topic Re: Block permissions inheritance programatically in Nuxeo Forum

Block permissions inheritance programatically

bledii_ — Thu, 26 Sep 2013 09:11:07 GMT

Hello,

is it possible to block permission inheritance via API?

When we try by resetting the ACP it seems not to work, and still permissions are inherited.

Thank you

EDIT: my use case is the following:

i want to create a document (folder) inside a tree of other folders, but want only the creator and users from the admin group to have access on it

Re: Block permissions inheritance programatically

bruce_Grant — Fri, 27 Sep 2013 01:29:27 GMT

Don't know about the API, but you could create a listener for various document creation events (DOCUMENT_CREATED, DOCUMENT_CREATED_BY_COPY, DOCUMENT_DUPLICATED, etc.) and then remove inheritance and set default ACL.

Something like...

DocumentRef docRef = docModel.getRef();
ACP acp = this.session.getACP(docRef);
						
// delete existing 'local' ACL 
acp.removeACL(ACL.LOCAL_ACL);

// block inheritance
acp.getOrCreateACL().add(new ACE(SecurityConstants.EVERYONE, SecurityConstants.EVERYTHING, false));

// and then create the local ACL entries you do want
ACL acl = acp.getOrCreateACL(ACL.LOCAL_ACL);
... and then create desired ACEs ...
acl.add(new ACE("testgroup","Read", true));
acp.addACL(acl);
this.session.setACP(docRef, acp, true);

Re: Block permissions inheritance programatically

bledii_ — Mon, 30 Sep 2013 09:54:09 GMT

hello Bruce

Re: Block permissions inheritance programatically

bruce_Grant — Mon, 30 Sep 2013 14:20:04 GMT

I added lines to above example to create ACE and then save updated ACL to doc - is this what you tried?

Re: Block permissions inheritance programatically

bledii_ — Mon, 30 Sep 2013 15:07:14 GMT

hello bruce, thanks for the info,the main difference i can find is the override=true in setACP, will try that and get back to you with the result, thanks

Re: Block permissions inheritance programatically

bledii_ — Mon, 30 Sep 2013 15:34:45 GMT

hello bruce, it doesn't seem to work, unless we are doing something wrong.

Re: Block permissions inheritance programatically

bruce_Grant — Mon, 30 Sep 2013 15:37:32 GMT

The only other thing I can think is that I have this code running in a class that extends UnrestrictedSessionRunner so it has fully trusted status

Re: Block permissions inheritance programatically

bledii_ — Thu, 03 Oct 2013 11:02:56 GMT

bruce, i am going to accept your answer as it pointed me in the right direction, thank you

Re: Block permissions inheritance programatically

vieville_ — Fri, 04 Oct 2013 10:01:53 GMT

Hello,

Re: Block permissions inheritance programatically

Florent_Guillau — Fri, 04 Oct 2013 12:22:58 GMT

@vieville Automation is a different matter, please ask a new question.

Re: Block permissions inheritance programatically

Anurag_Kumar — Wed, 04 Nov 2015 13:54:17 GMT

Hey Bruce,