri, 14 Nov 2008 06:02:51 GMT jamen 2008-11-14T06:02:51Z Permissions, Role incorrectly assigned for user on space? https://connect.hyland.com/t5/alfresco-archive/permissions-role-incorrectly-assigned-for-user-on-space/m-p/205329#M158459 Hi Guys,I've been scouring the web/wiki/forums etc and I'm trying to obtain some clear answers on how permissions work in Alfresco.&nbsp; Hopefully with you assistance you can give me a clear direction on why I am experiencing the issues I'm facing.&nbsp; I have provided a the custom fragment for the permissi Fri, 14 Nov 2008 06:02:51 GMT https://connect.hyland.com/t5/alfresco-archive/permissions-role-incorrectly-assigned-for-user-on-space/m-p/205329#M158459 jamen 2008-11-14T06:02:51Z Re: Permissions, Role incorrectly assigned for user on space? https://connect.hyland.com/t5/alfresco-archive/permissions-role-incorrectly-assigned-for-user-on-space/m-p/205330#M158460 <HTML><HEAD></HEAD><BODY><SPAN>If I am not mistaken, users have full rights on the content they create. Therefore people have delete rights on the space they created, unless the ownership is yanked away, possibly by a space content rule.</SPAN><BR /><SPAN>Just a suggestion… I am by no means an expert, but hopefully this can help you.</SPAN></BODY></HTML> Tue, 18 Nov 2008 15:59:46 GMT https://connect.hyland.com/t5/alfresco-archive/permissions-role-incorrectly-assigned-for-user-on-space/m-p/205330#M158460 lpiguet 2008-11-18T15:59:46Z