How to manage access permission in alfresco

Question

Hello Everyone thank's in advance for your help.

I am trying to configure access permission in alfresco and now stuck in a scenario
It would be great help if someone defines proper way to achieve this functionality
now my problem is

I want to create a site (which will be accessible by all user)
then will create folder and sub folder in that site (i am ready to customize content type of those folder if required)
now i want to configure alfresco in such a way that specific set of user can access specific folder and it's content for example

This is list of user
user1,user2,user3,user4,user5  

And this is folder structure
Project 
  Data
    Test
    Exam
  Design
    art
    practice
  Work
    W1
    W2

Now how to configure it in such a way that
user1 can access Data->Exam
user2 can access work and all it's child folder
user3 can access Data and all it's child folder
user4 can access Design and all it's child folder and
user5 can access Data->Work, Design->art,Work->W1 folder

Note that i am using CMIS api to generate this folder structure so is there any way to achieve this by java code only ?

i have read about managing permission but not sure about using it just because when i have tried to provide permission to folder it allow to add only single user
but in my case i want to make group of user and want to make the folder accessible by that particulate group.

Thank you so much for you time :)

Answer 1

If you want to use a group, you'll need to create the group in Alfresco using either the admin console or the Alfresco API. CMIS cannot manage users or groups.

Once your users and groups are in place, you can use CMIS to assign them to ACLs. However, the challenge is that you may need to disable or "break" ACL inheritance to do exactly what you want. You cannot disable ACL inheritance with the CMIS API. You'll have to do it in the UI or through the Alfresco API.

With your users and groups in place and with your folders configured to inherit or not inherit parent permissions as needed, you can now add users and groups to your folders. With CMIS, you can add as many users or groups as you need to a given folder. It is not limited to a single user or group. This page has some examples on using Access Control Entries (ACEs) which make up Access Control Lists (ACLs).

Answer 2

I think that Jeff Potts answer is great i will only add few thing's you can look to this post it will give you an answer how to work with ACL How to get Acls of a document.

You can also use the allowable action in any Folder (or document) it will look like this :

 Action a = Action.CAN_DELETE_OBJECT;
 object = session.getObjectByPath(idObject); // In case it's a folder
 if (object.getAllowableActions().getAllowableActions().contains(a)) {

        return Boolean.TRUE;// You can do it 

 }

Only remember that you can get the allowable action from String (In case you want work with few of them)

String canCreateFolder= Action.CAN_CREATE_FOLDER.value(); 

the most importante Action that you have to use :

can_create_folder = Action.CAN_CREATE_FOLDER.value();
can_create_document = Action.CAN_CREATE_DOCUMENT.value();
can_update_folder = Action.CAN_UPDATE_PROPERTIES.value();
can_update_document = Action.CAN_UPDATE_PROPERTIES.value();
can_delete_folder = Action.CAN_DELETE_OBJECT.value();
can_delete_document = Action.CAN_DELETE_OBJECT.value();

Hope that helped you.