Crear ROLES de usuario

[camachompi]

He creado varios roles de usuario, pero hay uno de los roles que nose configurarlo.

quiero tener un rol de usuario que pueda ver, crear y editar documentos pero que no pueda elimminar documentos ni siquiera los suyos propios (OWNER).
He conseguido crear un rol sin la opcion de eliminar pero no me deja mover los documentos a otras carpetas.


es decir lo que quiero es un rol que vea, cree, edite, mueva documentos pero que no pueda borrar ni un documento.

[cybermakoki]

Hola camachompi,

Creo que eso no lo vas a poder hacer, porque mover un documento implica eliminarlo del sitio en el que estás.

Si usas un rol colaborador, que permite editar pero no eliminar, verás que no tienes opción de mover el documento.

Un saludo,
Patricia.

[camachompi]

CREAR NUEVOS ROLES:
- ROL JEFES  CONTABLE y ADMINISTRATIVO

http://forums.alfresco.com/forum/installation-upgrades-configuration-integration/configuration/delet...

nano tomcat/webapps/alfresco/WEB-INF/classes/alfresco/model/permissionDefinitions.xml

añadir

nano tomcat/webapps/alfresco/WEB-INF/classes/alfresco/model/permissionDefinitions.xml

Crear dos nuevos grupos de permisos (DeleteNodeTest y DeleteChildrenTest)
- DeleteNodeTest → para poder mover documentos sin eliminarlos
- DeleteChildrenTest → para poder eliminar y mover documentos pero solo los documentos propios.

      <!– ============================================= –>
      <!– Convenient groupings of low level permissions –>
      <!– ============================================= –>
     
      <permissionGroup name="Read"  expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="ReadProperties"/>
           <includePermissionGroup type="sys:base" permissionGroup="ReadChildren"/>
           <includePermissionGroup type="sys:base" permissionGroup="ReadContent"/>
      </permissionGroup>
      
      <permissionGroup name="Write" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="WriteProperties"/>
           <includePermissionGroup type="sys:base" permissionGroup="WriteContent"/>
      </permissionGroup> 
      
      <permissionGroup name="Delete" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="DeleteNode"/>
           <includePermissionGroup type="sys:base" permissionGroup="DeleteChildren"/>
      </permissionGroup>
      
      <permissionGroup name="DeleteNodeTest" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="DeleteNode"/>
      </permissionGroup>

      <permissionGroup name="DeleteChildrenTest" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="DeleteChildren"/>
      </permissionGroup>


      <permissionGroup name="AddChildren" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="CreateChildren"/>
           <includePermissionGroup type="sys:base" permissionGroup="LinkChildren"/>
      </permissionGroup>

———————————————————————————————————————

Crear los 3 roles definidos:
- Jefes → pueden ver,crear, editar, mover, eliminar documentos de los demas
- Contable → pueden ver,crear, editar, mover, eliminar documentos sus propios documentos
- Administrativo → puede ver,crear,editar, mover sus propios documentos pero no elimina nada

   <!– ================================================ –>
   <!– Permissions available to all content and folders –>
   <!– ================================================ –>
  
   <permissionSet type="cm:cmobject" expose="selected">
      
       <!– Kept for backward compatibility - the administrator permission has   –>
      <!– been removed to avoid confusion –>
      <permissionGroup name="Administrator" allowFullControl="true" expose="false" />
     
<!– A coordinator can do anything to the object or its children unless the     –>
      <!– permissions are set not to inherit or permission is denied.                 –>
      <permissionGroup name="Coordinator" allowFullControl="true" expose="true" />

      <permissionGroup name="Jefes" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Editor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="Delete" type="sys:base" />
      </permissionGroup>

      <permissionGroup name="Contable" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Editor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="DeleteChildrenTest" type="sys:base" />
      </permissionGroup>


      <!– A collaborator can do anything that an editor and a contributor can do –>
      <permissionGroup name="Collaborator" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Editor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
      </permissionGroup>


      <permissionGroup name="Administrativo" allowFullControl="false" expose="true">
          <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject"/>
          <includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
          <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
          <includePermissionGroup type="sys:base" permissionGroup="Write"/>
         <includePermissionGroup permissionGroup="DeleteNodeTest" type="sys:base" />

      </permissionGroup>
     
      <!– A contributor can create content and then they have full permission on what –>
      <!– they have created - via the permissions assigned to the owner.              –>
      <permissionGroup name="Contributor" allowFullControl="false" expose="true" >
          <!– Contributor is a consumer who can add content, and then can modify via the –>
          <!– owner permissions.                                                      –>
          <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject"/>
          <includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
          <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
      </permissionGroup>

——————————————————————————————————————-

   <!– =============================== –>
   <!– Permissions specific to content –>
   <!– =============================== –>
  
   <permissionSet type="cm:content" expose="selected">

      <!– Content specific roles.                                                       –>
     
      <permissionGroup name="Coordinator" extends="true" expose="true"/>
      <permissionGroup name="Jefes" extends="true" expose="true"/>
      <permissionGroup name="Contable" extends="true" expose="true"/>
      <permissionGroup name="Collaborator" extends="true" expose="true"/>
      <permissionGroup name="Administrativo" extends="true" expose="true"/>
      <permissionGroup name="Contributor" extends="true" expose="true"/>
      <permissionGroup name="Editor" extends="true" expose="true"/>
      <permissionGroup name="Consumer" extends="true" expose="true"/>
      <permissionGroup name="RecordAdministrator" extends="true" expose="false"/>
     
   </permissionSet>
   
   
    <permissionSet type="cm:folder" expose="selected">

      <!– Content folder specific roles.                                                       –>
     
  <permissionGroup name="Coordinator" extends="true" expose="true"/>
      <permissionGroup name="Jefes" extends="true" expose="true"/>
      <permissionGroup name="Contable" extends="true" expose="true"/>
      <permissionGroup name="Collaborator" extends="true" expose="true"/>
      <permissionGroup name="Administrativo" extends="true" expose="true"/>
      <permissionGroup name="Contributor" extends="true" expose="true"/>
      <permissionGroup name="Editor" extends="true" expose="true"/>
      <permissionGroup name="Consumer" extends="true" expose="true"/>
      <permissionGroup name="RecordAdministrator" extends="true" expose="false"/>
     
   </permissionSet>


————————————————————————————————————————-

para que el rol administrativo no pueda borrar sus propios documentos modificar :

   <!– ================== –>
   <!– Global permissions –>
   <!– ================== –>
  
   <!–                                                                                  –>
   <!– Global permissions apply regardless of any particular node context.              –>
   <!– They can not be denied by the permissions set on any node.                       –>
   <!–                                                                                  –>
     
   <!– Admin can do anything to any ndoe                                                –>
   <globalPermission permission="FullControl" authority="ROLE_ADMINISTRATOR"/>
  
   <!– For now, owners can always see, find and manipulate their stuff                  –>
     <!–  <globalPermission permission="FullControl" authority="ROLE_OWNER"/>  –>
   <globalPermission permission="Administrativo" authority="ROLE_OWNER"/>
  
   <!– Unlock is granted to the lock owner                                              –>
   <globalPermission permission="Unlock" authority="ROLE_LOCK_OWNER"/>
  
   <!– Check in is granted to the lock owner                                            –>
   <globalPermission permission="CheckIn" authority="ROLE_LOCK_OWNER"/>
  
   <!– Cancel check out is granted to the locak owner                                   –>
   <globalPermission permission="CancelCheckOut" authority="ROLE_LOCK_OWNER"/>
  
   <!– Usere need to be able to remove stuff from thier own sandbox –>
   
   <globalPermission permission="Flatten" authority="ROLE_WCM_STORE_OWNER" />


—————————————————————————————————————————-

ahora modificamos el fichero :
nano tomcat/webapps/share/WEB-INF/classes/alfresco/share-documentlibrary-config.xml

para poder ver el icono de “mover documento”

primero buscamos MOVE TO y comentamos las lineas que dicen perission allow ¡=”true”>Delete</

         <!– Move to –>
         <action id="document-move-to" type="javascript" label="actions.document.move-to">
            <param name="function">onActionMoveTo</param>
                   <!–   <permissions>
               <permission allow="true">Delete</permission>
            </permissions>    –>
            <evaluator negate="true">evaluator.doclib.action.isLocked</evaluator>
         </action>

segundo buscamos la accion y eliminamos el permission=”Delete” de la linea
<action type="action-link" id="onActionMoveTo" permission="Delete" label="menu.selected-items.move"/>

      <multi-select>
         <action type="action-link" id="onActionDownload" label="menu.selected-items.download" />
         <action type="action-link" id="onActionCopyTo" label="menu.selected-items.copy" />
         <action type="action-link" id="onActionMoveTo" label="menu.selected-items.move"/>
         <action type="action-link" id="onActionAssignWorkflow" asset="document" label="menu.selected-items.assign-workflow"/>
         <action type="action-link" id="onActionDelete" permission="Delete" label="menu.selected-items.delete"/>
         <action type="action-link" id="onActionCloudSync" asset="document"  permission="CreateChildren" label="menu.selected-items.cloudSync" notAspect="sync:syncSetMemberNode" syncMode="ON_PREMISE" />
         <action type="action-link" id="onActionCloudSyncRequest" label="menu.selected-items.cloudRequestSync" hasAspect="sync:syncSetMemberNode" syncMode="ON_PREMISE" />
      </multi-select>

————————————————————————————–
nano tomcat/webapps/alfresco/WEB-INF/classes/alfresco/messages/webclient.properties

nano tomcat/webapps/alfresco/WEB-INF/classes/alfresco/messages/webclient_es.properties

añadir

# Repo permission display labels
# Note - these come from the server, the english translation is generally the same
Administrator=Administrador
Consumer=Consumidor
Coordinator=Coordinador
Jefes=Jefes
Contable=Contable
Collaborator=Colaborador
Administrativo=Administrativo
Contributor=Contribuidor
Editor=Editor
All=Todos
FullControl=Control completo
ContentManager=Administrador de contenidos
ContentPublisher=Editor de contenidos
ContentContributor=Contribuidor de contenidos
ContentReviewer=Revisor de contenidos

edit_details=Editar detalles


Reiniciar ALFRESCO.

[camachompi]

A

[camachompi]

CREAR NUEVOS ROLES:
- ROL JEFES  CONTABLE y ADMINISTRATIVO

http://forums.alfresco.com/forum/installation-upgrades-configuration-integration/configuration/delet...

nano tomcat/webapps/alfresco/WEB-INF/classes/alfresco/model/permissionDefinitions.xml

añadir

nano tomcat/webapps/alfresco/WEB-INF/classes/alfresco/model/permissionDefinitions.xml

Crear dos nuevos grupos de permisos (DeleteNodeTest y DeleteChildrenTest)
- DeleteNodeTest → para poder mover documentos sin eliminarlos
- DeleteChildrenTest → para poder eliminar y mover documentos pero solo los documentos propios.

      <!– ============================================= –>
      <!– Convenient groupings of low level permissions –>
      <!– ============================================= –>
     
      <permissionGroup name="Read"  expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="ReadProperties"/>
           <includePermissionGroup type="sys:base" permissionGroup="ReadChildren"/>
           <includePermissionGroup type="sys:base" permissionGroup="ReadContent"/>
      </permissionGroup>
      
      <permissionGroup name="Write" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="WriteProperties"/>
           <includePermissionGroup type="sys:base" permissionGroup="WriteContent"/>
      </permissionGroup> 
      
      <permissionGroup name="Delete" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="DeleteNode"/>
           <includePermissionGroup type="sys:base" permissionGroup="DeleteChildren"/>
      </permissionGroup>
      
      <permissionGroup name="DeleteNodeTest" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="DeleteNode"/>
      </permissionGroup>

      <permissionGroup name="DeleteChildrenTest" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="DeleteChildren"/>
      </permissionGroup>


      <permissionGroup name="AddChildren" expose="true" allowFullControl="false">
           <includePermissionGroup type="sys:base" permissionGroup="CreateChildren"/>
           <includePermissionGroup type="sys:base" permissionGroup="LinkChildren"/>
      </permissionGroup>

———————————————————————————————————————

Crear los 3 roles definidos:
- Jefes → pueden ver,crear, editar, mover, eliminar documentos de los demas
- Contable → pueden ver,crear, editar, mover, eliminar documentos sus propios documentos
- Administrativo → puede ver,crear,editar, mover sus propios documentos pero no elimina nada

   <!– ================================================ –>
   <!– Permissions available to all content and folders –>
   <!– ================================================ –>
  
   <permissionSet type="cm:cmobject" expose="selected">
      
       <!– Kept for backward compatibility - the administrator permission has   –>
      <!– been removed to avoid confusion –>
      <permissionGroup name="Administrator" allowFullControl="true" expose="false" />
     
<!– A coordinator can do anything to the object or its children unless the     –>
      <!– permissions are set not to inherit or permission is denied.                 –>
      <permissionGroup name="Coordinator" allowFullControl="true" expose="true" />

      <permissionGroup name="Jefes" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Editor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="Delete" type="sys:base" />
      </permissionGroup>

      <permissionGroup name="Contable" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Editor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="DeleteChildrenTest" type="sys:base" />
      </permissionGroup>


      <!– A collaborator can do anything that an editor and a contributor can do –>
      <permissionGroup name="Collaborator" allowFullControl="false" expose="true">
         <includePermissionGroup permissionGroup="Editor" type="cm:cmobject" />
         <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
      </permissionGroup>


      <permissionGroup name="Administrativo" allowFullControl="false" expose="true">
          <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject"/>
          <includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
          <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
          <includePermissionGroup type="sys:base" permissionGroup="Write"/>
         <includePermissionGroup permissionGroup="DeleteNodeTest" type="sys:base" />

      </permissionGroup>
     
      <!– A contributor can create content and then they have full permission on what –>
      <!– they have created - via the permissions assigned to the owner.              –>
      <permissionGroup name="Contributor" allowFullControl="false" expose="true" >
          <!– Contributor is a consumer who can add content, and then can modify via the –>
          <!– owner permissions.                                                      –>
          <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject"/>
          <includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
          <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
      </permissionGroup>

——————————————————————————————————————-

   <!– =============================== –>
   <!– Permissions specific to content –>
   <!– =============================== –>
  
   <permissionSet type="cm:content" expose="selected">

      <!– Content specific roles.                                                       –>
     
      <permissionGroup name="Coordinator" extends="true" expose="true"/>
      <permissionGroup name="Jefes" extends="true" expose="true"/>
      <permissionGroup name="Contable" extends="true" expose="true"/>
      <permissionGroup name="Collaborator" extends="true" expose="true"/>
      <permissionGroup name="Administrativo" extends="true" expose="true"/>
      <permissionGroup name="Contributor" extends="true" expose="true"/>
      <permissionGroup name="Editor" extends="true" expose="true"/>
      <permissionGroup name="Consumer" extends="true" expose="true"/>
      <permissionGroup name="RecordAdministrator" extends="true" expose="false"/>
     
   </permissionSet>
   
   
    <permissionSet type="cm:folder" expose="selected">

      <!– Content folder specific roles.                                                       –>
     
  <permissionGroup name="Coordinator" extends="true" expose="true"/>
      <permissionGroup name="Jefes" extends="true" expose="true"/>
      <permissionGroup name="Contable" extends="true" expose="true"/>
      <permissionGroup name="Collaborator" extends="true" expose="true"/>
      <permissionGroup name="Administrativo" extends="true" expose="true"/>
      <permissionGroup name="Contributor" extends="true" expose="true"/>
      <permissionGroup name="Editor" extends="true" expose="true"/>
      <permissionGroup name="Consumer" extends="true" expose="true"/>
      <permissionGroup name="RecordAdministrator" extends="true" expose="false"/>
     
   </permissionSet>


————————————————————————————————————————-

para que el rol administrativo no pueda borrar sus propios documentos modificar :

   <!– ================== –>
   <!– Global permissions –>
   <!– ================== –>
  
   <!–                                                                                  –>
   <!– Global permissions apply regardless of any particular node context.              –>
   <!– They can not be denied by the permissions set on any node.                       –>
   <!–                                                                                  –>
     
   <!– Admin can do anything to any ndoe                                                –>
   <globalPermission permission="FullControl" authority="ROLE_ADMINISTRATOR"/>
  
   <!– For now, owners can always see, find and manipulate their stuff                  –>
     <!–  <globalPermission permission="FullControl" authority="ROLE_OWNER"/>  –>
   <globalPermission permission="Administrativo" authority="ROLE_OWNER"/>
  
   <!– Unlock is granted to the lock owner                                              –>
   <globalPermission permission="Unlock" authority="ROLE_LOCK_OWNER"/>
  
   <!– Check in is granted to the lock owner                                            –>
   <globalPermission permission="CheckIn" authority="ROLE_LOCK_OWNER"/>
  
   <!– Cancel check out is granted to the locak owner                                   –>
   <globalPermission permission="CancelCheckOut" authority="ROLE_LOCK_OWNER"/>
  
   <!– Usere need to be able to remove stuff from thier own sandbox –>
   
   <globalPermission permission="Flatten" authority="ROLE_WCM_STORE_OWNER" />


—————————————————————————————————————————-

ahora modificamos el fichero :
nano tomcat/webapps/share/WEB-INF/classes/alfresco/share-documentlibrary-config.xml

para poder ver el icono de “mover documento”

primero buscamos MOVE TO y comentamos las lineas que dicen perission allow ¡=”true”>Delete</

         <!– Move to –>
         <action id="document-move-to" type="javascript" label="actions.document.move-to">
            <param name="function">onActionMoveTo</param>
                   <!–   <permissions>
               <permission allow="true">Delete</permission>
            </permissions>    –>
            <evaluator negate="true">evaluator.doclib.action.isLocked</evaluator>
         </action>

segundo buscamos la accion y eliminamos el permission=”Delete” de la linea
<action type="action-link" id="onActionMoveTo" permission="Delete" label="menu.selected-items.move"/>

      <multi-select>
         <action type="action-link" id="onActionDownload" label="menu.selected-items.download" />
         <action type="action-link" id="onActionCopyTo" label="menu.selected-items.copy" />
         <action type="action-link" id="onActionMoveTo" label="menu.selected-items.move"/>
         <action type="action-link" id="onActionAssignWorkflow" asset="document" label="menu.selected-items.assign-workflow"/>
         <action type="action-link" id="onActionDelete" permission="Delete" label="menu.selected-items.delete"/>
         <action type="action-link" id="onActionCloudSync" asset="document"  permission="CreateChildren" label="menu.selected-items.cloudSync" notAspect="sync:syncSetMemberNode" syncMode="ON_PREMISE" />
         <action type="action-link" id="onActionCloudSyncRequest" label="menu.selected-items.cloudRequestSync" hasAspect="sync:syncSetMemberNode" syncMode="ON_PREMISE" />
      </multi-select>

————————————————————————————–
nano tomcat/webapps/alfresco/WEB-INF/classes/alfresco/messages/webclient.properties

nano tomcat/webapps/alfresco/WEB-INF/classes/alfresco/messages/webclient_es.properties

añadir

# Repo permission display labels
# Note - these come from the server, the english translation is generally the same
Administrator=Administrador
Consumer=Consumidor
Coordinator=Coordinador
Jefes=Jefes
Contable=Contable
Collaborator=Colaborador
Administrativo=Administrativo
Contributor=Contribuidor
Editor=Editor
All=Todos
FullControl=Control completo
ContentManager=Administrador de contenidos
ContentPublisher=Editor de contenidos
ContentContributor=Contribuidor de contenidos
ContentReviewer=Revisor de contenidos

edit_details=Editar detalles


Reiniciar ALFRESCO.

[camachompi]

PERDONAR pero los administradores han ocultado parte del contenido, adjunto un txt

[jorgeeveris]

Hola camachompi,

estoy intentando configurar Alfresco de manera que:

- Coordinator tenga todos los permisos.
- Collaborator sea como Coordinator pero que solo pueda borrar sus propios contenidos.
- Consumer solo pueda leer los contenidos existentes en su espacio invitado y que no pueda ni crear contenidos ni borrarlos.

Para esto he modificado el OWNER_ROLE para que solo tenga estos permisos:

includePermissionGroup type="sys:base" permissionGroup="Read"
includePermissionGroup type="sys:base" permissionGroup="Execute"

y posteriormente en la definición de cada rol definir sus permisos. Por ejemplo para Collaborator, y siguiendo tu ejemplo:

permissionGroup name="Collaborator" allowFullControl="false" expose="true"
         includePermissionGroup permissionGroup="Editor" type="cm:cmobject"
         includePermissionGroup permissionGroup="Contributor" type="cm:cmobject"
         includePermissionGroup permissionGroup="DeleteChildrenTest" type="sys:base"
permissionGroup

definiendo también:
permissionGroup name="DeleteChildrenTest" expose="true" allowFullControl="false"
   includePermissionGroup type="sys:base" permissionGroup="DeleteChildren"
permissionGroup>
pero no me permite borrar ni si quiera los contenidos que el Collaborator sube (no me sale el icono de borrar).

Gracias de antemano.
Un saludo!

[camachompi]

pasame un mail por privado para adjuntarte un PDF para que puedas verificar todos los pasos que lleve a cabo durante los cambios, podrás ver todos los textos añadidos o modificados en color rojo, creo que te falta el primer paso: "Crear dos nuevos grupos de permisos (DeleteNodeTest y DeleteChildrenTest)"

pd: Crea que no estamos en la misma versión de alfresco ya que yo utilizo la 4.2.d y los archivos de configuracion pueden cambiar.Siento la tardanza en la respuesta

[cybermakoki]

genial camachompi!

Gracias por la info

[rquinga]

Estimado camachompi, quedare eternamente agradecido si me puedes facilitar el pdf para crear grupos y roles.

Saludos.