Workflows add permission

[ribz33]

Hi,

i want that a user can valid document. This user must have only Read access on content.
When user valid or reject document, status property change.

This is my task :

<task-node name="ValidationTask">
  <transition name="reject" to="end">
    <action class="org.alfresco.repo.workflow.jbpm.AlfrescoJavaScript">
      <variable name="bpm_package" access="read,write" />
      <expression>
        bpm_package.children[0].properties["custom:status"]= "Draft";
        bpm_package.children[0].save();
      </expression>
    </action>
  </transition>
</task-node>
‍‍‍‍‍‍‍‍‍‍‍‍‍

I have error Access denied.
I thinked that if i give access read,write on bpm_package this will be enough to save my content but answer seems to be no !

Someone have an idea how i can solve this ?

[ribz33]

Nobody have an idea ?

To make it simple my question is just :

How to change a content propriety in a workflow when user don't have WriteProperties permission ?

[vladimir_kovaly]

I have the same question in the same situation.
There has been the registered issue for ages:
http://issues.alfresco.com/browse/AR-1142
Vote for it.

[vladimir_kovaly]

I'd propose to add extra parameter to AlfrescoJavaScript action configuration ("run-as" for instance), that would be used to impersonate identity which would run the script.

[ribz33]

I did a class to execute workflow scripts as system user.

Take a look on JIRA, i just commit it :
http://issues.alfresco.com/browse/AR-1911

There is some little issues but its working well. If you other issues, please let me know.

[federico_tesei]

hi to all
I'm novice to Alfresco and after digging a lot into the Alfresco permission intricacy ask help to the forum.
I'm afraid I'm facing this sort of problem too.
Let's me try to explain my scenario [ Alfresco 2.1 community on Jboss 4.2 GA ]
I'm trying to set-up with out of the box Alfresco 'features' { i.e. simple-work-flow move-actions, standard Alfresco

defined roles … } a document moving through a bunch of spaces by actions triggered by users belonging to  distinct

groups.
Typically to allow an user role to move from space S[ource] to space D[estination] I
> define as admin a simple move work-flow action on source space
> invite the user's group on the Source space with the required Alfresco Role { e.g. Editor }       
> I invite the user's group on the Destination space with the minimum Alfresco role that allows writing on the space {

i.e. Collaborator }

The outcome of my trials is that the transition succeed only when
> the user that belongs to the invited group on the Source space is the creator of the content to be moved
> the user is admin.

So  the questions are:

> Does the clearance to perform an action depends not only on the user's Alfresco role on the Source space but also on

the match with user content creator.
If this is the the problem
> How can I arrange to have the move performed I think impersonating the admin role without affecting the actual content

modifier.

Could anybody clarify/help  me on the topic.

thanks to all