Creating Roles

HI All,

I Have a requirement to create 3 roles like role1, role2, role3, in such a way that role2 can add/delete role1 users and role3 can add /delete role2 users.

could you please tell me how to procedd on this?

let me know if i am not clear.

Regards

Swarup

Find more posts tagged with

Comments

DCTM_Guru

If you use DA to create role objects, there is an attribute called "administrator". Once you create role3 object and are in the process of creating role2 object, assign role3 as administrator of role2. Repeat with role1 object.

Also, please move this thread one to the Documentum Developer Network. Select "Move discussion" from the Actions menu and choose the appropriate forum, as described in the Guidelines. EMC is trying to have technical questions posted there:

https://community.emc.com/community/edn/documentum?view=discussions

gyanus

Hi Johnny...Thanks for the reply..

I did exactly what you said i.e., I assigned role3 as administrator of role2 and role2 as administrator of role1.

But when I login to DA/Webtop with members(users)of role2, I am able to remove members from role3 and i am also able to delete the role3. This should not happen since my requirement is that role2 members can delete only role1 members and not role3 members. Also role3 members should have the privilege to delete both role1 and role2 members.......

Waiting for ur reply.......

DCTM_Guru

Please move your thread first. My response was based on whats in the documentation. Make sure your client capability and privileges for your users are not set to sysadmin or superuser.

gyanus

Hi Johnny,

My requirement is that :

a) The members of role2 can delete members of role1and not members of role3.

b) And the members of role3 can delete both members of role2 and members of role1.

But as you mentioned that client capability and privileges for the users of role2 should not be set to sysadmin and superuser respectively, then the Administrator node will not be visible for the users of role2 when they login to DA/Webtop. So users of role2 won't have access to Administrator node and thus my requirement a) is not met.

DCTM_Guru

"then the Administrator node will not be visible for the users of role2 when they login to DA/Webtop."

- Look at Administrator Access feature in DA User Guide.

gyanus

Thanks for reply Johnny......

I have set Privileges to Create Group and Client Capability to Coordinator for the members of role2. Now the Administration node is visible.

Now I can delete role1. But the problem is that I can't create users and also I can't delete members of role1.

The requirement says that the members of role2 can delete members of role1.

Could u shed some light on how to achieve this..?

Thanks in advance

Regards

Swarup

DCTM_Guru

You probably have to customize the component if its not meeting your requirements.

gyanus

Thanks for reply Johnny......

I had set Privileges to Create Group and Client Capability to Coordinator for the members of role2. Now the Administration node is visible only in DA but not visible in Webtop. But i need the Admin node to be visible in webtop..

Plz reply asap.....

Thanks in advance

Regards

Swarup

BrooksV

Hi Swarup,

Did you find a solution yet?

I am working on doing almost the opposite as you but instead of Roles, I am working with Group memberships.

In doing research and discovery, I found you can give access to the "Administration" interfaces in several ways.

DA Only Method:

If you do not see the "Administrator Access" node in DA, then the AdminAccess.dar was not deployed. See Documentum Composer docs for details on how to deploy DAR files.In DA, below Resource management is a TreeBrowser Node called "Administrator Access".Create a "Administrator Access Set" (File->New->Administrator Access Set). This is where you can force members of a Role to have access to specific Administration Functions such as "User Management" which will activate them in DA Administration. - The User will have no priviliges to do anything unless you grant "Create Group" or "System Administrator" or whatever is appropriate for what you need then to do.

Webtop Method #1:

When a User has the Client Capability: "System Administrator"

- The "Administration Shows" Node show up in the Tree Browser

- The User will have no priviliges to do anything unless you grant "Create Group" or "System Administrator" or whatever is appropriate for what you need then to do.

Webtop Method #2:

Add the User or Role to the Role called "dce_user_manager". This will enable the "Administration" Node on the Tree Browser.

- The User will have no priviliges to do anything unless you grant "Create Group" or "System Administrator" or whatever is appropriate for what you need then to do.

Webtop Method #3:

Use a Action Item such as a menu Option or some other control enabled action.

To Add a Group List menu Item to the Tools menu (I have not tested this yet with the "rolelist" component but it should also work):

Create file ./custom/config/MyGroup_menubar_component.xml

Create file ./custom/config/MyGroup_actions.xml

< config version="1.0"> <scope> <action id="dppAdminGroup_action"> <desc>Displays the Administration->User Management->Groups dialog page to add, delete, and manage group memberships</desc> <execution class="com.documentum.web.formext.action.LaunchComponent"> <component>grouplist</component><navigation>jump</navigation></execution></action></scope></config>Refresh the components, test via Tools Menu->Group AdministrationRemember that the user must have at least "Create Group" Privilege.QUESTIONS:

If you have discovered other ways to activate Webtop Administration TreeBrowser Nodes, please let me know.

Does anyone know the best approach to set the Scope or a Filter so the "Group Administration" menu item only shows if the user has the privilege to perform group Administration?

Does anyone know how to give a user the ability to Manage Group Memberships without giving them ability to Create and Delete Groups?

I used a preset to Exclude the option File->New->Group which works great but to prevent the user from Deleting a Group, there is only "File->Delete" listed. Granting this will also prevent this user from deleting anything via "File->Delete" such as Documents they own.

Does anyone know any work-a-rounds?

Regards,

Brooks

lastnitescurry

Thread hijacking is very bold. Yes you do have some info (new and intersting) but you should create your own thread for your questions. Cross link them no problem.

I am not intersted in Swarup problems but as Brooks posted some interesting info about something I have not seen before.

I could not get the DA Only Method to work on my bare bones D6.7 repository. Only the default apps are installed

_references, BPM Runtime, TCF, Default XML Application, Smart Container, Webtop, Workflow
Presets, Webtop Express, AdminAccess, ResourceAgentsRegistry, LDAPDocApp
DCS Attachments,MessagingApp,Lifecycle,ATMOSProject,Extended Search - Clustering
Extended Search - SearchTemplates,IndexAgentDefaultFilters

Disable Group delete or create. Search for notdefined in webtop xml configs, for example:

<!-- disable actions against dm_folder -->
<action id="versions" notdefined="true"></action>
<action id="renditions" notdefined="true"></action>
<action id="view" notdefined="true"></action>
<action id="editfile" notdefined="true"></action>
<action id="checkin" notdefined="true"></action>
<action id="checkout" notdefined="true"></action>

The attached config will display a groups node and remove the create, delete, rename (reassign) actions. But group member ship editing is not available as that requires some unusual scopes like "dm_member_group". Also the user can view user actions (like rename) so they would also have to be disabled. Also the breadcrumb gives a path back to the User Management Node but as that does not eist, it will explode

Message was edited by: Brian Dinneen

BrooksV

Hi Brian,

I am sorry about hi-jacking this thread. That was not my intention.

I tested "rolelist" component and it worked exactly the same as the "grouplist" component works.

You are a life-saver for your suggestion in modifying my custom actions for "grouplist". It worked exactly as I needed it to work.

The final version of "MyAdminGroup_actions.xml" is:

<? xml version="1.0" encoding="UTF-8" standalone="no"?> <config version="1.0">

<scope role="dpp_group_admin_role" >

<action id="dppAdminGroup_action">

<desc>Allows members of the "dpp_group_admin_role" to manage only memberships. The members of this role are the group "dpp_admin_group".

The folders that are to be managed by the "dpp_admin_group" need to either be the Owner or Administrator of those user groups. Users in the "dpp_admin_group" must be granted at least the "CreateGroup" privilege.</desc>

<execution class="com.documentum.web.formext.action.LaunchComponent">

<component>grouplist</component>

</execution>

</action>

</scope>

<scope type="dm_group" privilege="creategroup">

<action id="newgroup" notdefined="true" />

<action id="delete" notdefined="true" />

<action id="groupreassign" notdefined="true" />

</scope>

</config>

Thanks again for your help.

Regards,

Brooks