Only the owner can access (see, read, write) a document - with OpenCMIS

juans — Wed, 03 Aug 2016 21:56:43 GMT

I have a site with its documentLibrary folder (Sites/Client1_site/documentLibrary) and with a file1.txt in it. How can I specify that this file1.txt is only accessible by its owner (user1) ? so when user2 (or any other user) goes into documentLibrary he can not see that file.What I did in Share was:

Re: Only the owner can access (see, read, write) a document - with OpenCMIS

gawadesk — Thu, 04 Aug 2016 11:12:01 GMT

Hello,

As per my understanding we can't break Alfresco Permission Inheritance using OpenCMIS. You must use Alfresco API for the same and can leverage from OpenCMIS.

Thanks,
Krishna

Re: Only the owner can access (see, read, write) a document - with OpenCMIS

juans — Fri, 05 Aug 2016 13:01:49 GMT

Thanks for you reply.

I think your understanding is correct. I went ahead and code something because I thought if I remove the ACL it would turn off the permission inheritance, but it did not work.

I created a file with OpenCMIS (thanks to jpotts as I took his code as base for this)

<java>
      String docName = "doc1";
      String contentType = "documentTypeExample";
      Session session = getSession();
      Folder folder = (Folder) session.getObjectByPath("/" + getFolderName());

      String timeStamp = new Long(System.currentTimeMillis()).toString();
      String filename = docName + " (" + timeStamp + ")";

      Map <String, Object> properties = new HashMap<String, Object>();

      properties.put(PropertyIds.OBJECT_TYPE_ID, "cmis:document");
      properties.put(PropertyIds.NAME, filename);

      String docText = "This is a sample " + contentType + " document called " + docName;
      byte[] content = docText.getBytes();
      InputStream stream = new ByteArrayInputStream(content);
      ContentStream contentStream = session.getObjectFactory().createContentStream(filename, Long.valueOf(content.length), "text/plain", stream);

      // CREATE A SIMPLE DOCUMENT
      Document doc = folder.createDocument(
               properties,
               contentStream,
               VersioningState.MAJOR);
      System.out.println("Created: " + doc.getId());
      System.out.println("Content Length: " + doc.getContentStreamLength());

      String id = doc.getId();
      OperationContext operationContext = new OperationContextImpl();
        operationContext.setIncludeAcls(true);
      // SHOW THE ACLS FOR THE CURRENT DOCUMENT
      printAcl(id, session, operationContext);

</java>
After run this, I get this:
<blockcode>
Created: 7b4bd05c-7be7-40fb-81bd-e7237257f63d;1.0
Content Length: 48
Acl for doc1 (1470324075356):
Access Control Entry [principal=Access Control Principal [principalId=GROUP_EVERYONE][extensions=null], permissions=[{http://www.alfresco.org/model/content/1.0}cmobject.Contributor], is direct=false][extensions=null]
END Acl for doc1 (1470324075356).
</blockcode>

Then I run this:
<java>
        // ADDING A NEW ACL
        String principal = "juansanin";
        RepositoryInfo repositoryInfo = session.getRepositoryInfo();
        AclCapabilities aclCapabilities = repositoryInfo.getAclCapabilities();

        Map<String, PermissionMapping> permissionMappings = aclCapabilities.getPermissionMapping();
        PermissionMapping permissionMapping = permissionMappings.get(PermissionMapping.CAN_VIEW_CONTENT_OBJECT);

        List<String> permissions = permissionMapping.getPermissions();
        Ace addAce = session.getObjectFactory().createAce(principal, permissions);

        List<Ace> addAces = new LinkedList<Ace>();
        addAces.add(addAce);

        // with AclPropagation.OBJECTONLY this permission should apply only to this object
        Document doc2 = (Document) session.getObject(id, operationContext);
        doc2.addAcl(addAces, AclPropagation.OBJECTONLY);


        System.out.println("With newly added Acl");
        printAcl(id, session, operationContext);

</java>
And get this:
<blockcode>
With newly added Acl
Acl for doc1 (1470324075356):
Access Control Entry [principal=Access Control Principal [principalId=GROUP_EVERYONE][extensions=null], permissions=[{http://www.alfresco.org/model/content/1.0}cmobject.Contributor], is direct=false][extensions=null]
Access Control Entry [principal=Access Control Principal [principalId=juansanin][extensions=null], permissions=[cmis:read, {http://www.alfresco.org/model/system/1.0}base.ReadContent], is direct=true][extensions=null]
END Acl for doc1 (1470324075356).
</blockcode>
At this point, if you go to Alfresco Share, you see that this last ACL is added to the section Locally Set Permissions (I thought I was going in the right direction).

Then I remove the current ACLs for the object with this:
<java>
        // REMOVE ALL ACLS FOR THE OBJECT
        Acl acl = doc2.getAcl();
        for (Ace ace : acl.getAces()) {
            System.out.println(ace);
            List<Ace> addAces2 = new LinkedList<Ace>();
            addAces2.add(ace);
          doc2.removeAcl(addAces2, AclPropagation.REPOSITORYDETERMINED);
          System.out.println("removed!");
        }

        System.out.println("It should not be any ACL as a removed them all!");
        printAcl(id, session, operationContext);
</java>
And when I list the ACLs for the object, the one with principalId=GROUP_EVERYONE is still there even though I supposedly remove it

<blockcode>
Access Control Entry [principal=Access Control Principal [principalId=GROUP_EVERYONE][extensions=null], permissions=[{http://www.alfresco.org/model/content/1.0}cmobject.Contributor], is direct=false][extensions=null]
removed!
Access Control Entry [principal=Access Control Principal [principalId=juansanin][extensions=null], permissions=[cmis:read, {http://www.alfresco.org/model/system/1.0}base.ReadContent], is direct=true][extensions=null]
removed!
It should not be any ACL as a removed them all!
Acl for doc1 (1470324075356):
Access Control Entry [principal=Access Control Principal [principalId=GROUP_EVERYONE][extensions=null], permissions=[{http://www.alfresco.org/model/content/1.0}cmobject.Contributor], is direct=false][extensions=null]
END Acl for doc1 (1470324075356).
</blockcode>

<java>

// I am using this method to print the current ACLs for the document
   private void printAcl(String id, Session session,
         OperationContext operationContext) {
      Document doc2 = (Document) session.getObject(id, operationContext);

        System.out.println("Acl for " + doc2.getName() + ": ");

        Acl acl = doc2.getAcl();
        for (Ace ace : acl.getAces()) {
            System.out.println(ace);
        }
        System.out.println("END Acl for " + doc2.getName() + ".");
   }

</java>

So I guess this is not the way to remove inherited permissions.

How could I do it with Alfresco API ? could you point me out to some document ? or code snippet ?

Thanks

Re: Only the owner can access (see, read, write) a document - with OpenCMIS

gawadesk — Fri, 05 Aug 2016 13:46:24 GMT

Hello,

Indeed you should use Alfresco API.

You can achieve this by using both Java as well as Scripting API provided by Alfresco.

JavaScript :


document.setInheritsPermissions(false); 
‍‍‍

Refer this document - http://docs.alfresco.com/5.0/references/API-JS-setInheritsPermissions.html

Java :


PermissionService.setInheritParentPermissions(NodeRef nodeRef, boolean inheritParentPermissions)
‍‍‍

Thanks,
Krishna

If this post was helpful, please click "mark comment as useful"

Re: Only the owner can access (see, read, write) a document - with OpenCMIS

acervantes2018 — Thu, 15 Mar 2018 19:31:35 GMT

Thanks!! In this way, many users can create folders in a site; so when "user_a" creates a document, i execute a rule with the permission directive (js), and only "user_a" can view the folder on the site.

Thank you!!

topic Only the owner can access (see, read, write) a document - with OpenCMIS in Alfresco Archive

Only the owner can access (see, read, write) a document - with OpenCMIS

Re: Only the owner can access (see, read, write) a document - with OpenCMIS

Re: Only the owner can access (see, read, write) a document - with OpenCMIS

Re: Only the owner can access (see, read, write) a document - with OpenCMIS

Re: Only the owner can access (see, read, write) a document - with OpenCMIS