topic Re: I need an help on how can I implement a security level in Alfresco Archive

I need an help on how can I implement a security level

diegop — Wed, 28 Jan 2009 13:29:23 GMT

Hi, i have to customize an alfresco 3 labs in order to add a new "security level": each content will have one of 5 levels: NO SECURITY, RESERVED, VERY RESERVED, SECRET, VERY SECRET.Each user will have a similar security level (that I will get it from an external LDAP).So: - every user with RESERVED

Re: I need an help on how can I implement a security level

t_broyer — Wed, 28 Jan 2009 15:43:13 GMT

The most efficient way is to use Alfresco's built-in security.

Create 4 nested user groups: RESERVED, contains VERY RESERVED, which in turn contains SECRET, which finally contains VERY SECRET (no need for a NO SECURITY group, GROUP_EVERYONE will be OK).
If a user is in level "SECRET", put it in the SECRET group. It will therefore also be in the "VERY RESERVED" and "RESERVED" groups, automatically, by "inheritance".

If a file or folder is "VERY RESERVED", set its ACLs to only allow the user group "VERY RESERVED" (this means do not inherit ACLs from the containing folder).

That's all, no customization needed, it "just works" out of the box, with the best performance ever.
Every other solution (e.g. dynamic authorities) will involve much more computations and be much less performant.

The tricky part would be doing all of this "automagically" if you want to (e.g. select security level from a combo box in the "edit details" page instead of using the "manage content users" page)

Re: I need an help on how can I implement a security level

diegop — Wed, 28 Jan 2009 16:52:19 GMT

The most efficient way is to use Alfresco's built-in security.

Create 4 nested user groups: RESERVED, contains VERY RESERVED, which in turn contains SECRET, which finally contains VERY SECRET (no need for a NO SECURITY group, GROUP_EVERYONE will be OK).
If a user is in level "SECRET", put it in the SECRET group. It will therefore also be in the "VERY RESERVED" and "RESERVED" groups, automatically, by "inheritance".

If a file or folder is "VERY RESERVED", set its ACLs to only allow the user group "VERY RESERVED" (this means do not inherit ACLs from the containing folder).

That's all, no customization needed, it "just works" out of the box, with the best performance ever.
Every other solution (e.g. dynamic authorities) will involve much more computations and be much less performant.

The tricky part would be doing all of this "automagically" if you want to (e.g. select security level from a combo box in the "edit details" page instead of using the "manage content users" page)

Thanks t.broyer, your help was precious and clear.

So now I have to customize a bit of Java/JSP/XML Alfresco's code to do all of this "automagically"…

Thank you again,
Diego