As an answer to the very first question: Unfortunately, it is impossible to restrict permissions to a type or an aspect only through configuration.But the good news is that you can implement a workaround using a dynamic authority, which has the following steps:1. Define a dynamic authority class which checks for the presence of the type or the aspect2. Register the class in the public-services-security-context.xml as an additional dynamic authority3. Extend your permissionDefinitions.xml file with the additional permission.Let's look at the steps in detail, and I wrap up from behind:3. In permissionDefinitions.xml:- Add a basic permissionSet "Perm" and an extended permissionSet "Perm_ext" as follows
<permissionGroup name="Perm" allowFullControl="false" expose="false">
<includePermissionGroup permissionGroup="Read" type="sys:base" />
</permissionGroup>
<permissionGroup name="Perm_ext" allowFullControl="false" expose="false">
<includePermissionGroup permissionGroup="Write" type="sys:base" />
</permissionGroup>
- Also make sure you link the extended set to a role through a global permission
<globalPermission permission="Perm_ext" authority="ROLE_EXT" />
1. Write your DynamicAuthority class. Below is a generic one for types, but the trick works in other settings as well
package org.alfresco.module.mymodule;
import * /* you have to do it yourself */
public class GenericTypeBasedDynamicAuthority implements DynamicAuthority {
private NodeService nodeService;
private PermissionsDaoComponent permissionsDaoComponent;
private AuthorityService authorityService;
// Deduced values
private PermissionReference basePermission;
private List<QName> applicableTypes = new ArrayList<QName>();
private String authority;
@Override
public String getAuthority() {
return authority;
}
@Override
public boolean hasAuthority(NodeRef nodeRef, String userName) {
AccessStatus state = hasBasePermission(nodeRef, userName);
return (applicableTypes.contains(nodeService.getType(nodeRef)) && (state == AccessStatus.ALLOWED));
}
@Override
public Set<PermissionReference> requiredFor() {
return null;
}
public void setNodeService(NodeService nodeService) {
this.nodeService = nodeService;
}
public NodeService getNodeService() {
return nodeService;
}
public void setPermissionsDaoComponent(PermissionsDaoComponent permissionsDaoComponent) {
this.permissionsDaoComponent = permissionsDaoComponent;
}
public PermissionsDaoComponent getPermissionsDaoComponent() {
return permissionsDaoComponent;
}
public void setAuthorityService(AuthorityService authorityService) {
this.authorityService = authorityService;
}
public AuthorityService getAuthorityService() {
return authorityService;
}
public void setAuthority(String authority) {
this.authority = authority;
}
public void setTypes(List<String> types) {
this.applicableTypes.clear();
for (String type : types) {
this.applicableTypes.add(QName.createQName(MyModel.NAMESPACE, type));
}
}
public List<String> getTypes() {
List<String> result = new ArrayList<String>();
for (QName qname : applicableTypes) {
result.add(qname.getLocalName());
}
return result;
}
public void setBaseRole(String role) {
this.basePermission = SimplePermissionReference.getPermissionReference(ContentModel.TYPE_CMOBJECT, role);
}
public String getBaseRole() {
return basePermission.getName();
}
private AccessStatus hasBasePermission(NodeRef nodeRef, String userName) {
NodePermissionEntry nodePermissions = permissionsDaoComponent.getPermissions(nodeRef);
List<? extends PermissionEntry> permEntries = nodePermissions.getPermissionEntries();
Set<String> auths = getAuthorityService().getAuthorities();
auths.add(userName);
for (PermissionEntry permEntry : permEntries) {
if (permEntry.getPermissionReference().equals(basePermission) &&
auths.contains(permEntry.getAuthority()) &&
permEntry.getAccessStatus() == AccessStatus.ALLOWED) {
return AccessStatus.ALLOWED;
}
}
return AccessStatus.DENIED;
}
}
So, now the stage is set for the last configuration: the public-service-security-context.xml. Here's the excerpt:
<bean id="permissionServiceImpl" class="org.alfresco.repo.security.permissions.impl.PermissionServiceImpl">
<property name="nodeService">
<ref bean="mtAwareNodeService" />
</property>
<property name="tenantService">
<ref bean="tenantService"/>
</property>
<property name="dictionaryService">
<ref bean="dictionaryService" />
</property>
<property name="permissionsDaoComponent">
<ref bean="permissionsDaoComponent" />
</property>
<property name="modelDAO">
<ref bean="permissionsModelDAO" />
</property>
<property name="authorityService">
<ref bean="authorityService" />
</property>
<property name="accessCache">
<ref bean="permissionsAccessCache" />
</property>
<property name="policyComponent">
<ref bean="policyComponent" />
</property>
<property name="aclDaoComponent">
<ref bean="aclDaoComponent" />
</property>
<property name="dynamicAuthorities">
<list>
<ref bean="ownerDynamicAuthority" />
<ref bean="lockOwnerDynamicAuthority" />
<!– dynamic authorities for roles on types –>
<ref bean="myDynamicAuthority" />
</list>
</property>
</bean>
<bean id="myDynamicAuthority" class="org.alfresco.module.mymodule.GenericTypeBasedDynamicAuthority">
<property name="nodeService">
<ref bean="nodeService"/>
</property>
<property name="permissionsDaoComponent">
<ref bean="permissionsDaoComponent" />
</property>
<property name="authorityService">
<ref bean="authorityService" />
</property>
<property name="authority">
<value>ROLE_EXT</value>
</property>
<property name="baseRole">
<value>Perm</value>
</property>
<property name="types">
<list>
<value>yourType</value>
</list>
</property>
</bean>
Above "yourType" is the type you want to extend your permissions on.I hope this helps! Happy hacking :lol:
ost type (create permission) but I suspect you'd also have to enable create children permission on fm:topic too.
