Hi All roles and permissions are defined in permissionDefinitions.xml inconfig/alfresco/model.I will go through the roles as they stand but bear in mind1) You may be inheriting permissions2) You may have permissions from the ALL group3) You may have permissions from being the owner4) And if you have groups you may have permissions becasue of group membership. See http://www.alfresco.org/mediawiki/index.php/Security_and_AuthenticationSo:
<!– ============================== –>
<!– Permissions for spaces/folders –>
<!– ============================== –>
<permissionSet type="cm:folder" expose="selected">
<!– Kept for backward compatibility - the folder administrator permission has –>
<!– been removed to aviod confusion –>
<permissionGroup name="Administrator" allowFullControl="true" expose="false" />
<!– A coordinator can do anything in the folder or its childeren unless the –>
<!– permissions are set not to inherit or permission is denied. –>
<permissionGroup name="Coordinator" allowFullControl="true" expose="true" />
<!– A contributor can create content and then they have full permission on what –>
<!– they have created - via the permissions assigned to the owner. –>
<permissionGroup name="Contributor" allowFullControl="false" expose="true" >
<!– Contributor is a guest who can add content, and then can modify via the –>
<!– owner permissions. –>
<includePermissionGroup permissionGroup="Guest" type="cm:folder"/>
<includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
<!– Check out requires write permissions so this will not apply to all –>
<!– documents. –>
<includePermissionGroup type="cm:lockable" permissionGroup="CheckOut"/>
</permissionGroup>
<!– An editor can read and write to anything in a space; they can not create –>
<!– new nodes. They can cehck out content into a space to which they have –>
<!– create permission. –>
<permissionGroup name="Editor" expose="true" allowFullControl="false" >
<includePermissionGroup type="cm:folder" permissionGroup="Guest"/>
<includePermissionGroup type="sys:base" permissionGroup="Write"/>
<includePermissionGroup type="cm:lockable" permissionGroup="CheckOut"/>
</permissionGroup>
<!– The guest permission allows read to everything by default. –>
<permissionGroup name="Guest" allowFullControl="false" expose="true" >
<includePermissionGroup permissionGroup="Read" type="sys:base" />
</permissionGroup>
</permissionSet>
To summarise:Guest can readEditor has all the permissions of Guest but can write properties and content. The editor can not create content. An editor can check out content - but the wolrking copy will have to be in a space to which they have create access e.g. their home space.Contributor has guest permissions + creation + check out of things they can write.They can not edit content they do not own. They get all permissions for the content they create - which by default they own. If they loose ownerhip they loose permissions ….unless you have explicitly given them permissions in some other way ….Coordinator can do anything in the space and sub-spaces which inherit permissions.I am not sure which permissions are used for approval check.You can change the definitions - they are read at start up.
I thought that if I was a guest, I shouldn't be able to add a space or create content. But what is more strange I can create a space, I can create content but I cannot add a content. Is this the case?
</code]
This sounds like you are also a contributor - this may be inherited …
I am not sure what add a content means - as opposed to create??
Regards
Andy
This is really helpful.
