Property or tag-level security

[zulu]

Hi Alfresco community,

I'm in the process of evaluating Alfresco as a DM component that we may migrate our existing systems towards.  I'll have a few questions as I go forward and it looks this is the place to ask them.  If there's a better forum or place, please let me know, and thanks in advance for your help.

In looking at the security and authentication page, it looks like there is support for repository-wide and node-level security.  Is there any way to provide finer-grained security, such as at the property level?  Ideal case would be someone with a higher clearance seeing all the properties for a given document, while someone with a lower clearance only sees a subset of those properties. 

Also curious if this can be done at a tag level (for instance, applying a 'foo' tag on documents, irrespective of their location, alters the permissions for given users).

I see the security model is extensible, but I haven't looked far enough into that yet.  Apologies if the answer is in there already.

best regards,
Chuck

[jpotts]

No, you cannot do field-level security out-of-the-box.

On the tag question, yes, you can alter permissions based on a tag change. You'd implement this either with a rule action, which would be configured on a folder and optionally its sub-folders, or with a behavior, which is what I'd suspect you'd want, because behaviors can be bound to policies that fire at a lower level than rules. You'd essentially write a Java class that would watch for tag changes and when one happens, you'd adjust the ACLs appropriately.

Jeff

[zulu]

Thanks Jeff, I appreciate the quick response.  The property part would be nice but is not essential.  The tag change trigger sounds like it will work for what I have in mind.

Chuck