topic Re: Have you really removed security from the opensource version in Alfresco Archive

Have you really removed security from the opensource version

jocsch — Tue, 18 Oct 2005 10:07:10 GMT

Oh, I am the first one to post in this forum, nice ;-)Do you really have removed security from the opensource version of the repository? Or do you only removed the administration mask?I know you must earn money with this product and I always supposed that there are some limitations to come.But secur

Re: Have you really removed security from the opensource version

kevinr — Tue, 18 Oct 2005 10:35:39 GMT

Hello,

A security implementation was never present in the Open version, the API is present, so we have not removed it. Simple authentication and basic user management is present, but yes Role and Group based access control and NTLM authentication features are not currently going to be available in the Open version.

Applogies if you feel we misled you about the security feature set but we feel that it is important enough to be made part of the support network package. So yes you are correct in that permissions and advanced security features such as NTLM single-signon are now part of the Profressional/Enterprise support network.

The permissions support provided for the Profressional/Enterprise version of Alfresco is advanced and very powerful. It provides features such as node level Allow, Deny, Users, Groups, ACLs, Inheritence, NTLM single-signon etc. through a XML based configuration. For the Open version it may be the case that we provide "simple" security features for people who don't require advanced security. The permissions interfaces are still exposed in the Open version, so a simple implementation for basic security features could be implemented.

Thanks,

Kevin

Re: Have you really removed security from the opensource version

cfgert — Tue, 18 Oct 2005 22:49:57 GMT

Unfortunatly it sounds that this was Alfresco for the public :cry: . Noone has a use of a document system without normal permission possiblities. Perhaps for the personal documents, but for nothing else. For us e.g. as an non profit organisation the monthly fee is not afordable.

But it looked really nice….

Re: Have you really removed security from the opensource version

jocsch — Wed, 19 Oct 2005 08:30:22 GMT

that's what I meant: not sure who can use this opensource product any longer. I think there are two possibilities this will evolve:

- no one with security considerations can use the opensource version.
- someone will create an add-on opensource version for the security management (is this possible or restricted by the licence?).

Mhm, I think jackrabbit also lacks a good security management. Could it really be so hard as acegi supports ACLs and the hooks are there? I will have a look into this issue in a few month, comparing these repos again.

Don't get me wrong guys. I really hope you can make money with this. But this security issue really hurts and is in my opinion a dead end.

markus

Re: Have you really removed security from the opensource version

lgr — Thu, 20 Oct 2005 18:23:53 GMT

Hello,

I agree with you, this is a sad news. Anyway, we have the opportunity to see someone build a better rights management interface with the open-source version.

I think this is why there is an Alfresco Community network.

But after having read the products comparison PDF, i understand that the most desirable feature that will lack in the community network is this groups and role based user security management. I think we can understand that clustering, high availability, secure lifecycle management, or even NTLM SSO are intended for use by larger companies, but you're right that security and user management will really needed for basic use of Alfresco. Without it, it is nearly unusable in a professional world.

Furthermore, i imagine that the common evaluation process of Alfresco will be to install the Community network, then upgrade if necessary to the Pro or Entreprise network. Clustering and High availability are not necessary for evaluation, but there is no true evaluation without good security features.

Hmm .. Ok, let's try the final version first, and we will see which functionnalities are lacking or not.

Laurent.

Re: Have you really removed security from the opensource version

janiner — Tue, 01 Nov 2005 21:35:52 GMT

I agree as well. I have no problem with things like clustering being available only for a fee, but groups and roles? Without them, what exactly is the point?

Re: Have you really removed security from the opensource version

mfeldstein — Tue, 01 Nov 2005 22:21:17 GMT

I have to agree with the other posters here. If there isn't support for roles, groups, and permissions within the Open Source version of the product, then Alfresco suddenly gets a lot less interesting. These are pretty much part of the definition of content management. Heck, even WordPress has 'em. Leaving them out makes the whole "Open Source" thing feel like little more than a marketing gimmick.

If you want to charge for clustering, well and good. If you want to charge for add-ons, fine. But don't charge for components that are considered part of your product definition and call that product "Open Source." That's misleading and will just irritate potential customers, not to mention potential Open Source partner projects. If you must go this way, then call the whole thing "visible source" or "community source" or whatever and be done with it.

Re: Have you really removed security from the opensource version

rdanner — Wed, 02 Nov 2005 01:21:07 GMT

Alfresco provides deep hooks for security. By deep I mean fine grained. The capability is there. The switch is not on. This is the first point. Alfresco has what many other OS products do not.

The second point is: Alfresco has to make money but where does the Vertical start.

I think this is a question that is in active debate at alfresco and very obviously on this forum.

I donÃ¢â‚¬â„¢t know what the people at alfresco will do with security and I have already gave by hot air on that so I will spare the expense of further bits on the subject but I think it's important to say…

The capability in terms of the software exists. This is huge. Even larger then that is that this community exists and the alfresco folks are engaged Balance is not achieved through a single stroke of the pendulum (by nature.)

I used to have anxiety over this issue. I am at the point where I can say for myself I think the community (alfresco organization) included will find the balance in the issue.

I'd type more on the subject but I have to add a few users to a couple spaces because I can't just add a group.

Re: Have you really removed security from the opensource version

andy — Wed, 02 Nov 2005 10:11:02 GMT

Hi

First, the API for a Permission Service with object level APIs is defined in the open world, like the AuthenticationService and soon the AuthorityService for groups etc.

Anyway, we have the opportunity to see someone build a better rights management interface with the open-source version.

If there are any comments and suggestions about the PermissionService or any other API then let us know.

The open permission service currently enforces nothing. What the open version should be and its compatibility with other permission services (including external systems for storing ACLs, as well as our own) is under active discussion. The open authentication is fairly simple and does not offer single sign on via NTLM or LDAP for example.

Regards

Andy

Re: Have you really removed security from the opensource version

lgr — Wed, 02 Nov 2005 11:19:49 GMT

The open permission service currently enforces nothing. What the open version should be and its compatibility with other permission services (including external systems for storing ACLs, as well as our own) is under active discussion. The open authentication is fairly simple and does not offer single sign on via NTLM or LDAP for example.

And i totally agree that LDAP or NTLM SSO support can be removed from the open-source version.

I'll be impatient to hear more information about the open version compatibility with other permission services …

Best regards,

Laurent.

Re: Have you really removed security from the opensource version

janiner — Wed, 02 Nov 2005 17:33:10 GMT

In my opinion, the free version needs to be usable by two audiences - those who want to check out the product before committing to pay for it, and those who cannot afford to pay (non-profits are a good example). Of course there will be plenty who will use it who could pay and will not, but that's a marketing expense; the more people using the free version the more exposure it's name will get and the more paid users it will attract. As I'm sure you know, big companies tend to be hesitant to use software no-one has ever heard of, so the more buzz you can generate the better.

Therefore, in order to provide something of basic usefullness to those folks, a decent permissions system is a must. It doesn't have to support LDAP or anything fancy/corporate, but it does need to allow them to use the product's basic CM capabilities in a real world environment with real users and real security needs.

If the product does not have that, then it is basically a toy, unsuitable for production use, and might lead the cynical among us to think that the only reason it is "open source" is to jump on the bandwagon and get some extra press. That might give you some short-term visibility, but building a community of folks who actualy use the product is IMHO the only way to keep it going long-term and become a name that CTOs recognize and will support.

Re: Have you really removed security from the opensource version

andy8080 — Fri, 04 Nov 2005 05:02:30 GMT

I have to agree with other posters - the lack of security is a problem.

Alfresco is promoted as an "Open Source Enterprise Content Management Solution", but this simply isnt true. Without the basic security implementation, I could not even recomend it for a small business, let alone an "enterprise".

Yes the "Professional" and "Enterprise" versions have this - but they are not Open Source.

While I respect what Alfresco has done - it's a great step forward (and very nicely built), I think the advertising/promotion is misleading - please dont call something Open Source *and* Enterprise ready when it clearly is not.

Re: Have you really removed security from the opensource version

rdanner — Fri, 04 Nov 2005 05:06:48 GMT

The open permission service currently enforces nothing. What the open version should be and its compatibility with other permission services (including external systems for storing ACLs, as well as our own) is under active discussion

This is pretty well covered as a sore spot. Any other issues or things that folks consider to be basic functionality that is missing to the point where the product is rendered a toy?

Re: Have you really removed security from the opensource version

janiner — Sun, 06 Nov 2005 07:36:53 GMT

This is pretty well covered as a sore spot. Any other issues or things that folks consider to be basic functionality that is missing to the point where the product is rendered a toy?

Nothing is jumping out at me in the current version (though I haven't done much with it yet) but I have looked at the Roadmap and the "hot backup" tools look to me like another thing that should be included in all versions.

Keeping in mind that non-profit user I mentioned earlier, I believe that the free version should include all the pieces that user would need. It's reasonable to charge for something like LDAP because, generally speaking, an organization large enough to need it is large enough to pay for it. But hot backups are about reducing downtime and that can be critical to users of any size.

Re: Have you really removed security from the opensource version

rdanner — Sun, 06 Nov 2005 16:20:04 GMT

This is pretty well covered as a sore spot. Any other issues or things that folks consider to be basic functionality that is missing to the point where the product is rendered a toy?

Nothing is jumping out at me in the current version (though I haven't done much with it yet) but I have looked at the Roadmap and the "hot backup" tools look to me like another thing that should be included in all versions.

Keeping in mind that non-profit user I mentioned earlier, I believe that the free version should include all the pieces that user would need. It's reasonable to charge for something like LDAP because, generally speaking, an organization large enough to need it is large enough to pay for it. But hot backups are about reducing downtime and that can be critical to users of any size.

What about your wish list? What would the perfect CMS have that you dont see out there or that you don't see in Alfresco? Regardless of licensing.

Re: Have you really removed security from the opensource version

janiner — Sun, 06 Nov 2005 18:43:44 GMT

What about your wish list? What would the perfect CMS have that you dont see out there or that you don't see in Alfresco? Regardless of licensing.

I really haven't spent enough time evaluating it to be sure. More documentation is always helpful, of course.

The current templating guide says "Currently we have not exposed the templating features much in the most recent version of the web-client (RC1b). The potential for the future is huge, templates could be used to generate whole web-sites or customise existing views and spaces etc."

I would like to know more about what is coming, as this is an important area for me, and if any of it will be restricted to the pay versions, but there is no mention of templating in the Roadmap (or I missed it).

Edited to add:

Another thing that would be very helpful is a section on the Wiki with links to learning resources. Maybe one section for "here's what you need to read and understand in order to be a power Alfresco user" and another for what you need to know to be an effective developer. I am coming at this from a completely non-Java background and at times I start to get overwhelmed by all the things I don't know. Not Java itself, that is relatively easy to read, but all of the other products and pieces that are incorporated into Alfresco.

For example, in order to get the most out of the Template Guide I need to know at least a little about JSF, JSP and FreeMarker, plus I need to know a lot more about how objects are handled in Alfresco than I currently do.

I don't expect anyone to teach me this stuff, but an assemblage of links recommended by those who are ahead of me on the learning curve would help a lot, and I expect I'm not the only one who would benefit from this. Extra credit given if the links are listed in the order in which it would be best to read them, since many times one piece of knowledge builds on another, but that's not obvious until you're deep into it.

Re: Have you really removed security from the opensource version

kevinr — Tue, 08 Nov 2005 16:52:10 GMT

The current templating guide says "Currently we have not exposed the templating features much in the most recent version of the web-client (RC1b). The potential for the future is huge, templates could be used to generate whole web-sites or customise existing views and spaces etc."

I would like to know more about what is coming, as this is an important area for me, and if any of it will be restricted to the pay versions, but there is no mention of templating in the Roadmap (or I missed it).

The templating features in 1.0 are currently exposed as a UI Component, and therefore can only really be seen in a limited light in the current web-client. This week I have just finished moving the templating system down into the Repository as a service. This means templating can now be accessed through the Alfresco API like any other public service. This opens it up to be used in features such as Actions, Rules and as part of custom applications etc. The new TemplateService will be available in the nightly-build from tonight (we are restarting nightly-build source drops from this evening I believe). In the future we also intend to expose templating more in the web-client, building pages such as "dashboards" or similar that are basically constructed from customisable templates.

Templates features will never be part of the "pay" version! We will only ever more features "down" from pay to Open Source - never the other way around

Cheers,

Kevin

Re: Have you really removed security from the opensource version

gavinc — Wed, 09 Nov 2005 14:07:16 GMT

If you were interested in the nightly build to try out the TemplateService Kevin mentions it's now available here: http://www.alfresco.org/source_download_nightly.php

Re: Have you really removed security from the opensource version

steve — Tue, 06 Dec 2005 12:17:23 GMT

Hi,

V1.1 is now out that includes Permissions in the Open Source version.

Enjoy,

Steve