Remove permission on folders

[krumholt]

Hello,

a SiteManager wants to deny access to some folders in his site to some users.
It is possible to set inherit permissions to false and then add back all the users that should have access.
But that is a lot of work to do for all the folders.
It would be much easier to deny access to selected folders on a per user basis without removing the inherited permissions
Is there a way to overwrite inherited permissions in Alfresco 4.2.e?
I know you can add to the inherited permissions but is there also a way to add a deny a permission?

[eswbitto]

I haven't ever found a deny option on a directory for the community edition. You could create groups and do the permissions that way.

[logxjb]

I'm in the exact same use case as the OP.

I was thinking about extending the permission model to create a "NoAccess" permission that I could use to override inherited permission on subfolders that require it.

However, could you explain a bit more your strategy with more groups ?

[eswbitto]

Ok so I have ldap sync with my Alfresco install. Now if I have a site that I only want to have certain people have access to a folder. I can go into the admin options and create a group. Then from there add the users that need to be a part of that group.

When editing the permissions of the said folder then I take inherited permissions off and just add the group with the access level required. Its easier then having to add each person individually. Yes it does suck initially having to create the groups, but pays off….and I agree with you. A "deny permission" option would be nice, but unlikely.

[krumholt]

So my problem with the groups aproach is that i want the Sitemanager to be able to do most of the work.
I would like a solution where no admin ist required to manage a sites permissions.

[logxjb]

I've misread the OP.

The problem I've to solve is similar, but is already at group level.

This is a simplified exemple:

Let say I have GroupA and GroupB with the following folder structure

RootFolder
|- Folder 1
|- Folder 2
|– Folder 2.1
|– Folder 2.2

If I want GroupA and GroupB to be able to edit all that structure except "Folder 2.1" where I only want to grant access to GroupA.

The administrator has to:

Grant access on RootFolder to all those groups
Go to Folder 2.1 permission settings
Remove inherit permissions on this folder
Re-grant access to GroupA on this folder

This sound pretty simple, because the example is simple … but if in fact I to create this kind of structure often (I use a space template) and in each structure, I manage more groups and more exception folder … it would be far easier to just go on exception Folder, don't change inheritance, but restrict access on the folder to the 2 or 3 concerned groups.