Complex Security Requirements

[ukdavo]

I would like to develop/configure a fairly complex security model. Documents would be added to Alfresco with a bunch of business related metadata (e.g. project, document type, partner, contract, product, etc). Access to the documents would be dependant on the value of the document properties and the users membership of one or more groups. I don't think that the standard Alfresco security model (i.e. groups/users, ACLs, etc) would accommodate this but I could be wrong. For example, access to a document may be granted to users that are members of group_a and group_b and group_c ('and' not 'or'). Can anyone suggest a possible approach to this?

Thanks

[mrogers]

You are right that normally group access will be group_a or group_b or group_c.   However the alfresco security model is very flexible and can be configured and extended.

You are going to need to do some digging…  

Although just a thought … would it be possible to simplify the problem by creating a group (group_abc) containing the intersection of group_a, group_b and group_c.   And then using the standard permission model on that group.

[nick_l]

It is an old post though.

I have similar problem. If we simply creating group_abc, it can lead to composition explosion. For example, there are 1000 groups like group a, 1000 groups like group b and 1000 groups like group c. The worst case, the composition groups like group_abc would be 1000*1000*1000. 

[mrogers]

Yes clearly that would be a problem, my suggestion above was a possible work-around.   However since I wrote that first reply alfresco's permission model has gained "deny" and other stuff like property driven security for R.M.   Although not easy I do think an "And" is do-able.   

[nick_l]

Thanks Rogers
Can you be more explicit about property driven security?

[mikemars]

I'd suggest that you take a look at using Dynamic Authorities. There are examples in the Alfresco source such as LockOwnerDynamicAuthority.java

As the term suggests, these dynamically determine if a user should have access.

You will need to extend AbstractLifecycleBean and implement DynamicAuthority.

When defining your Dynamic Authority override the hasAuthority() method which you can use to determine if the user satisfies the required criteria, in your case checking the custom properties e.t.c

You can also override the getAuthority() method which determines the access the user should have, such as consumer, editor e.t.c