How to hide default workflows models in the start workflow list in AEM Cloud version

[supriya-hande]

I am looking for a way to hide default workflows models in the start workflow list in AEM Cloud version. I found below link:
https://helpx.adobe.com/au/experience-manager/kb/hide-workflow-models-start-workflow-list.html

I was trying to add Workflow: System tag on the OOTB model but its giving error like: cant submit a form

Not sure if I dont have permission to add tags for OOTB workflow model. Is there any way to achieve this in AEM cloud version?

[Kamal_Kishor]

Hi @supriya-hande : It could be a permission issue for you. Please have a look at this to see if it helps: https://experienceleague.adobe.com/docs/experience-manager-65/administering/operations/workflows-man...

[supriya-hande]

hi @Kamal_Kishor We can give permission to folders /var/workflow/models but not to the nodes. Also I dont see option to create folder in Workflow models in AEM cloud version. There is option to create model which creates node inside /var/workflow/models

Any idea on this?

[aanchal-sikka]

@supriya-hande 

We can add permissions to workflow nodes as well. Use can use repo-init or netcentric ACL tool.

https://www.bounteous.com/insights/2021/11/16/adobe-experience-managers-sling-repoinit-have-you-trie...

[supriya-hande]

@aanchal-sikka Thanks for reply.
I tried adding permission for testuser using repo init on this path:

/var/workflow/models/launch-review

 set ACL on /var/workflow/models/launch-review
      deny jcr:all for test123
 end

 but this permission is not getting added for testuser. If I add ACL on /var/workflow/models/dam then it works. So it looks like we can add permissions for folders but not for node bcoz /var/workflow/models/launch-review is a node.
Any idea on this?

[supriya-hande]

@aanchal-sikka I tried adding ACL for a group:AEM-Content-Authors-No-Publish
This group is created from Admin console.

scripts=[
"
set ACL for AEM-Content-Authors-No-Publish
deny jcr:read on /var/workflow/models/dam
deny jcr:read on /var/workflow/models/cloudservices
deny jcr:read on /var/workflow/models/projects
deny jcr:read on /var/workflow/models/s7dam
deny jcr:read on /var/workflow/models restriction(rep:glob,/ac-newsletter-workflow-simple/)
deny jcr:read on /var/workflow/models restriction(rep:glob,/InboxRequest/)
deny jcr:read on /var/workflow/models restriction(rep:glob,/launch-review/)
end
"
]

This works in local but failing in Build Image step. I am getting below error:

javax.jcr.RepositoryException: Applying repoinit operation failed despite retry; set loglevel to DEBUG to see all exceptions. Last exception message was: Failed to set ACL (java.lang.IllegalStateException: Authorizable not found:AEM-Content-Authors-No-Publish) AclLine DENY {paths=[/var/workflow/models/dam], privileges=[jcr:read]}
	at org.apache.sling.jcr.repoinit.impl.RepositoryInitializerFactory.applyOperations(RepositoryInitializerFactory.java:154)
	at org.apache.sling.jcr.repoinit.impl.RepositoryInitializerFactory.processRepository(RepositoryInitializerFactory.java:130)
	at org.apache.sling.jcr.base.AbstractSlingRepositoryManager.executeRepositoryInitializers(AbstractSlingRepositoryManager.java:627)
	at org.apache.sling.jcr.base.AbstractSlingRepositoryManager.initializeAndRegisterRepositoryService(AbstractSlingRepositoryManager.java:575)
	at org.apache.sling.jcr.base.AbstractSlingRepositoryManager.access$300(AbstractSlingRepositoryManager.java:96)
	at org.apache.sling.jcr.base.AbstractSlingRepositoryManager$4.run(AbstractSlingRepositoryManager.java:544)
Caused by: org.apache.sling.jcr.repoinit.impl.RepoInitException: Failed to set ACL (java.lang.IllegalStateException: Authorizable not found:AEM-Content-Authors-No-Publish) AclLine DENY {paths=[/var/workflow/models/dam], privileges=[jcr:read]}
	at org.apache.sling.jcr.repoinit.impl.DoNothingVisitor.report(DoNothingVisitor.java:66)
	at org.apache.sling.jcr.repoinit.impl.AclVisitor.setAcl(AclVisitor.java:88)
	at org.apache.sling.jcr.repoinit.impl.AclVisitor.visitSetAclPrincipal(AclVisitor.java:115)
	at org.apache.sling.repoinit.parser.operations.SetAclPrincipals.accept(SetAclPrincipals.java:76)
	at org.apache.sling.jcr.repoinit.impl.JcrRepoInitOpsProcessorImpl.apply(JcrRepoInitOpsProcessorImpl.java:56)
	at org.apache.sling.jcr.repoinit.impl.RepositoryInitializerFactory.lambda$applyOperationInternal$0(RepositoryInitializerFactory.java:170)
	at org.apache.sling.jcr.repoinit.impl.RetryableOperation.apply(RetryableOperation.java:62)
	at org.apache.sling.jcr.repoinit.impl.RepositoryInitializerFactory.applyOperationInternal(RepositoryInitializerFactory.java:168)
	at org.apache.sling.jcr.repoinit.impl.RepositoryInitializerFactory.applyOperations(RepositoryInitializerFactory.java:150)
	... 5 common frames omitted
Caused by: java.lang.IllegalStateException: Authorizable not found:AEM-Content-Authors-No-Publish
	at org.apache.sling.jcr.repoinit.impl.AclUtil.checkState(AclUtil.java:528)
	at org.apache.sling.jcr.repoinit.impl.AclUtil.setAcl(AclUtil.java:150)
	at org.apache.sling.jcr.repoinit.impl.AclUtil.setAcl(AclUtil.java:125)
	at org.apache.sling.jcr.repoinit.impl.AclVisitor.setAcl(AclVisitor.java:85)
	... 12 common frames omitted

Any idea why this is happening? 

[kautuk_sahni]

@supriya-hande Did you find the suggestions from users helpful? Please let us know if more information is required. Otherwise, please mark the answer as correct for posterity. If you have found out solution yourself, please share it with the community.