topic Re: Consumer permissions to all users through globalPermission in Alfresco Archive

Consumer permissions to all users through globalPermission

lista — Tue, 22 Oct 2013 14:47:57 GMT

Hi,basically, because of other issues, I need to have permission inheritance turned off, and still have a group that has read permission to the whole repository.Now, similarly to how we have globalPermission to allow administrators full access defined in permissionModel.xml, I was hoping I could to

Re: Consumer permissions to all users through globalPermission

eswbitto — Tue, 22 Oct 2013 16:30:45 GMT

I think some clarity is needed in your setup. You can go into the repository and for each site you can turn off inheritance perm. Then just manually add your groups with the consumer level access. That's basically read only.

Re: Consumer permissions to all users through globalPermission

lista — Tue, 22 Oct 2013 17:42:00 GMT

I'm not sure I follow you; sure I can apply permissions to each node, but that's what I'm trying to avoid.
I still think the globalPermissions approach should work.

"Global Permission - a permission or permission group assigned to an authority regardless of the node. A global permission takes precedence over node specific ACLS. If "bob" were granted the global permission "read" then "bob" would have the "read" permission for everything, regardless of any ACLs set on any nodes."

http://wiki.alfresco.com/wiki/Security_and_Authentication

Re: Consumer permissions to all users through globalPermission

lista — Fri, 12 Sep 2014 11:54:40 GMT

Long time no see.

Basically, if you have this piece of configuration ("FullControlTest" is an exact copy of "FullControl") everything works as expected, administrators still have full access.


<!–<globalPermission permission="FullControl" authority="ROLE_ADMINISTRATOR"/>–>
<globalPermission permission="FullControlTest" authority="ROLE_ADMINISTRATORS"/>
‍‍‍‍

If you alter that to read this:


<!–<globalPermission permission="FullControl" authority="ROLE_ADMINISTRATOR"/>–>
<globalPermission permission="FullControlTest" authority="GROUP_MYGROUP"/>
‍‍‍‍

Members of the "MYGROUP" do not have full control.

Any ideas why?