Create new content with only VERSION permissions

I seem to remember reading something about this now being possible but I can't find any information on it. The goal is to allow users with VERSION and Change Folder Links permissions to create a new document but to only be able to version and specifically not check in as the same version.

Find more posts tagged with

Comments

DCTM_Guru

VERSION permission is defined on the ACL that is assigned to the newly created object. If you have the Inherit ACL From setting set to FOLDER, and the parent folder ACL gives dm_owner VERSION permission and Change Folder extended permission, I dont see why you couldnt do this.

Is this a hypothetical question or are you getting a permission error?

Alternatively, you could give dm_owner WRITE permission and customize checkin.jsp to only show checkin as minor or major version (ie hide/delete checkin as same version option).

fainemr

Yes, this is how it is configured.

No error really, just New -> Document in Webtop is not available, it is greyed-out. Those I have asked (in person) have said it isn't possible since creating a new document updates the i_folder_id attribute of the document and that requires WRITE.

RalfKahrl

Maybe the user you are trying to create a document has not the appropriate client capability like contributor or higher.

Have a look at the documentation or at this blog entry: http://kkdocumentumguru.wordpress.com/2011/05/15/authorization-client-capability-and-privileges/

bacham2

You are assuming that the user creating the document will have VERSION permission which is wrong. In any case, it should be sufficient to have "Change Folder Links" on the folder to create a new document in it (I'm talking from the perspective on Content Server). If you don't specify an ACL at creation time, the document will get one assigned based on the Content Server settings (i.e. from the parent folder, user or type). In any case, you should most probably get DELETE permission on it since you are the owner of the document (of course it depends on the ACL).

DCTM_Guru

Strange that New-Document is disabled. I know the action has precondition for client privilege, but I dont recall that it actually checks any permissions, since the permission on the object does not really exist until the object is created (sort of catch 22).

Worst case scenario, you can always write a TBO that changes the permission after the object is created.

fainemr

Seems that I can now create a new document with only version permissions for dm_owner. However, dm_owner cannot attach a lifecycle which is almost understandable:

User has no write permission on the object, is not the owner of the object, or is not a superuser

However, if I'm understanding this documentation correctly then the user should only require CHANGE STATE if the a_bpaction_run_as attribute of the docbase config object is set to Lifecycle Owner, and the lifecycle owner does have permissions to promote, which I am certain is the case. I tried it with a_bpaction_run_as set to superuser but it didn't work.

I'm assuming this is because the superuser account inherits the permissions for the object from the owner who does not have WRITE permission but only VERSION and CHANGE STATE.

https://community.emc.com/message/25820#25814

Which raises the question of why we have this option at all, seems useless if superuser still doesn't have permissions on the object.

Promotion moves an object from one normal state to the next normal state. Users who own an object or are superusers need only Write permission to promote the object. Other users must have Write permission and Change State permission to promote an object. If the user has only Change State permission, Content Server will attempt to promote the object as the user defined in the a_bpaction_run_as property in the docbase config object. In those instances, that user must be either the owner or a superuser with Write permission or have Write and Change State permission on the object.

The bold part is true, thse permissions are granted to the lifecycle owner user by the same acl that gives dm_owner VERSION.

DCTM_Guru

As I stated earlier, it may be easier for you to give users WRITE permissions and just disable checkin as same version. This would solve your promotion issue.

fainemr

Yeah, I'm thinking about doing that and also doing a Post Change action to change the ACL after the document is promoted. My problem seems to always be that the state I want the user to be able to promote the document into requires more permissions than the user has, not the state the document is current in. I guess this is common problem when changing ACLs (PSTs) in lifecycle actions.

DCTM_Guru

"...My problem seems to always be that the state I want the user to be able to promote the document into requires more permissions than the user has."

- I just re-read entire thread, have you tried setting a_bpaction_run_as attribute to install/docbase owner?

fainemr

Yes, it worked a bit too well. Anyone with any sort of access to the content could promote it, and I didn't want that. I want only those with WRITE or CHANGE STATE to be able to promote it. The catch, seems to be that the user's object level permissions in the next state seem to matter just as much as those of the current state. I don't think it should work this way. I should be able to promote a document to a state that changes the ACL to one in which I have no permissions on the document.