Exclusive permissions?

[jooray]

Hello,


  is it possible to use some kind of "exclusive" permissions, i.e. specifically denying someone (or some group) access to space? For example I have a department group and I want everyone but one person from that group being able to access that space. I could create another group of people that does not include the specific person, but that does not scale well (if someone else comes to that particular department, I need to edit that group). In this specific example I could create a group without that person and have department group inherit from that one and adding this person, but this does help this specific case only and not in general.

  Are Alfresco permissions inclusive only?

  Thank you,

    Juraj.

[lotharm]

Hi,

yes, Alfresco permissions are additive. There is a deny flag buried in the database, but it is not accessible through the UI, nor it is clear how it should work. Perhaps the Alfresco
developers could explain it?

One way to work around this is removing the inheritance flag and set explicit permissions.

Regards,
  lothar

[andy]

Hi

There is deny.

By default we have "any allow" allows.
So deny is really aprtial block of inheritance.

Andy deny denies is in the code .
It has not been tested as much and I do not recall if there is simple config to switch modes.

The UI does not expose deny. The Java API does.

Andy