ACL Permissions | Community
Skip to main content
A
ankitachauri
January 16, 2023
Solved

ACL Permissions

  • January 16, 2023
  • 3 replies
  • 1553 views

I have content structure like - /content/A , /content/B, /content/C
and user groups  AuthorA, AuthorB and AuthorC.
UserGroup AuthorA has allow access for /content/A and deny for/content/B & deny for /content/C
similarly AuthorB has allow access for /content/B and deny for/content/A & deny for /content/C

and Author C has allow access for /content/C and deny for/content/A & deny for /content/B

we have a  user -testUser,
testUser is part of usergroup AuthorA and AuthorB but testUser is only able to access /content/A
How can we make testuser to acces /content/B also because it is part of usergroup AuthorB as well

Thanks
Ankit

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
    Best answer by rampai

    Hi @ankitachauri ,

     

    Approach 1 (In case deny rules cannot be reverted. Wherever possible you should use only allow and avoid deny):

    You can do an ACL re-ordering using crx/de (Access Control tab) or crx/explorer (Access Control Editor) interface in case it is an on-premise AEM instance.

     

    You need to ensure that for each of your groups, deny rules are on top and allow rules are at the bottom so that allow takes priority over deny.

    e.g. You would be seeing something like this initially. Notice deny at the end.

    Update this to move deny at the top and any allow rules below it.

    This should fix your current problem.

     

    Approach 2 (Recommended from long-term perspective):

    Explicitly allow only the necessary content path and do not give access to the other nodes. For this, you need to set a rep:glob at the parent node with value "" and then add the permission only to the child node intended as shown below. With this you no longer need the deny rules.

     

     

     

    Thanks,

    Ram

    3 replies

    Anmol_Bhardwaj
    Community Advisor
    Anmol_BhardwajCommunity Advisor
    Community Advisor
    January 16, 2023

    Hi @ankitachauri ,

    It seems like the current setup you have done is giving each user group access to only one content path and denying access to the other two.

    One possible reason for this could be that the user group AuthorA has been granted access to /content/A and denied access to /content/B and /content/C.

    Similarly, user group AuthorB has been granted access to /content/B and denied access to /content/A and /content/C. Since testUser is a member of both user groups, they are being denied access to /content/B due to the deny rule in user group AuthorA.

     

    Solution: 

    You can give explicit allow access to /content/B for testUser.

    You can also create a new user group that gives access to both /content/A and /content/B and assign testUser to that group.

     

    Note:

    Explicit access to a user would take precedence over the group access

      Jagadeesh_Prakash
      Community Advisor
      Jagadeesh_PrakashCommunity Advisor
      Community Advisor
      January 16, 2023

      @ankitachauri Seems like your scenario doesn't have any possible solution untill you do below things

       

      1. Create a seperate group and add the necessary permissions

      2. remove deny all groups and add the permissions to users (Which is not recommanded)

      3. We might need to do a custom groups which can allow multiple groups and deny others. 

        rampai
        Community Advisor
        rampaiCommunity AdvisorAccepted solution
        Community Advisor
        January 16, 2023

        Hi @ankitachauri ,

         

        Approach 1 (In case deny rules cannot be reverted. Wherever possible you should use only allow and avoid deny):

        You can do an ACL re-ordering using crx/de (Access Control tab) or crx/explorer (Access Control Editor) interface in case it is an on-premise AEM instance.

         

        You need to ensure that for each of your groups, deny rules are on top and allow rules are at the bottom so that allow takes priority over deny.

        e.g. You would be seeing something like this initially. Notice deny at the end.

        Update this to move deny at the top and any allow rules below it.

        This should fix your current problem.

         

        Approach 2 (Recommended from long-term perspective):

        Explicitly allow only the necessary content path and do not give access to the other nodes. For this, you need to set a rep:glob at the parent node with value "" and then add the permission only to the child node intended as shown below. With this you no longer need the deny rules.

         

         

         

        Thanks,

        Ram

          Terms & ConditionsAccessibility statement

          Loading footer...