Alfresco permission Control

The default permission set of the platform includes the following eight common application permission sets,

Read Permission readproperties, readchildren, readcontent

Write write permission writeproperties, writecontent

Delete Delete permission deletenode, deletechildren

Addchildren add subnode permissions createchildren, linkchildren

Execute execution permission executecontent

Checkin check-in permission unlock

Checkout check-out permission lock

Cancelcheckout unlock the check-out permission

 

 

1. Alfresco uses the ACL mechanism to implement the permission control over text streams. The ACL contains multiple user and group access permissions.

All members of the group have the right to join the group.

 

 

2. Permission Mechanism Design in alfresco:

Each object (including folders and files) in the content library is related to an ACL object. When a user accesses a content library object, he/she first searches for the permissions of the current user on the object based on the ACL corresponding to the object. Determine whether the current user has the relevant permissions to operate on the object, so as to achieve the permission management of the content library object. The permission Inheritance Mechanism in alfresco allows the content library object to inherit the permissions of the parent node. Therefore, you do not have to assign an ACL to each object when creating the object. As long as you assign permissions to the directory structure, after the object is created, the parent node permission is inherited by default. Users, groups, and ACLs can be flexibly configured to implement complex content security control.

 

3. the specific implementation of the permission mechanism in alfresco is at the underlying layer of Alfresco, which specifies an interface for object operations: nodeservice abstracts various object operations into several basic methods, such as getproperties ();, setproperties (); intercept these methods. The task is to determine whether the method can be called by the current user, the Object ID of the current operation, and the operation being executed, this allows you to control object permissions at the underlying layer.