Permissions, Groups and Roles

[pvaibhav]

I looked at the permissions model in WIKI. What is not clear is how Groups and Roles come in the picture.

My Idea of permission was very simple - There are set of users and there are set of permissions. Any subset of permissions can be applied to any user or set of users. Every permission has a predefined behavior - or every permission has set of associated allowed actions.

I think Alfresco has the same concept. But Can any body explain how Groups and Roles intermigle with Permissions in Alfresco?

Vaibhav

[andy]

Hi

You can assign permissions to groups and roles in exactly the same way as permissions can be assigned to users. The permisson applies to the group. The membership of groups and roles is now encapsulated in the AuthenticationService (to get the static groups and roles of the current authenticated user). If group membership changes this may affect a users permissions.

I have a habbit of calling username, groups and role authorities in the acegi way.

Actions on services may be configured to require certain permissions, role membership etc.

I hope this answers your question.

Regards

Andy

[renga]

I do have a follow-up question on the same context.

My requirement is, i want to have role/permission which can only move content from home space to other space.  If i chose to give Write permission it is allowing the Add/Create content , which i don't want to give.

Any help on this lines?

Thanks.

[andy]

Hi

You would have create a move permission and protect the appropriate move methods in the public-services-security-context.xml. You should assign this MOVE permission to your own own permission group (like editor). The pattern should be clear from the configuration files.

Regards

Andy

[gnewtonaus]

Hi,

I have a fresh install of Alfresco (2.0.0 build 185) and I'm trying to set up a read-only situation for a group of users - one would think a fairly simple thing to do.

I've created a person who is a member of GROUP_EVERYONE (a default group?) which I've given the role Consumer on the Company Home space. Consumer appears to be the lowest level of permissions?

When I login as the new user and go into the space I'm still getting the two menu's at the top as follows:-

Create
- Content
- Space
- Advanced Space Wizard

More Actions
- Cut
- Paste All
- Manage Space…
- Manage Content Rules..

and alongside each item…
Actions
- Copy
- Start Advanced Workflow

A read-only user shouldn't be able to any of these things. I want to turn them off!

I've spent a couple hours going through the wiki and forums etc.. and I can't find a simple answer, only complex answers that don't even seem to address this? We have an Enterprise support license but I don't know how to get support apart from here.

Any help would be most appreciated.

Regards,
Greg Newton
Sydney, Australia

[andy]

Hi

Check inherited permissions and check who owns the folder. Both these routes can give additional access to that specificially set on the node. Does the user have admin rights?

Andy

[einreb301986]

Hi, I have my on post regarding adding permissions using web scripts. You can visit my blog, but its not yet finish..haha… Will update it soon

http://anythingalfresco.wordpress.com/2010/02/05/adding-alfresco-permissions-using-webscripts/

@gnewtonaus
By default, GROUP_EVERYONE has a Consumer Role assigned to it in any space. If you created a new user and use Company Home as its Home Page and not User homes, then you will be getting those kinds of menus activated.

[kishorevreddy]

I need to send out an invite to 1000+ users. I am currenlty working on ver 4.2. Pls let know how can I send a bulk invite to all these users at one go.

Also, how to set default permission as Consumer for all these users.