1. Externalizing permissions in Drools
Samuel Masué
Software developer at CERN

2. document level
meta-data
external
refreshed

3. document level
meta-data
external
refreshed

4. behaviour
permission service

5. behaviour permission service node service webscript dynamic
authorities

6. rules engine
centralized

7. centralized

8. facts

9. rules
facts

10. rules facts Get document’s ACL document ACL user
Get user’s authorities
authorities
user + doc
reason
Why can I see this document?
facts

11. rules facts Get document’s ACL document ACL user
Get user’s authorities
authorities
user + doc
reason
Why can I see this document?
facts

12. Parameter table (Drools facts)
who?
what?
of whom?
permission
group(HR) CV
all
read
role(supervisor)
contract
supervisee
read
alf(creator)
ID card
all
delete

13. Parameter table (Drools facts)
who?
what?
of whom?
permission
group(HR) CV
all
read
role(supervisor)
contract
supervisee
read
alf(creator)
ID card
all
delete

14. Integration with Alfresco
creation
access
update

15. get node properties set permission generate document ACL creation
one single behaviour
node service
permission service
get node properties
generate document ACL
set permission

16. get node properties set permission generate document ACL creation
one single behaviour
node service
permission service
get node properties
generate document ACL
set permission

17. access
permission service
get ACL
get authorities

18. override get authorities
access
override get authorities
authority service
smart override
get authorities
get custom authorities

19. override get authorities
access
override get authorities
authority service
smart override
get authorities
get custom authorities

20. get last changes select impacted nodes update permission update
scheduled job
who?
what? …
permission service
get last changes
select impacted
nodes
update permission

21. get last changes select impacted nodes update permission update
scheduled job
who?
what? …
permission service
get last changes
select impacted
nodes
update permission

22. Externalizing permissions in Drools
Samuel Masué
Software developer at CERN