Access Denied

[chicco0386]

Hi,
I've this schema:

3 users:
Pinco
Ciccio
Gigi

1 group with 3 sub-groups:
AZIENDA:
–>Redattori (User: Pinco)
–>Verificatori (User: Ciccio)
–>Approvatori (User: Gigi)

SPACES:
AZIENDA (Spaces Users: AZIENDA Coordinator)
–>Workflow (Spaces Users:  Inherit Parent Space Permissions)
–>–>In redazione (Spaces Users: Redattori Collaborator)
–>–>Da verificare (Spaces Users: Verificatori Collaborator)

And I've started a simple workflow, where one of its steps is:
When INBOUND: The document will be moved to 'Da verificare' if the 'Chiedi verifica' action is taken.

I've configured all this actions whit admin users…

Now when I logged in with user Pinco and I do the action 'Chiedi verifica' in a content into "In redazione" I've this message error:
[size=100]
Failed to approve the document due to system error: Access Denied. You do not have the appropriate permissions to perform this operation.[/size]

I use Alfresco 3.1 LABS Stable for linux…

HELP ME PLEASE
ops:  ops:  :?: 

THANKS

[jayjayecl]

Pinco needs WriteChildren permission in folder "Da verificare" , in order to let this document to be moved into this very space.
You did not tell whether the following spaces does inherit parent space permissions :

–>–>In redazione (Spaces Users: Redattori Collaborator)
–>–>Da verificare (Spaces Users: Verificatori Collaborator)

[chicco0386]

Pinco needs WriteChildren permission in folder "Da verificare" , in order to let this document to be moved into this very space.
You did not tell whether the following spaces does inherit parent space permissions :

–>–>In redazione (Spaces Users: Redattori Collaborator)
–>–>Da verificare (Spaces Users: Verificatori Collaborator)

Thanks for the quickly response…
But I don't understand how I can set the  WriteChildren permission in folder "Da verificare" ?

PLEASE HELP ME
THANKS

[chicco0386]

I've SOLVED the problem:

1) "In redazione" –> User: Redattore –> Collaborator
2) "Da verificare" –> User: Redattore –> Contributor

So I can have the Write permission on the space "Da verificare"…

OK…

But with the Contributor permission into "Da verificare", the Redattore user can add contents…and I don't want this…

HOW CAN I DO?
I have to edit some XML configuration file?

[viralshah]

We are facing the same issue, not able to understand why the user needs coordinator role in the space where the content is to be moved after he has approved from his space. Should not the system be actually moving the content to next space based on workflow ?

By making the user a coordinator in next space, the security is compromized as he can now add content to the space, where as his job was to just review content created by others and pass it on for approval.

[jayjayecl]

The fact is that the action of moving the document will be called with the permission context of the user of the workflow.
In order to  change that, you'll have to fork the workflow in order to call for "authenticationComponent.setSystemUserAsCurrentUser()" to be able to do the action… and then clear the securityContext