nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Permissions Best Practice

Tim__D

Hello,

At my company there is currently a single group of folks who work on all the websites. To enable this large group to access multiple sites and workareas we have a single local teamsite users group which we have created on both our development an dproduction server. This local group does not contain individual users but a global group that is global to the domain. This allows us to add users to the group easier.

I have a new requirement where a new group of users outside our existing group wishes to control a subset of files within a branch and workarea that has this generic group applied. I cannot simply add these users to our generic group because they should only be able to access this subset of files.

How can I provide access to only certain files / folders within a shared workarea to a different user group? Current users of the branch should have access to everything new group of users should have access to only a few files and folders.

Does this require a new workarea and a new local group?

Find more posts tagged with

Comments

Tbag

Is it out of the question to create a new branch containing just the content that this new group needs access to?

In previous implementations I've done, I've had to balance the pros of containing all the content within 1 branch with the cons of ownership granularity and open deploy configuration flexibility.

If breaking a branch out is out of the question, you can play some games with the submit.cfg's regexs so that any content submitted in that particular directory is owned by a totally new group that your new cluster of editors and the old cluster of editors belong to.

Hope That Helps,
Tom

Tim__D

I would like to avoid creating another branch because as it is we have a lot of branches. Unless my new old users group includes the new users how will they even get access to the branch / workarea to submit the files?

Edited by Tim__D on 12/01/05 07:28 AM (server time).

smenon

You could create a new local group that contains the new users and the global group that you had before. Use this new local group as the group for sharing only on that branch/workarea. Whether or not you create a new workarea for these users is up to you. You could potentially control access to those files by managing the permissions on the assets carefully such that only these new users have access to certain content within that branch/worakrea.

thanks

--Sunil Menon
Sr. Product Manager
Interwoven, Inc.

Tim__D

My challenge is what happens when another group has this same requirement? True a single list of users could be added to the existing local group which also has a global group but this is not scalable if another group is needed in the future because local groups cannot include other local groups. Also in this scenario how would I ensure that certain users only have access to certain files within the branch?

What I have is a shared branch which is currently shared with a local group that includes a global group. All users exist in the global group.

What I need is a branch that has multiple groups with different permissions contributing to it who are limited to what they have access to edit and submit.

I'm not sure that users that are not part of the group applied to the branch / workarea could work in the branch if they are not part of the group and having a branch where everyone is assigned to a single group locally or globally does not meet my privilages requirement at the file level. Make sense?

/images
/js
/pdf/
/flash
/content/group_content_1/??
/content/group_content_2/??

Edited by Tim__D on 12/05/05 12:12 PM (server time).

Tbag

If it is likely that you'll have three or more different logical user groups that you'll need to juggle, drop the submit.cfg like it was a Asian Chicken and resign yourself to multiple branches...they're really not that bad, especially if you have an "all-branch merge" process into some uber-branch that you deploy from. Does this make sense?

Tim__D

It does make sense and based on what I know I could see how that would work. It does create some concerns for me about the management of the branches files and overall workflow.

How about this. I create a branch with no group for sharing. Next I create a workarea for the majority of my users that exist in the nice and easy global group and share that workarea with them. Then I create a new workarea and share that with a different group of users. Could I then allow them access to edit only certain files within that workarea limiting them from editing only certain parts of the site?

jbonifaci

You can set permissions at the directory level as well. So, within a single branch, you have DirectoryA, DirectoryB, DirectoryC and DirectoryD. GroupA has permissions for DirectoryA, GroupB has permissions for DirectoryB, GroupC has permissions for DirectoryC and all three groups have permissions on DirectoryD. This way everyone can contribute to their specific directories and everyone can contribute to the global directory. I would avoid using the branch approach if possible, as it makes virtualization more complex if there is shared content across all of the branches. Remember, KISS.

~Jeff