Permissions in alfresco vs share

[cybertoast]

I don't understand how /share and /alfresco permissions interact. I've got a case where I want to have a admin group be able to have full access to all /share sites. I created a site (SiteA) as a user (userB) in /share. I then go to /alfresco as admin and invite a specific group (groupA) with Site Manager rights to SiteA. groupA has user userA. When I log in as userA I would expect to have Site Manager permissions on SiteA. But when I look at userB's permissions on SiteA, they only have Consumer rights (which they had from before). Since membership and permissions seems to be via an Invite model, does this Site Manager invite have to be accepted by userB first? And if so, how is that managed - i.e., I don't have a pending invite as userB in /share which I can accept.

Basically the question is how to change user's roles on sites through an administrative interface so that the end user does not have to think about it.

Thanks

[gronfelt]

I'm not sure I understand your example correctly, perhaps there´s some mixup between usernames in it? If you use userB to create a site, that would make userB Site Manager, not consumer.

However, I'll try to provide some answers anyway:

Inviting users in the Explorer interface (/alfresco) doesn't actually make them a member of the Site, it only overrides document permissions. Site membership levels are normally set in Share, you could then override the permissions on specific documents or folders by inviting users to another level in the Explorer interface.

One example:
I normally set my users as Collaborators in Share. However, this means that they cannot remove documents owned by another user, only the Site Manager could to this. Since I wan't them to be able to do this, I invite the users as Coordinators (which corresponds to Site Manager when it comes to document permissions) in the documentLibrary space in Explorer. Now the users have full permissions on all documents and folders, but they are not Site Managers, so they can not perform Share specific actions like reconfiguring the Site.

For your final question, you could use a simple javascript in Explorer to change user's roles in Share:

var site = siteService.getSite("sitename");
site.setMembership("username", "siteManager")‍‍

Put it in Data Dictionary > Scripts (with the extension .js) and run it by selecting Run Action on the Document Details page for any document (it doesn't matter which file, since you're not doing anything to the document itself).

[cybertoast]

Thanks much gronfelt.

[sheahen]

I am interested in this issue as well.  While experimenting with /Alfresco and /Share, I deleted a user that had been the site manager for a site.  It then seemed impossible to give anyone site manager permissions once this was done, even though the site was still there.  I tried the script you posted from an admin user, but still got an error - is it possible to designate a site manager from an admin script if the admin is not a site manager?  Or could the site be copied with new permissions perhaps?  Or maybe I just ran the script wrong…I replaced "sitename" with the site name and "username" with the user name I wanted to make site manager.

Here was the error:
Failed to run Actions due to error: 00290020 Failed to execute script 'workspace://SpacesStore/ce47dab8-2017-471f-9fa3-f18bb5dc1741': 00290019 An authority was not found for GROUP_site_IntranetDesign_siteManager

My concern is that I want to be able to over-ride and fix problems like this from admin if an employee leaves or botches his/her settings.  I appreciate very much any insight you can give!

[cybertoast]

It seems like if you log in as an admin user you can take ownership of the site. Then you can assign permissions to whatever you want on the site. At least this working in my one experiment.

[gronfelt]

I am interested in this issue as well.  While experimenting with /Alfresco and /Share, I deleted a user that had been the site manager for a site.  It then seemed impossible to give anyone site manager permissions once this was done, even though the site was still there.  I tried the script you posted from an admin user, but still got an error - is it possible to designate a site manager from an admin script if the admin is not a site manager?  Or could the site be copied with new permissions perhaps?  Or maybe I just ran the script wrong…I replaced "sitename" with the site name and "username" with the user name I wanted to make site manager.

Here was the error:
Failed to run Actions due to error: 00290020 Failed to execute script 'workspace://SpacesStore/ce47dab8-2017-471f-9fa3-f18bb5dc1741': 00290019 An authority was not found for GROUP_site_IntranetDesign_siteManager

My concern is that I want to be able to over-ride and fix problems like this from admin if an employee leaves or botches his/her settings.  I appreciate very much any insight you can give!

I've recently run in to the same problem, which is kind of odd, because I've not had any problems with this before. I don't know if it's related to a specific site or if it's an issue with 3.2r2, which I recently upgraded to.

[tommorris]

Have you tried upper-casing the first letter?
I noticed that I have to exectute (in 3.2.0e): site.setMembership("username", "SiteManager")
rather than: site.setMembership("username", "siteManager")
my full group names seem to refelect this also.