How to apply dynamic ACL to an object similar dynamic groups ?

chris.edwards

Hi,

I have a requirement to allow a user, access to a document upon request.

The user initially has browse access to the document, but at the press of a button, will be escalated to relate privileges.

I have tried applying this with dynamic groups, and while it partially worked. If the same dynamic group is applied to multiple documents, then the user automatically receives the escalated privileges on all documents with the dynamic group. Until the session expires.

Short of generating a dynamic group for each distinct document, I am at a loss of how to achieve the requirement.

Does anyone have a suggestion, or a view on multiple dynamic groups. I am looking at possibly in excess of 3.75 Billion documents, and at least 10% requiring the dynamic acl/group solution.

Michael McCollough

Would love to know the full use case behind doing this, if all they need do is hit a button to get read/relate access to the object, then why only allow browse off the get-go? If you are looking to know when privs are used, you can use the audittrail to know when a user accesses the content or relates another object to that one.

The only way I can think to address your specific issue would be to:

Get the acl,

Store the name and domain of the acl

Save a copy

Add the user with relate permissions

Change object’s ACL to the new ACL

Upon user completion, set the acl back to the previous ACL

No matter the case, it gets dicey doing this type of stuff due to:

Ensuring acl/perms get set back

What happens if two users want to read the document at the same time?

There may be other ways to better accomplish your goals if you share more details about your use case.