nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

OS Groups vs Teamsite Groups

lizn

We are in the process of redoing our security and would like any suggestions that would be helpful. We currently have TS 6.1 with windows and are upgrading to 6.5 with windows. As we upgrade we trying to staighten out our security. What are the benefits of using OS Groups opposed to Teamsite Groups or vice versa? How do others have their securities setup? We have several branches and each branch has several workareas in which users can only see certain workareas and not the whole branch. Any input would be appreciated.
thanks

Find more posts tagged with

Comments

ccprofessional

What type of "security" are you refering to?

Are you asking if using TS Groups is somehow more secure while accessing TS from the UI (client browser) than using OS groups?
TS groups were introduced to make user/role administration easier - not for security reasons.

lizn

I'm really wanting to know of there's a way of replacing local group with teamsite groups. so that we don't have to set up the local groups everytime we change servers. we'd want our teamsite groups to inherit our domain groups, and allow our teamsite groups to be added to our workarea and branches.

in reference to security we're more concerned with permissions to read and write to the directories.

nipper

This will depend on how badly yo are affected by the limitiations of groups within the OS.

Since I am running on Unix & you mentioned Windows, the 2 main issues I have are unrelated
to Windows.

NFS has a limit of 16 (maximum) groups that one user can belong to. This means that for an admin
like myself, I cannot get to everything I need to. Also, /etc/group has a limitiation of 1K characters
to a line, so if a groups has a lot of users, it will need to be broken into multiple.

That being said, those are some of the Unix issues. If TS groups help on DOS, I have no idea, except that
it may make administration easier, depending on your company

Jamik

where I work we've set up domain groups for our teamsite users so we have domain groups like domain\iw_hr_contributors and they get set as the branch group and also the workarea group (we only do one workarea per branch here) so we've done domain groups here should be no problem if you're on a windows machine.

gzevin

> Also, /etc/group has a limitiation of 1K characters to a line

are you sure this is not a vi limit? try vim

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU

nipper

{red]
are you sure this is not a vi limit? try vim

No it is not a VI limit. It is the groups file or useradd command, this is
all scripted so I see the error.

gzevin

aaaaaaaahhhh.. Ok then Smiley Happy

thanks

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU

Johnny

One question I have with ts groups is how security is handled for scripts (EG custom menu item, external tasks etc) that interact with the file system as most traditional scripts would.

EG

I have a branch/workarea and directory controlled via tsgroups.

Under the operating system - if I understand correctly - they would all appear as one default group (tsgroup?).

If that is what I can see, then I assume that is what an external task would see running on behalf of the owner of the task. Does that mean that the traditional way of determining file/directory permissions for that user is no longer valid? .. Would we then have to rely solely on CS SDK rather than interacting with the file system? If so, how will traditional teamsite scripts (EG iwpt_compile) work in these situations?

And what about our custom webserver - will the proxy allow/deny against the tsgroup system or OS group system?..

TS 6.5
Solaris 5.8

John Cuiuli

Johnny

These two posts 1 , 2 cover most questions.

In short - you'll have to re write anything that relies on the file system.

1. how templating (iwpt_compile) handles this
2. how the proxy handles this
3. does OD understand tsgroups yet?

I'm still not sure about those three.

John Cuiuli