Possibility to disable 'Inherit Parent Space Perm'

robses — Fri, 01 Jun 2007 09:54:43 GMT

Is it possible to create a role similar to Coordinator but without the possibility to adjust the setting "Inherit Parent Space Permissions" of a space. We want our coordinators to manage the space users themself, but not allow them to enable the "Inherit Parent Space Permissions" setting. This will

Re: Possibility to disable 'Inherit Parent Space Perm'

andy — Wed, 06 Jun 2007 13:57:42 GMT

Hi

At the moment, the authorisation layer allows you to set permissions or not.

It would be possible to have different requirements around the methods on the PermissionService API that would do what you want. In public-services-security-context.xml you would need to do over ride …


<bean id="PermissionService_security" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor">
        <property name="authenticationManager"><ref bean="authenticationManager"/></property>
        <property name="accessDecisionManager"><ref local="accessDecisionManager"/></property>
        <property name="afterInvocationManager"><ref local="afterInvocationManager"/></property>
        <property name="objectDefinitionSource">
            <value>
                org.alfresco.service.cmr.security.PermissionService.getOwnerAuthority=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.getAllAuthorities=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.getAllPermission=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.getPermissions=ACL_NODE.0.sys:base.ReadPermissions
                org.alfresco.service.cmr.security.PermissionService.getAllSetPermissions=ACL_NODE.0.sys:base.ReadPermissions
                org.alfresco.service.cmr.security.PermissionService.getSettablePermissions=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.hasPermission=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.deletePermissions=ACL_NODE.0.sys:base.ChangePermissions
                org.alfresco.service.cmr.security.PermissionService.deletePermission=ACL_NODE.0.sys:base.ChangePermissions
                org.alfresco.service.cmr.security.PermissionService.setPermission=ACL_NODE.0.sys:base.ChangePermissions
                org.alfresco.service.cmr.security.PermissionService.setInheritParentPermissions=ACL_METHOD.ROLE_ADMINISTRATOR
                org.alfresco.service.cmr.security.PermissionService.getInheritParentPermissions=ACL_ALLOW
                org.alfresco.service.cmr.security.PermissionService.clearPermission=ACL_NODE.0.sys:base.ChangePermissions
            </value>
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Then only admins can muck around with inheritance. Non admins will get an ugly error on trying to set this via the UI as it would not protect this….

If this is not enough then you need to read about dynamic authorities and start creating more permissions around the PermissionService.

Cheers

Andy

Re: Possibility to disable 'Inherit Parent Space Perm'

robses — Mon, 25 Jun 2007 16:48:58 GMT

My apologies for the late reply, thank you for the proposed solution. I will add this to our setup, having a error thrown in the UI is no problem, the main thing is that the workspace stay protected.

Regards Rob

topic Re: Possibility to disable 'Inherit Parent Space Perm' in Alfresco Archive

Possibility to disable 'Inherit Parent Space Perm'

Re: Possibility to disable 'Inherit Parent Space Perm'

Re: Possibility to disable 'Inherit Parent Space Perm'