Question

In some cases it might be useful to restrict access and thus visibility of select workflow-models to users/groups. How is it possible to assign effective permissions on workflow-models which are not visible in the CQ5 Security Admin?

Answer, Resolution

In order to set ACLs on workflow-models, the CRX Content Explorer has to be used. The following steps exemplify how to deny READ access to the Publish Example workflow-model.

Please note: depending on the actual CQ version, the procedure differs slightly.

CQ5.1, CQ5.2.x

  • logged in as admin, open the crx.default workspace with the CRX Content Explorer
  • navigate to the Publish Example workflow-model /etc/workflow/models/publish_example
  • make sure the node is selected in the tree on the left
  • in the upper toolbar, click on the Versions button and select Checkout
  • the workflow-model is now editable
  • next click on the Security button and select ACL Editor
  • create a New Permission, select a group and deny READ (leave the rest untouched)
  • click Apply and close the window
  • now checkin the workflow-model via Versions -> Checkin

At this point, all members of the above group will neither see the Publish Example workflow-model in the sidekick nor in the workflow-console.

CQ5.3

  • logged in as admin, open the crx.default workspace with the CRX Content Explorer and checkout the workflow-model node (same as above)
  • next click on the Security button and select Access Control Editor
  • in the Applicable Access Control Policies section, mark the checkbox next to org.apache.jackrabbit.core.security.authorization.acl.ACLTemplate
  • click on Set selected policies
  • next click on New ACE
  • browse the Principal (user/group) for which a privilege is to be set
  • DENY jcr:read and confirm
  • click Apply and close the window
  • now checkin the workflow-model via Versions -> Checkin

Applies to

CQ5.1, CQ5.2.x, CQ5.3

Denna produkt är licensierad enligt en Creative Commons Erkännande-Ickekommersiell-Dela Lika 3.0 Unported-licens  Twitter™- och Facebook-inlägg omfattas inte av villkoren i Creative Commons-licensen.

Juridiska meddelanden   |   Onlinesekretesspolicy