Apply permissions to OOTB group and service user

[sn8083]

Hi I need to apply permissions to OOTB workflow service user and workflow-users group.
question is should there be entries in group_config and user_config in yaml for OOTB groups/users.
or can i just add permissions in ace_config.

[kwin]

Please check out the documentation at https://github.com/Netcentric/accesscontroltool/blob/develop/docs/AdvancedFeatures.md#configure-permissions-for-built-in-users-or-groups-like-anonymous.

[sn8083]

hi @kwin
as mentioned in the document i have used

• global_config:
  defaultUnmanagedExternalIsMemberOfRegex: .*
  defaultUnmanagedExternalMembersRegex: .*

and i am trying to apply permissions for an OOTB service user- workflow-service, getting NoGroupDefinedException_
NoGroupDefinedException: Validation error while reading ACE definition nr.1 of authorizable workflow-service is not defined in group configuration

[kwin]

In those cases just list the built-in authorizable (user/group) in the YAML file (with the correct authorizable id) and leverage unmanagedAcePathsRegex as outlined below. No other properties need to be set on the authorizable as this is in fact not touched by the ACTool.

(https://github.com/Netcentric/accesscontroltool/blob/develop/docs/AdvancedFeatures.md#configure-permissions-for-built-in-users-or-groups-like-anonymous)

You still need to have the built-in group listed as stated above below -group_config.

[sn8083]

i have added both entries like below.

-global_config:
   defaultUnmanagedExternalIsMemberOfRegex: .*
   defaultUnmanagedExternalMembersRegex: .*
- ace_config:
    - workflow-service:
      - path: /apps
        permission: allow
        privileges: jcr:read

[kwin]

I don't see the group_config...

[sn8083]

hi i as workflow-service is a service-user, i believe it should be added in
-user_config

i added the below and getting errors
: OakState0001: Unresolved conflicts in /home/users/system/system

• user_config:
  • workflow-service:
    • name: workflow-service
      path: system
      isSystemUser: true
• global_config:
  defaultUnmanagedExternalMembersRegex: workflow-service
• ace_config:
  • workflow-service:
    • path: /apps
      permission: allow
      privileges: jcr:read