topic Problem with permissions over groups(behaviour of heritance) in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/problem-with-permissions-over-groups-behaviour-of-heritance/m-p/210364#M163494 <HTML><HEAD></HEAD><BODY><SPAN>Hi all, i have the follow scenario :</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; GROUP-A<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; _________________<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group-A-A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group-A-B<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group-A-A-A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group-A-B-A<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>The process :</SPAN><BR /><SPAN>-A User of the GROUP-A-A-A upload a document in a general space (this space is accesible for all user of all groups).</SPAN><BR /><SPAN>-Alfresco launch a inbound rule that execute the next script code :</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>&nbsp;&nbsp;&nbsp; //cut inheritance<BR />&nbsp;&nbsp;&nbsp; document.setInheritsPermissions(false);<BR />&nbsp;&nbsp;&nbsp; //get groups of the user (in this example if the user belongs to Group-A-A-A the function return Group-A-A-A,Group-A-A and Group-A )<BR />&nbsp;&nbsp;&nbsp; var arr=people.getContainerGroups(person);<BR />&nbsp;&nbsp;&nbsp; var i;<BR />&nbsp;&nbsp;&nbsp; for(i=0;i&lt;arr.length;i++)//assign read permissions<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; document.setPermission("Read",arr[i].properties["usr:authorityName"] );<BR /><BR />&nbsp;&nbsp;&nbsp; document.save();<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>Other Details:</SPAN><BR /><SPAN>-the nodebrowser show the follow information of the document :</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>&nbsp;&nbsp;&nbsp; Permissions<BR />&nbsp;&nbsp;&nbsp; Inherit:&nbsp;&nbsp; false<BR />&nbsp;&nbsp;&nbsp; Assigned Permission&nbsp;&nbsp; To Authority&nbsp;&nbsp;&nbsp;&nbsp; Access<BR />&nbsp;&nbsp;&nbsp; Read&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; GROUP_GROUP-A-A-A&nbsp;&nbsp; ALLOWED<BR />&nbsp;&nbsp;&nbsp; Read&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; GROUP_GROUP-A-A&nbsp;&nbsp;&nbsp;&nbsp; ALLOWED<BR />&nbsp;&nbsp;&nbsp; Read&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; GROUP_GROUP-A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ALLOWED<BR /><BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>But the problem is that the document is accesible for the users of the GROUP-A-B and GROUP-A-B-A&nbsp; :shock:!!.</SPAN><BR /><SPAN>I believe this is due that they share the parent top level group (Group-A).</SPAN><BR /><BR /><SPAN>I need avoid this behavior. I want to assign read permissions only for top levels groups of the same "branch".</SPAN><BR /><SPAN>Is this posible through configuration files??</SPAN><BR /><SPAN>If the answer is no, how can i do it?</SPAN><BR /><BR /><SPAN>Sorry for my poor english.</SPAN><BR /><SPAN>Thanks a lot!</SPAN></BODY></HTML> Tue, 12 May 2009 20:38:58 GMT venzia 2009-05-12T20:38:58Z Problem with permissions over groups(behaviour of heritance) https://connect.hyland.com/t5/alfresco-archive/problem-with-permissions-over-groups-behaviour-of-heritance/m-p/210364#M163494 Hi all, i have the follow scenario :&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; GROUP-A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; _________________&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group-A-A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group-A-B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group-A-A-A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group-A-B-A‍‍‍‍‍‍‍The process :-A Use Tue, 12 May 2009 20:38:58 GMT https://connect.hyland.com/t5/alfresco-archive/problem-with-permissions-over-groups-behaviour-of-heritance/m-p/210364#M163494 venzia 2009-05-12T20:38:58Z Re: Problem with permissions over groups(behaviour of heritance) https://connect.hyland.com/t5/alfresco-archive/problem-with-permissions-over-groups-behaviour-of-heritance/m-p/210365#M163495 <HTML><HEAD></HEAD><BODY><SPAN>Note that documents permissions have a hierarchy as well that is separate from the hierarchy of users and groups.&nbsp; You can customize permission schemes in Alfresco.&nbsp; See these for reference:</SPAN><BR /><UL><A href="http://wiki.alfresco.com/wiki/Security_and_Authentication#How_to_add_your_own_type_or_aspect.2C_assign_permissions_for_it.2C_configure_it_and_secure_a_service_that_uses_it_" rel="nofollow noopener noreferrer">http://wiki.alfresco.com/wiki/Security_and_Authentication#How_to_add_your_own_type_or_aspect.2C_assign_permissions_for_it.2C_configure_it_and_secure_a_service_that_uses_it_</A>….<BR /><A href="http://wiki.alfresco.com/wiki/PermissionModelDefintionExample" rel="nofollow noopener noreferrer">http://wiki.alfresco.com/wiki/PermissionModelDefintionExample</A></UL></BODY></HTML> Fri, 10 Jul 2009 17:39:10 GMT https://connect.hyland.com/t5/alfresco-archive/problem-with-permissions-over-groups-behaviour-of-heritance/m-p/210365#M163495 brian_robinson 2009-07-10T17:39:10Z