Custom role visible in Alfresco Explorer

[lista]

Hi all,

I'm trying to add a custom role.

Now, what one needs to do to get this to work is to edit the permissionDefinitions.xml file with your own custom role, and to edit the webclient.properties file for that new custom role (this part makes the role visible in Alfresco Explorer). That's all fine too and appears to work, but the fun part starts now.

We all know about the Consumer role.
It looks like this:

<!– The Consumer permission allows read to everything by default.                  –>
<permissionGroup name="Consumer" allowFullControl="false" expose="true" >
<includePermissionGroup permissionGroup="Read" type="sys:base" />
</permissionGroup>
‍‍‍‍‍‍

Read permissionGroup in return looks like this:

<permissionGroup name="Read"  expose="true" allowFullControl="false">
<includePermissionGroup type="sys:base" permissionGroup="ReadProperties"/>
<includePermissionGroup type="sys:base" permissionGroup="ReadChildren"/>
<includePermissionGroup type="sys:base" permissionGroup="ReadContent"/>
</permissionGroup>
‍‍‍‍‍‍‍

Now, if I define my custom role and just make it extend the Consumer one, everything works, like this:

<permissionGroup name="MyCustomRole" allowFullControl="false" expose="true" >
<includePermissionGroup permissionGroup="Consumer" type="cm:cmobject"/>
</permissionGroup>
‍‍‍‍‍

If I define my custom role like this, everything still works (just replaced the Consumer role with what it's built with, Read permissionGroup:

<permissionGroup name="MyCustomRole" allowFullControl="false" expose="true" >
<includePermissionGroup permissionGroup="Read" type="sys:base" />
</permissionGroup>
‍‍‍‍‍

Finally, and most importantly, if I define my custom role like this (replacing Read permission groups with it's permissionGroups, the role breaks. Meaning, it simply does not work, read permissions are not there.

<permissionGroup name="MyCustomRole"  expose="true" allowFullControl="false">
<includePermissionGroup type="sys:base" permissionGroup="ReadProperties"/>
<includePermissionGroup type="sys:base" permissionGroup="ReadChildren"/>
<includePermissionGroup type="sys:base" permissionGroup="ReadContent"/>
</permissionGroup>
‍‍‍‍‍‍‍

My question is, am I missing something here? Has someone encountered this one before, maybe worked around it?
Thanks!

[afaust]

Hello,

first of all, which Alfresco version are you using for your development?
Starting with Alfresco 4.0 and the introduction of SOLR, some permission checks (especially those performed on SOLR using indexed ACLs) are based on the "getReaders" method of the permission service, which uses a modified "Read" permission check (as far as I know without using implied permissions as would required in your case) to determine who can access the specific node.
To my knowledge, this way of permission checking is mostly limited to filtering of result sets retrieved by SearchService.query and mostly in the SOLR use-case. Since I do not know the usage pattern that you used to determine that your permission group was not working, it is hard to say if this is what does affect you.
Generally, I do not yet understand your reason(s) for replacing the "Read" with the granular permissions in your custom role. As long as you don't plan to provide only a subset of these permissions, I'd advise to use "Read" instead.

Regards
Axel

[lista]

Hi,

thank you for your answer.

It's 3.4, Lucene. Replacing the "Read" with granular permissions was just a method to see where things stop working, since my custom role with granular permissions did not function. So I replaced granular permissions with "Consumer" role - it worked, I replaced "Consumer" role with "Read" permissions - it worked, I replaced "Read" permission with granular ones - it stopped working.

So I just tried to see whether I was missing a piece, somewhere.
I'll be sure to post solution as soon as I find it.