How To Restrict Access To Workflow Models For A User Or Group

Adding the system tag hides the workflow model for all users.

Is there a way to only hide the workflow models for certain groups or a user?

You can do like below:

Restrict OOTB workflow for CustomGroup

"Adding the system tag hides the workflow model for all users."  -- this is correct

"Is there a way to only hide the workflow models for certain groups or a user?" -- Never tried that but, in theory, you could remove the read access to /var/workflow/models/<wf_name> and corresponding model paths in /conf or /lib for that specific user/group and it should stop populating in the drop-down. This should work.

That was my approach initially but, when you go to /useradmin to set permission not all of the workflow models show up individually.

In the useradmin console when setting permissions, if you open the /var/workflow/models node you will not see all of the models that you see in crx/de under the /var/workflow/models. Essentially you cannot set permissions per workflow model.

Now my approach was to create a two sets of folders under the /var/workflow/models node. One for the restricted workflow models, /var/workflow/models/restricted, and another for the non-restricted workflow models /var/workflow/models/non-restricted. I would move the OOB workflow models to the restricted folder and deny read permissions. This works fine! But, the problem is when I update a workflow model and press Sync, it will create the updated workflow model under /var/workflow/models not the restricted or nonrestricted folder. I would also need to move the /conf or /lib configurations for the workflows to a new path. Next I have to consider these changes need to be propagated to multiple environments (Dev, QA, Prod). And of course there will be issues during upgrades.

The whole thing seemed really messy/buggy and I was looking for a more elegant solution.

Hi,

Please check Adobe Experience Manager Help | Common Repository Restructuring in AEM 6.4

I believe workflows are getting read from conf and var

you can simply restrict those models.

If /useradmin doesn't work, then there is another tool for more granular permissions -- /crx/de

Create multiple groups and restrict the model paths for each group per your use case using this console. I would update this thread, if I get a better solution.

I'm adding the workflow:system tag to hide the workflows, as recommended earlier. I can add the workflow:system tag for some of the models but not for all.

For some models the UI for adding tags is grayed out.

And if I try to add the tags property through crx/de I get an error.

How do I add the system tag for these workflows?

You cannot add it via /crx/de unless you tweak permissions.

The tag must be there OOB either in /etc/tags or /content/cq:tags, pick it and apply from page properties/Touch UI editor

I couldn't add the tag to the OOB workflows under /libs.

I got it to work by copying the model from /libs to /conf.

Thanks for your help.