topic Re: CMIS and Records Management in Alfresco Archive

CMIS and Records Management

sammasue — Mon, 22 Sep 2014 16:13:36 GMT

Hello,I tried CMIS with Records Management however I get a very frequent error when I select recordsorg.apache.chemistry.opencmis.commons.exceptions.CmisPermissionDeniedException: Permission denied: 08220365 Access Denied‍‍‍I identified a possible cause :CMISResultSet rs = getOpenCMISQueryService().

Re: CMIS and Records Management

sammasue — Wed, 24 Sep 2014 09:27:00 GMT

I progressed a bit on this topic. And I found out this bean is responsible:


   <bean id="search.adm.luceneQueryEngineSecurity" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor">
        <property name="authenticationManager"><ref bean="authenticationManager"/></property>
        <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
        <property name="afterInvocationManager"><ref bean="afterInvocationManager"/></property>
        <property name="objectDefinitionSource">
            <value>
               org.alfresco.repo.search.impl.querymodel.QueryEngine.executeQuery=ACL_ALLOW,AFTER_ACL_NODE.sys:base.Read
               org.alfresco.repo.search.impl.querymodel.QueryEngine.getQueryModelFactory=ACL_ALLOW
            </value>
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍

Indeed this bean does not check the permissions for RM.

I would like to override this bean config and add RM_ALLOW,AFTER_RM.FilterNode to the list but I tried many things and all failed. Does someone know how to do it?

PS: this bean is defined in cmis-api-context.xml and/or opencmis-context.xml.

Sam.

Re: CMIS and Records Management

rwetherall — Fri, 17 Oct 2014 00:41:14 GMT

Have a look for "rm-method-security.properties" in the RM code.

I would try adding the following ..

rm.methodsecurity.org.alfresco.repo.search.impl.querymodel.QueryEngine.executeQuery=RM_ALLOW,AFTER_RM.FilterNode
rm.methodsecurity.org.alfresco.repo.search.impl.querymodel.QueryEngine.getQueryModelFactory=RM_ALLOW

This will ensure that when the node in hand is an RM artifact that these method level security checks are performed, rather than the standard DM ones.

Hope this helps. We should add an easier way to extend this!

Cheers,
Roy

Re: CMIS and Records Management

rwetherall — Fri, 17 Oct 2014 00:44:14 GMT

As a follow up …

The following bean definition …

<java>
<bean id="rm-method-security-properties" class="org.springframework.beans.factory.config.PropertiesFactoryBean">
      <property name="locations">
            <list>
                <value>classpath*:alfresco/module/org_alfresco_module_rm/security/rm-method-security.properties</value>
                <!– Override –>
                <value>classpath*:alfresco/extension/rm-method-security.properties</value>
            </list>
        </property>
   </bean>
</java>
.. implies that you can add your own custom rm-method-security.properties in the extensions directory. This might be preferable to modifying the core implementation.

Cheers,
Roy

Re: CMIS and Records Management

sammasue — Fri, 17 Oct 2014 08:25:58 GMT

Hello Roy,

Thank you a lot for help. It works perfectly.

Sam