nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to make a user with read permission to delete documents

NitinSalian

i have created two roles role1 and role2 and Acl, acl1 with Role1 to basic write permission and role 2 to basic read permission and extended delete permission.

two users user1 assigned to role1 and user2 assigned to role2. when i login as user1, i have write permission on the document, but when i login as user2 in webtop i dont have delete rights, if i try to delete it gives error message as 'unable to delete beause of no delete permission on object'

please let me know where i went wrong.

Regards

Nitin

Find more posts tagged with

Comments

DCTM_Guru

What version of Content Server and Webtop are you using?

Also, please move this thread one to the Documentum Developer Network. Select "Move discussion" from the Actions menu and choose the appropriate forum, as described in the Guidelines. EMC is trying to have technical questions posted there:

https://community.emc.com/community/edn/documentum?view=discussions

NitinSalian

Content Server version is 6.5.0.221

Webtop version is 6.5 SP2

NitinSalian

HI Johny Gee,

Thanks for the reply

I had moved to Documentum Community

is this the correct comunity?

waiting for reply

Regards

Nitin

DCTM_Guru

Did you use Webtop to set the extended delete or was this through DFC? Can you post screenshot of the document permissions tab for that user?

BTW - you should move the thread to : ECN > Developer Network > Documentum

NitinSalian

Hi Johny Gee

Thanks for the reply

I had moved the discussion.

and to be clear my requirement is as follows.

RoleA users should able to create/ update document .

RoleB should be able to read / delete the document.

And folder security is kept on (i dont want to compromise in this, upto last point)

My Implementation.

Created 2 roles rolea, roleb

and created 2 acl folderacl and document acl as follows (created in DA)

folderacl

RoleA basic write permission Extended run procedure, change location

RoleB basic Read permission Extended run procedure, change location,change folder links

documentacl

RoleA basic write permission Extended run procedure, change location

RoleB basic Read permission Extended run procedure, change location,extended delete.

now folder acl is attacched to the cabinet and default acl setting in the server config is set 1 (ensure that default acl flows to all the folders created under this cabinet)

and in tbo of the documenttype, i am attaching the document acl through this.setacl method.

now rolea is able to create/update the document

but now roleb is can do botth create and delete the document, but as i said above roleb should be only to delete the document and not create document.

where i went worng, how to achieve the above?

Regards

Nitin

DCTM_Guru

What happens if you remove the TBO? Since Folder security is turned on, roleB should NOT be able to create documents in a folder, since

folderacl is only giving RoleB basic Read permission.

NitinSalian

Hi Johny

Thanks for the reply

if tbo is removed, the folderacl rights will flow to document also and but now also i guess roleb can create document, because roleb has Extended run procedure, change location,change folder links permission,

but i will try removing the tbo and come back with the result.

Regards

Nitin

DCTM_Guru

Change the folder acl to match the doc acl temporarily. This way you can verify if the security permissions behave as expected.

NitinSalian

HI Johny GeeThanks for the replyExtended Delete cannot be given on folde or cabinet, bcoz any user should not be able to delete the folder or cabinet.so we should have two acl one for folder/cabinet and another for document.folderaclRoleA basic write permission Extended run procedure, change locationRoleB basic Read permission Extended run procedure, change location,change folder linksdocumentaclRoleA basic write permission Extended run procedure, change locationRoleB basic Read permission Extended run procedure, change location,extended delete.now folder acl is attached to cabinet and folder and documentacl is attached to document.now roleb is able to create and delete the doc.i think giving change folder links extended permission is overwriting the basic permission and giving the write permission in the folder, thats why roleb is able to create document.can we achieve the requirement if so could you please post no of acl required and entries in each acl, do we need another acl apart from the above two acl. waiting for replyRegardsNitin

DCTM_Guru

Please re-read my reply - Change the folder acl to match the doc acl temporarily. I suggested this b/c we wanted to eliminate your TBO code from the test scenario. Since your TBO code is the one the assigns the acl, if you set the acl to the parent folder, the inherit acl setting from the server config will propagate the acl to the document from the parent folder (similar to what your TBO would do). This way you can test if the extended delete behaves as it should. Once you have tested this and it works as expected, then the issue must be in your TBO code.

NitinSalian

HI Johny

I had checked that already sorry, if i not mentioned in my previous post.

when i try to attach folder acl to the folders and documents. roleb is not able to delete but able to create document.

when i try to attach document acl to folders and documents, roleb is able to create and delete document.

so extended delete is not working as expected, for delete we have to give checnge folder links extended permission, if this is given user is able to create the doc even he have the basic read permission on the document.

is that what you want to check?

or i am missing anything?

could you please let me know how to proceed? is that we have to diable the folder security to achieve this? even if we disable the folder security how can we stop one role from creating the object of custom object type.

Regards

Nitin

DCTM_Guru

Since you no longer have TBO in your test scenario, you should be able to log support ticket if you believe the extended delete is not behaving as expected.

As for your other question - "how can we stop one role from creating the object of custom object type."

- If you are using Webtop, you can use preset feature to filter out object types by role. Read the Webtop User Manual for more details.

NitinSalian

Hi Johnny

Thanks for the reply

As you said if webtop is used then we can use the preset feature in webtop, But if we create documents using DFC code or web service how can we achieve this problem of security/roles. can we control through condition checking in TBO (in Do Save method)? is it the write approach? or is there any better approach?

And Regarding Extended Delete, how is it expected to work? is it that on having Extended Delete Permission, user can delete the document from the folder, even if user does not have write / change forlder links permission on the parent folder? (when folder security is on)

Regards

Nitin

DCTM_Guru

"...if we create documents using DFC code or web service how can we achieve this problem of security/roles."

- If you are writing your own app, then you can embed your own business logic in the UI layer or web service on what objects are available for which roles.