java - 没有足够的访问权限来创建文件夹

Question

在我当前的项目中，使用 Filenet P8 Content Platform Engine 5.2.1 与 WebSphere 8.5.5.3、Eclipse Mars 4.5.2 和 Apache Maven 3.3.1

我需要动态创建文件夹，并且遵循以下顺序:

我使用 p8admin 用户创建该文件夹的新实例:

Folder newFolder = Factory.Folder.createInstance(objectStore, subFolderClass);

我使用以下方法添加一些属性:

newFolder.getProperties().putValue(EcmFilenetConsts.PROPERTY_ID_LOTTO, ((CNEPropertyBean) sgacPropsBean).getIdLotto());

我设置了parent和folderName属性:

Folder parentFolder = Factory.Folder.getInstance(objectStore, null, parentFolderPath);
newFolder.set_Parent(parentFolder);
newFolder.set_FolderName(subFolderName);

然后，我在执行 newFolder.save(RefreshMode.REFRESH) 之前对文件夹设置了一些权限:

AccessPermission permission = Factory.AccessPermission.createInstance();
permission.set_GranteeName(granteeName);
permission.set_AccessType(AccessType.ALLOW);
permission.set_InheritableDepth(-1);
permission.set_AccessMask(EcmFilenetConsts.ACCESS_READ_FOLDER);
AccessPermissionList permissions = Factory.AccessPermission.createList();
permissions.add(permission);
folder.set_Permissions(permissions);

其中EcmFilenetConsts.ACCESS_READ_FOLDER = AccessRight.READ.getValue() | AccessRight.READ_ACL.getValue();

如果我保存文件夹，然后添加权限，我不会有任何问题，但我想在保存之前添加所有内容，就像使用 Content Navigator 时那样。

由于我只需要添加对此文件夹的直接权限，而所有其他权限均由父级(或文档类默认实例安全性)继承，因此我尝试使用工厂创建一个空的 AccessPermissionList，但结果是所有 Reader 权限均已正确设置，但 Owner 权限未设置。

因此，当尝试在其中添加子文件夹时，我得到以下信息:

FNRCE0001E - The requester has insufficient access rights to perform the requested operation.

如果查看新创建的文件夹security

p8admin 用户、p8admins 和 p8operators 组缺失，它们是文件夹类默认实例安全性的一部分。

以下是新创建的“动态”文件夹的每个权限的访问掩码:

DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=AMM_000008_00001,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_DIRECT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=AMM_000001_00001,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_PARENT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=AMM_000002_00001,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_PARENT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=FOR_RTI_L01,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_PARENT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1

这是安全信息预期结果(通过保存文件夹并随后添加安全性获得)

DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=AMM_000008_00001,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_DIRECT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=p8admin,cn=users,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 999415
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_DIRECT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: 0
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=AMM_000001_00001,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_DEFAULT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=AMM_000002_00001,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_DEFAULT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=p8admins,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 999415
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_DEFAULT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: 0
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=p8operators,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 999415
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_DEFAULT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: 0
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=AMM_000001_00001,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_PARENT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=AMM_000002_00001,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_PARENT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - Folder GranteeName: cn=FOR_RTI_L01,cn=groups,ou=spcdev,o=priv
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessMask: 131073
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - AccessType: ALLOW
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - PermissionSource: SOURCE_PARENT
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImpl  - InheritableDepth: -1
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImplTest  - Folder ACCESS FULL CONTROL:999415
DEBUG com.leonardo.spcic.ecm.filenet.security.SecurityManagerImplTest  - Folder ACCESS READ:131073

我的疑问是我不确定自己是否遵循了正确的顺序，或者缺少一些步骤。动态创建文件夹以添加属性和安全性的正确步骤是什么？我必须手动设置安全性吗？

Answer 1

免责声明:我不熟悉这项技术。我刚刚用谷歌搜索了一下。

看来Folder.createInstance除非您明确指示，否则不会在 API 端创建实例。

The created object does not yet exist in an object store. To persist the created object to the object store, you must explicitly call the save method, or commit the object via a batch operation.

强调我的。

get_Permissions()，实际上任何 get_X() 方法似乎都在 API 端查询该值，但您的文件夹在那里还不存在，因此失败。

有lots of people有a similar problem他们在哪里使用getInstance而不是fetchInstance最终导致相同的问题和相同的错误代码。

要点是:您需要从服务器“获取”对象的实例才能查询其属性。

这就是为什么以下说法正确:

If I save the folder and after that I add permissions I have no problems

<小时/>

一种解决方案是不查询权限属性，而是从头开始创建权限:

AccessPermissionList permissions = Factory.AccessPermission.createList();
permissions.add(permission);
folder.set_Permissions(permissions);
// Perhaps you will also need additional permissions now?