topic Re: turn off Global READ permission in Alfresco Archive

turn off Global READ permission

omegerard — Fri, 09 Dec 2005 09:51:33 GMT

Hi,I'm testing enterprise version 1.1It seems that the each user has read access to each and every work space. As far as I have understood the docs, it appears that this is due to a global "guest role" permission that overrides the specific space ACLs. I suppose this global permission can be turned

Re: turn off Global READ permission

kevinr — Fri, 09 Dec 2005 10:00:35 GMT

Hello,

Edit the web-client-config.xml file. Search for this line:

<home-space-permission>Guest</home-space-permission>

And change it to this:

<home-space-permission></home-space-permission>

You can make the default permissions any valid permission, see:
org.alfresco.service.cmr.security.PermissionService
for allowed values.

Thanks,

Kevin

Re: turn off Global READ permission

omegerard — Fri, 09 Dec 2005 10:05:24 GMT

Kevin

Thank you for your quick and accurate reply.

Was there any reason why the "Guest" permission was globally set?

Ludo

PS. The progress from v1.0 to v1.1 is impressive. Congratulations.

Re: turn off Global READ permission

kevinr — Fri, 09 Dec 2005 10:07:19 GMT

No problem. We thought that GUEST access would be an acceptable default - obviously it depends on your installlation

Thanks for your comments!

Kev

Re: turn off Global READ permission

kevinr — Fri, 09 Dec 2005 10:22:38 GMT

If you wish to remove the GUEST access from Home Spaces you have already created before making the config change, then:

. Login as "admin"
. Navigate to each home space you want to change
. Select "Manage Space Users" from the More… actions menu
. Remove the GUEST access that is applied to the GROUP_ALL special user

Cheers,

Kevin

Re: turn off Global READ permission

omegerard — Fri, 09 Dec 2005 10:43:02 GMT

Kevin

Giving my index finger a bit of a rest, I've got one additional question:

If you wish to remove the GUEST access from Home Spaces

What about the other space?

Under company home I created a tree structure:

A -> X

Re: turn off Global READ permission

omegerard — Fri, 09 Dec 2005 10:45:33 GMT

Wait a minute … I hadn't finished yet.

Tree structure with

User Spaces – Space X — Space Y

What do I do when I don't want external users to access Space X?

Even if the space soes not explicitly disallow these external users to visit these spaces as guests, they can see the space. I would like to make it invisible for them.

Regards

Ludo

Re: turn off Global READ permission

kevinr — Fri, 09 Dec 2005 11:48:44 GMT

Node permissions are inherited unless inheritance is disabled for a space. When a users Home Space is created, it is set to break inheritance at that point in the hiearchy, but any folders created under that space will inherit the home space permissions. Therefore you don't need to do anything to change the permissions for the structure you mention, as simply changing the permission at the user space level will be enough.

Cheers,

Kevin

Re: turn off Global READ permission

omegerard — Fri, 09 Dec 2005 12:06:30 GMT

Kevin

Judging from what you say

Node permissions are inherited unless inheritance is disabled for a space.

I fear that I wasn't clear enough.

In my example: User Spaces – Space X — Space Y are all -1 nodes from the Company Home root node. In other words, Space X is a sister of User Spaces.

Ludo

PS. Drawing trees in ascii is too difficult for me

Re: turn off Global READ permission

kevinr — Fri, 09 Dec 2005 12:13:35 GMT

I see - yes you'll need to modify the permissions in the UI for each space at the same level unless they are under a space with the correct inherited permissions.

Thanks,

Kevin

Re: turn off Global READ permission

omegerard — Fri, 09 Dec 2005 14:39:23 GMT

Kevin,

Pardon my ignorance, but what do you mean by

you'll need to modify the permissions in the UI for each space at the same level

Is UI = Web interface? If so, I tried to set the permissions right; As a matter of fact, they are right. The group to which the external users belong, don't have read access. Still, they appear to be "guests".

Kind regards

Ludo

Re: turn off Global READ permission

kevinr — Fri, 09 Dec 2005 15:14:37 GMT

Sorry yes UI=web-client (we only have one UI at the present)

For the spaces you have modified the permissions on, are they set to "Inherit Parent Space Permissions"? If this is checked then they will inherit permissions from the parent (Company Home?) which has GUEST by default, so uncheck this and then it should be ok.

Thanks,

Kevin

Re: turn off Global READ permission

omegerard — Mon, 12 Dec 2005 08:13:18 GMT

Kevin

Thanks again for your help.

In fact, this

"Inherit Parent Space Permissions"

thing is very powerful!

I checked it off and it worked as expected. Thanks.

On another note, you said

Sorry yes UI=web-client (we only have one UI at the present)

Can I deduce from this remark that you are working on another (G)UI?

Regards

Ludo

Re: turn off Global READ permission

kevinr — Mon, 12 Dec 2005 10:24:48 GMT

Sorry yes UI=web-client (we only have one UI at the present)
Can I deduce from this remark that you are working on another (G)UI?

Not that i know of we have plenty of APIs but only one client at the moment. I personally think that a repository node browser written in Swing or SWT would make a great little app and a good project for the community to learn the system.

Cheers,

Kevin

Re: turn off Global READ permission

fthamura — Thu, 19 Jan 2006 17:05:06 GMT

I removed the guest user

and i try to login, and how can i still can access my space which must be hide .

can help?

Re: turn off Global READ permission

kevinr — Thu, 19 Jan 2006 17:26:40 GMT

Sorry i'm not sure exactly what you've done…? Did you remove GUEST from the web-client config XML file?

Kevin

Re: turn off Global READ permission

fthamura — Thu, 19 Jan 2006 17:44:38 GMT

i remove the guest at system user page, can we do this without modify the web-client xml?