oo

Permissions Framework Integration

Liferay 7.4+

Published objects are integrated automatically with Liferay’s permissions framework. You can manage user access to an object and its entries with application and resource permissions. With role-based access control, you can ensure only appropriate users view and use your application’s data.

By default, custom object permissions are not assigned to user roles automatically. This is to prevent the accidental exposure of object data. To grant access, manually assign object permissions to the desired roles.

When defining role permissions, active objects appear according to their scope and panel link. Without a set panel link, custom objects do not appear in the Roles UI. Account restricted objects must also have Show Widget enabled.

tip

For site-scoped objects, you can determine whether permissions are granted for all sites or only specific sites.

important

Account and organization roles are only supported in objects with account restriction enabled. Otherwise, you can only use regular and site roles for assigning object permissions. See Account Restriction and User Roles for more information.

Application Permissions

Application permissions grant access to the published object itself and do not include resource-related permissions. Each object includes these standard application permissions according to their defined scope:

Permission Description
Access in Control Panel (Company Scope Only) Access the object in the Global Menu ( Global Menu ).
Access in Site and Asset Library Administration (Site Scope Only) Access the object in the Site Menu ( Site Menu ) or Asset Library.
Configuration N/A
Permissions View and modify application permissions for the object.
Preferences N/A
View* View the object’s application page.

* The view permission is also required to view mapped content, add/modify a form container mapped to the object definition while editing a page, and perform other actions provided users have additional required permissions (e.g., creating display page templates, information templates, and site navigation menus). Without it, collection and content displays are not displayed in View and Preview modes.

Resource Permissions

Resource permissions grant access to view, create, and act on entries for custom object definitions. Some of these permissions relate to creating object entries, while others are for performing actions on existing entries (e.g., edit, delete).

Creating Entries

Permission Description
Add Object Entry Create an entry. This permission is required to view the associated object’s form container. Without it, form containers are not displayed in View and Preview modes.
Permissions View and manage permissions related to creating entries.

Acting on Existing Entries

Permission Description
Delete Delete entries.
Object Entry History Use REST APIs to query entry history. This permission is only available while Entry History is enabled for the object definition.
Permissions View and modify permissions for individual entries.
Update Update entries.
View View entries.
note

The creator of an object entry is assigned the owner role automatically and granted the above permissions.

Resource permissions are generated for each standalone action added to an object. They’re useful for managing which roles can trigger the action, and are named using the action.[actionName] pattern.

Managing Permissions for Individual Object Entities

For 7.4 U10+/GA14+

With custom objects, you can manage permissions for individual database entities to control access to object data.

Follow these steps:

  1. Navigate to the desired custom object.

  2. Click the Actions button (Actions Button) for the desired entity and select Permissions.

    Click the Actions button for the desired entity and select Permissions.

  3. Use the checkboxes to grant permissions to act on the entry permissions to the desired roles.

    note

    Permissions defined in the Roles administrative application override permissions defined at the entity level.

    Use the checkboxes to assign permissions to the desired roles.

  4. Click Save.

Capability:
Feature: