[Resolved] - Unable to add/remove/change ACL on workspaces, sections and documents

freemann_ — Thu, 09 Feb 2023 07:49:05 GMT

Since my last post here on this subject which never resolved, I come back with another interesting one.

Since migration on LTS2021, the exception change and now I have this when I try to add/change or remove an ACL .

2023-02-09T08:43:07,765 WARN  [https-jsse-nio-0.0.0.0-8443-exec-6] [org.nuxeo.ecm.automation.core.trace.Trace] 

****** chain ******
Name: Document.RemovePermission
Exception: OperationException
Caught error: Failed to invoke operation Document.RemovePermission
Caused by: org.nuxeo.ecm.automation.OperationException: Failed to invoke operation Document.RemovePermission
****** Hierarchy calls ******
        org.nuxeo.ecm.automation.core.operations.document.RemovePermission

2023-02-09T08:43:07,766 ERROR [https-jsse-nio-0.0.0.0-8443-exec-6] [org.nuxeo.ecm.webengine.app.WebEngineExceptionMapper] org.nuxeo.ecm.core.api.NuxeoException: Failed to invoke operation: Document.RemovePermission
org.nuxeo.ecm.core.api.NuxeoException: Failed to invoke operation: Document.RemovePermission
        at org.nuxeo.ecm.automation.server.jaxrs.ExecutableResource.doPost(ExecutableResource.java:87) ~[nuxeo-automation-server-2021.19.10.jar:?]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:?]
        at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
        at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
....
Caused by: java.lang.IllegalArgumentException: Negative ACL not allowed: ACE(username=members, permission=CanAskForPublishing, isGranted=false, creator=null, begin=null, end=null)

Thanks for your help

Re: [Resolved] - Unable to add/remove/change ACL on workspaces, sections and documents

Konrad_Krenzlin — Thu, 09 Feb 2023 08:17:35 GMT

Your log shows a Negative ACL not allowed. Checking the source code this is due to a configuration that does not allow non-granting ACEs by default.

See https://doc.nuxeo.com/nxdoc/configuration-parameters-index-nuxeoconf/#nuxeosecurityallownegativeacl

Re: [Resolved] - Unable to add/remove/change ACL on workspaces, sections and documents

freemann_ — Thu, 09 Feb 2023 10:17:29 GMT

[Konrad Krenzlin](https

topic [Resolved] - Unable to add/remove/change ACL on workspaces, sections and documents in Nuxeo Forum

[Resolved] - Unable to add/remove/change ACL on workspaces, sections and documents

Re: [Resolved] - Unable to add/remove/change ACL on workspaces, sections and documents

Re: [Resolved] - Unable to add/remove/change ACL on workspaces, sections and documents