topic Re: Security roles for 1.1 in Alfresco Archive

Security roles for 1.1

ell — Wed, 07 Dec 2005 15:48:40 GMT

Hello thereI am looking into the security roles for release 1.1Could anyone please explain what rights each one of them has?Is there a tutorial available on how to use these roles (maybe from the pro edition)?I thought that if I was a guest, I shouldn't be able to add a space or create content. But

Re: Security roles for 1.1

abrar — Fri, 09 Dec 2005 06:59:43 GMT

Hi

First thanks to the Alfresco team for releasing open source version 1.1 with roles This is really helpful.

I am experimenting with Alfresco Open source version 1.1 and I have the same question as in the previous post about roles. I am working with the Software Engineering Project template. And only the user with coordinator role is able to request for approval and also approve. Other users with contributor or editor roles only have permission to edit or add content but are unable to request for approval. Would appreciate if someone throws light on the various alfresco roles.

I want to know how to setup users so that the user who has rights to request for approval is different from the user that has right to approve. Currently AFAIK only coordinator has rights to request for approval and approve, which I think is not right.

Thanks
Abrar

Re: Security roles for 1.1

andy — Fri, 09 Dec 2005 13:03:49 GMT

Hi

All roles and permissions are defined in permissionDefinitions.xml in
config/alfresco/model.

I will go through the roles as they stand but bear in mind

1) You may be inheriting permissions
2) You may have permissions from the ALL group
3) You may have permissions from being the owner
4) And if you have groups you may have permissions becasue of group membership.

See http://www.alfresco.org/mediawiki/index.php/Security_and_Authentication

So:



   <!– ============================== –>
   <!– Permissions for spaces/folders –>
   <!– ============================== –>
   
   
   <permissionSet type="cm:folder" expose="selected">
        <!– Kept for backward compatibility - the folder administrator permission has   –>
        <!– been removed to aviod confusion –> 
        <permissionGroup name="Administrator" allowFullControl="true" expose="false" />
        
        <!– A coordinator can do anything in the folder or its childeren unless the     –>
        <!– permissions are set not to inherit or permission is denied.                 –>
        <permissionGroup name="Coordinator" allowFullControl="true" expose="true" />
        
        <!– A contributor can create content and then they have full permission on what –>
        <!– they have created - via the permissions assigned to the owner.              –>
        <permissionGroup name="Contributor" allowFullControl="false" expose="true" >
            <!– Contributor is a guest who can add content, and then can modify via the –>
            <!– owner permissions.                                                      –>
            <includePermissionGroup permissionGroup="Guest" type="cm:folder"/>
            <includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
            <!– Check out requires write permissions so this will not apply to all      –>
            <!– documents.                                                              –>
            <includePermissionGroup type="cm:lockable" permissionGroup="CheckOut"/>
        </permissionGroup> 
        
        <!– An editor can read and write to anything in a space; they can not create    –>
        <!– new nodes. They can cehck out content into a space to which they have       –>
        <!– create permission.                                                          –>
        <permissionGroup name="Editor"  expose="true" allowFullControl="false" >
            <includePermissionGroup type="cm:folder" permissionGroup="Guest"/>
            <includePermissionGroup type="sys:base" permissionGroup="Write"/>
            <includePermissionGroup type="cm:lockable" permissionGroup="CheckOut"/>
        </permissionGroup>
        
        <!– The guest permission allows read to everything by default.                  –>
        <permissionGroup name="Guest" allowFullControl="false" expose="true" >
            <includePermissionGroup permissionGroup="Read" type="sys:base" />
        </permissionGroup>
   </permissionSet>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

To summarise:

Guest can read

Editor has all the permissions of Guest but can write properties and content. The editor can not create content. An editor can check out content - but the wolrking copy will have to be in a space to which they have create access e.g. their home space.

Contributor has guest permissions + creation + check out of things they can write.
They can not edit content they do not own. They get all permissions for the content they create - which by default they own. If they loose ownerhip they loose permissions ….unless you have explicitly given them permissions in some other way ….

Coordinator can do anything in the space and sub-spaces which inherit permissions.

I am not sure which permissions are used for approval check.

You can change the definitions - they are read at start up.


I thought that if I was a guest, I shouldn't be able to add a space or create content. But what is more strange I can create a space, I can create content but I cannot add a content. Is this the case? 
</code]

This sounds like you are also a contributor - this may be inherited …
I am not sure what add a content means - as opposed to create??

Regards

Andy‍‍‍‍‍‍‍‍‍‍

Re: Security roles for 1.1

abrar — Mon, 12 Dec 2005 05:06:10 GMT

Andy, Thanks for response. Glad to know that permissions can be altered via permissionDefinitions.xml. I am able to add delete permissions to a role by modifying that file.

 
<permissionGroup name="Contributor" allowFullControl="false" expose="true" >

….

<! – Added  Delete permissions –>
      <includePermissionGroup permissionGroup="Delete" type="sys:base"/>

        </permissionGroup> ‍‍‍‍‍‍‍‍‍

Now I would like to know if its possible to apply permission to rules or workflows, So user with that role will be able to execute a workflow without worrying about folder or node permissions. Please do point me in the right direction. Any information would help.

Thanks
Abrar.

Re: Security roles for 1.1

andy — Mon, 12 Dec 2005 10:38:24 GMT

Hi

Rules set to run in the back ground run as "system".
Rules that execute at the end of a transaction runs as the current user.

I have raised bug AR-313 against this.

There is already an enhancement request for rules to "run as" another user.

So in the short term you can work round this issue by running the rule in the background.

Actions executed direct from the UI will always run as the system user.

Cheers

Andy

Re: Security roles for 1.1

erlywom — Fri, 20 Jan 2006 11:29:30 GMT

Hi,

I have faced some problems while using Alfresco.

1. If i'm the Contributor, can i send the document for approval?
2. If i'm not mistaken, when a workflow is created, i cannot assign the approver. So, may i know who has the access right to approve the document?

Thanks.

Re: Security roles for 1.1

gavinc — Mon, 23 Jan 2006 09:33:22 GMT

Hi,

The approve and reject actions are not protected by any permission, therefore it will depend on the permissions of the spaces involved in the workflow and the permissions assigned to them.

For example if you have a workflow that moves a document to space A when it is approved then the user approving the document must have "delete" permission on the existing space and "contributor" or "coordinator" on space A.

Feel free to raise a feature request on JIRA if you would like permissions to be applied to the actual approve and reject actions, or alternatively, you can define your own permissions and add a permission evaluator around the action in document-details.jsp

Hope this helps.

Re: Security roles for 1.1

paulhh — Fri, 05 May 2006 08:32:29 GMT

Just to update this thread to the latest default set of roles (1.2):

Consumer = Read spaces and content
Editor = Consumer + edit existing content
Contributor = Consumer + add new content
Collaborator = Editor + Contributor
Coordinator = Full Control

Paul.

Re: Security roles for 1.1

pej — Thu, 01 Mar 2007 14:19:10 GMT

What differs Coordinator from Collaborator?. If I look at it from a truthtable view they have the same rights. Is there more rights included in "Full Control" ?

Regards

Re: Security roles for 1.1

andy — Fri, 02 Mar 2007 15:11:26 GMT

Hi

Full control adds the rest - e.g. Setting permissions.

See http://wiki.alfresco.com/wiki/Security_and_Authentication#Default_Permissions
for the gory details.

Andy