Access for External Clients to Alfresco ECM

[hm]

How does alf handle access and control to spaces and files for external clients? For example lets say we have the ECM set up for the company - this is fine and dandy. All users within the company can collaborate and share content etc. However let's say we want to have the companies various clients access certain spaces, how can this be controlled tightly without treating the external clients as comapny users with access to different spaces?

[derek]

Hi,

Andy has written a very thorough document around the security and authentication implementation: http://www.alfresco.org/mediawiki/index.php/Security_and_Authentication

I'll ask him to elaborate on this post when he returns from tomorrow.

Regards

[kevinr]

Hello,

If i understand correctly then yes this can be done with Alfresco.

If you change the default permissions on Home Spaces to private e.g. change the following line in web-client-config.xml:

<home-space-permission>Guest</home-space-permission>

to:

<home-space-permission></home-space-permission>

Then users cannot see ANY spaces created for new users unless they are specifically invited to them. You can also remove GUEST access from the existing home spaces by removing it in the Manage Space Users screen for those spaces (e.g. ones that been created before make the config change as above).

Currently all users have access the Company Home space, but obviously you don't have to put anything in there - or only create Spaces that your internal users can see, so they won't appear to other users.

Thanks,

Kevin

[andy]

Hi

This depends on what you require.

If it is "all external clients get the same access" then guest would support this (in version 1.2). You would then explicitly assign permissions to guest. This would let in everyone as guest.

If different companies require different access to the spaces, or you do not want general guest access, then there must be some form of identifiction and authentication. For this I would recommend individual authentication and a group for each external company. Then assign permissions to the company groups. You could have one identity/authentication per external company if you want.

Is there some other way that you have to identify external users and their companies? If so, you could have a custom authentication mechanism to set this identitiy.

Regards

Andy