Hiding OOTB workflow from StartWorkflow dialog in AEMasCS

[prithwi]

Hi,

I think this is very common usecase that customer wants to see only the project specific workflows in the StartWorkflow dialog. I tried to implement this using ACL but it didn't work. Referred few similar community articles but none of them worked for me. So, I decided to overlay /libs/cq/gui/components/authoring/workflow/listworkflows which shows the list of workflows in the dialog box, but this component is marked as granite:InternalArea. I overlayed this in local AEM which worked perfectly but I believe overlaying will not work in cloud environment because of MixingType=granite:InternalArea! Correct me if wrong. Any suggestion would help greatly.  

Requirement is to display only selected workflows (project related) in the below two dialog boxes.

[EstebanBustamante · Accepted solution]

Hi,

If it is difficult to overlay, you can always work around this by creating a hook for this functionality. What I mean is that you can add custom JavaScript that will hide the elements you don't want to display in the dropdown when the page loads.

Something like this:

$(document).on("foundation-contentloaded", function(e) {
    // Add values to hide here
    var valuesToHide = ["workflow1", "workflow2", "workflow3"];
    for (var i = 0; i < valuesToHide.length; i++) {
        $("#workflow-dropdown-id option[value='" + valuesToHide[i] + "']").hide();
    }
});

Hope this helps.

[aanchal-sikka]

@prithwi 

Did you revoke access on Workflows both in /conf and /var folders?

Little surprised because this has been a recurring question, and I guess people were able to resolve via ACLs.

Can you possibly share an example of what you mean by its not working? And what is the ACL set up to hide this workflow?

[prithwi]

Hi @aanchal-sikka,

I was trying to resolve this using Tools > Security > Permission. But I can only select the path /var/workflow/models not the specific workflows. Even I tried ACL commands in repoinit where I added workflow name after the path like below

deny jcr:read on /var/workflow/models/publish_example

but AEM rejected this command and server failed to start. Later, I tried to assign permission from CRXDE but when I click on the + icon it shows me this error. So, I was not able to make it using ACL approach. 

After your response I again look for the solution and did some trial and error. Finally I'm able to make it work using ACL permission only. I used restriction rep:glob on the workflows to hide them. I have not used rep:glob before so not aware of it's uses. Here is the list of commands in my repoinit file to hide OOTB workflows (in case this helps other people) -

set ACL for workflow-users,workflow-editors
        deny jcr:read on /var/workflow/models/dam
        deny jcr:read on /var/workflow/models/cloudservices
        deny jcr:read on /var/workflow/models/projects
        deny jcr:read on /var/workflow/models/s7dam
        deny jcr:read on /var/workflow/models restriction(rep:glob,/ac-newsletter-workflow-simple/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/InboxRequest/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/launch-review/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/preset-publish-to-preview/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/publish_example/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/publish_to_campaign/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/request_for_activation/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/request_for_deactivation/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/request_for_deletion/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/request_for_deletion_without_deactivation/)
        deny jcr:read on /var/workflow/models restriction(rep:glob,/request_to_complete_move_operation/)
    end

Thanks @aanchal-sikka  for your quick response. It help me to think me twice. 

Also thanks to @EstebanBustamante. I tried JS option which was having some conflict with other libraries. I didn't focus more to resolve it as ACL worked for me. I'll try this option at my free time to learn it!