topic Re: How to restrict user to search for site-member of that site only rather than all? in Alfresco Archive

How to restrict user to search for site-member of that site only rather than all?

nwali — Thu, 22 Dec 2016 13:03:29 GMT

I am new to Alfresco and using Alfresco Community 5.0.d & aio sdk for customising the application.I am not able to get a way to restrict user of Site-A to search & see only Site-A members where as in current scenario if user search for member in Site-A then the result comes combined from Sit

Re: How to restrict user to search for site-member of that site only rather than all?

afaust — Thu, 22 Dec 2016 13:33:39 GMT

There is no easy / configurable way to only show only those users of the same site(s) in the global user search. All users are publicly visible by default and as such can be found by anyone. This needs to be that way for various functionalities, e.g. inviting other users to sites or assigning ad-hoc tasks.

Re: How to restrict user to search for site-member of that site only rather than all?

douglascrp — Thu, 22 Dec 2016 16:14:39 GMT

Axel Faust‌ I was able to implement that requirement by reusing part of this project GitHub - cggh/cggh-alfresco-extensions: Alfresco customizations

Home · cggh/cggh-alfresco-extensions Wiki · GitHub

The configuration for this is here Repo extensions · cggh/cggh-alfresco-extensions Wiki · GitHub

Re: How to restrict user to search for site-member of that site only rather than all?

afaust — Thu, 22 Dec 2016 16:31:50 GMT

Obviously I was not saying it is impossible. Touching the public-services-security-context.xml is not something that is considered a "recommended" approach to customization by Alfresco. In another thread I made a mention of adding / changing AOP handling and that person did not get the hint that that would be a rather invasive change (for a beginner) and immediately wanted to know how it can be done. So I try to not mention this anymore...

Re: How to restrict user to search for site-member of that site only rather than all?

douglascrp — Thu, 22 Dec 2016 19:00:10 GMT

I know you didn't say that

And I have to agree with you... Telling people to try it without understanding the implications is kind of risky.

Re: How to restrict user to search for site-member of that site only rather than all?

nwali — Tue, 03 Jan 2017 12:14:21 GMT

Hi Douglas,

I went through the links provided but its kinda bit confusing. Could you narrow down what exact modification needs to be taken care of? I saw there are many files to be changed but what exactly to be modified in those files?

Thanks.

Re: How to restrict user to search for site-member of that site only rather than all?

douglascrp — Wed, 04 Jan 2017 15:52:03 GMT

Hey

I have to agree with what Axel said before. If you are not able to understand what that code does, then you shouldn't be messing with it.

That is not a recommended change, at least not without understanding all that can go wrong, and even more when you perform an upgrade.

If you can, try to convince your users to let it the way it is, and avoid performing those changes.

Re: How to restrict user to search for site-member of that site only rather than all?

nwali — Thu, 05 Jan 2017 12:13:01 GMT

I do agree with you and Axel that without knowing the code working, performing changes will mess up things. So if you could direct me to some blog or site that would help me understanding those files or ways then that would be great.

Also from security perspective this a big issue, as in case I have two different customer and I invite them to work on different sites. Then accidentally if they search in People they might get to know that I'm working with both of them. At last from business point of view it is not good.

Thanks.

Re: How to restrict user to search for site-member of that site only rather than all?

afaust — Thu, 05 Jan 2017 13:08:13 GMT

This is only a security issue because you are trying to manage the use case of handling two customers with extreme isolation requirements in a way that was never designed for full logical data separation. That is where multi-tenancy comes in and provides that extra layer of security. A "tenant" is basically a separate logical view in an Alfresco system with its own users, data dictionary and general content structure. There is no chance of a tenant user ever accidentally seeing a user or piece of content from another tenant.

Re: How to restrict user to search for site-member of that site only rather than all?

nwali — Thu, 05 Jan 2017 16:46:42 GMT

Axel Faust‌ Thank you for the information. I went through the tenant part and it works like charm to keep both customer away from each others search. But now there has to be two different credentials for the admin to manage both the sites/customers. Also there is no way for a single admin to see the progress of both customer from single point of view as tenant creates two different instance with different credential.

Also comment provided by Douglas with links using which he had implemented the same, does not have any documentation for user to read and understand the usage or use cases. Definitely the documentation around Alfresco development is very less and is like just a overview.

If you have any proper blog or tutorial which would help me then please share.

Re: How to restrict user to search for site-member of that site only rather than all?

afaust — Thu, 05 Jan 2017 16:57:49 GMT

Sure - there have to be trade-offs to extreme & clean isolations, but I would assume that minor admin inconvenience may be acceptable if proper security can be provided. Also, a solution based on multi-tenancy can theoretically be extended with manageable effort - and without as many risks as fiddling with security definitions - to collect status data from each tenant and provide an overview for the global admin, as well as allow a convenient "switch to same user in tenant X" function to be developed.

The problem with your use case is that it is not something that most people will ever have to deal with and as a result you will not find any blog, tutorial etc. that deals with those kind of implementation changes to safely get started yourself. Douglas and myself only know how we would deal with such a use case only from years of tinkering with the software ourselves, and we know the associated risks from various times we shot ourselves in the foot.

Re: How to restrict user to search for site-member of that site only rather than all?

idwright — Thu, 05 Jan 2017 18:10:12 GMT

Totally agree - I'm not that comfortable with doing it like that and I wrote it in the first place!

We have quite a small and lightly used instance but it does work for us.

I agree it's best not to mess with it and stick with the default behaviour if possible.

As I've said elsewhere - I'm happy for people to look at and use that code but be aware that it was not written with the purpose of being more widely released and should be treated with great care.(I work on Alfresco on my own, part of my time, on community edition and am largely making it up as I go along...)

Re: How to restrict user to search for site-member of that site only rather than all?

nwali — Fri, 06 Jan 2017 10:35:02 GMT

Thank you Axel Faust and Ian Wright‌ for your time and comment. I would go with the tenant feature to achieve the restriction as messing around with security changes will take a long time.

Thanks.