nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Full text index search and permissions

Imran_Yusubov

Hi All,

I have some questions regarding to full text search.If a user have none permission on a folder but read permission on the documents inside of the folder, will that user be able to find the documents with search and read the documents inside that folder.If yes, is there a better way to disable this.

Thanks in advance

Find more posts tagged with

Comments

DCTM_Guru

Unlike windows, folders in Documentum are virtual. This means that search engine searches only documents and does care which folder (or subfolder) the document resides it. If you dont want a user to find the document, you need to define the security on the document appropriately. Start with dm_world - NONE and make sure that the user doesnt belong to any additional groups you add to the ACL.

Imran_Yusubov

Hi,

My requirement is like that.If I create a document only I should have delete and my default group should have version permit.If I send the document to another department the the group of this department also should see it.I have created different acl for each case and update the acl every time when the department changes.But I guess there will be thousands of different acl-s for each case.Too much load on the system but there is not an other option i think.

Thanks

DCTM_Guru

Instead of precreating manually created ACLs, you can have the Content Server generated system ACLs (ones that start with dm_). There is Grant permissions activity template in one the xCelerators on Developer Site. Obviously, this will still generate thousands of different ACLs, but this isnt any different from limiting access via ACL on a folder - you still have to set ACL on folder to give various groups access.

Imran_Yusubov

I have created a template acl using Composer with dm_world none, dm_owner delete p.Whenever a new case is created I create a new acl from the template using Create ACL activty and call it "cb_case_number" then I apply it too all of the case objects, also copy it's id to a process variable.Then using the Alter ACL activty I update the new ACL (not the template ) and add new groups/users to it.One acl per each case.Is that ok?

DCTM_Guru

As you stated before, this can potentially generate thousands of ACL. This is NOT best practice, since 1) its hard to manage (you always have to open the ACL definition to see who has permissions), 2) having thousands of ACLs will eventually start impacting the system, and 3) you cant programmatically change the ACL in the future without having to create new ones using grant/revoke commands. Ideal security is to have predefined manually created ACLs. You mention dept in your use case. Is there a reason why you cant define a dept level ACL and use this in your workflow instead of generating one on the fly?

Imran_Yusubov

There are 22 departments.If one document will route from dep1,dep2,dep3 then this three departments should see it and others not.If it will got to dep1,dep2,dep3,dep4 then dep4 also should be able to see it and all of the previous departments also should see it.So how can I define dept level ACLs .It would be a huge number if I calculate all different cases.Is there any better approach? Also it is not predictable from the workflow where the case will go to because everything is add-hoc routiing based.

DCTM_Guru

I would go back to the business analyst and ask why the other depts should see it or not. Most users intuitively dont want to share, but then if you ask why, they dont have a valid answer. Most of the time, you can move the security model from dept level to a division level, where there are less numbers.

Imran_Yusubov

Oh Johnny there are no business analysts.I am the developer,analyst,administrator,business analyst architect.I am doing everything and there are just some "paper people" which hard to make them to understand and work with.They don't want to understand .

Actually the situation in here is different.The divisions are included in departments so they are more, each department has 2 or more divisions.

But I plan at most there will be 20 000-30 000 different cases for the next 5 years.And I will archive them after 5 year and delete the acls with a job or something.Hope content server will be able to handle so many acls.But the good news is that we have quite powerfully servers.I have calculated the required hardware using DCTM sizing guide which tells that we need 4 times less hardware resources than we have now.And some more servers can be purchased and added to the system.

Imran_Yusubov

I hope that will not be a problem for documentum since EMC says it can handle bllions of objects so about 30 000 acl-s and about 100 000 documents should bee noting for it.