nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

branch security

cheeku

Hi ,
I have made the branch_security=on & workarea_security=on in my iw.cfg file to restrict the branch & workarea from users who don't have access in that branch. But branch security is not functioning. For Workarea it is fine. Can anyone help me?

Find more posts tagged with

Comments

Sailesh

Have you checked that user do not have read access to that branch?

cheeku

Yes I have denied the read access but then also branch is visible

kaalraa

Hi ,
I have made the branch_security=on & workarea_security=on in my iw.cfg file to restrict the branch & workarea from users who don't have access in that branch. But branch security is not functioning. For Workarea it is fine. Can anyone help me?

Both the security features work when the user does NOT have any access over Branch and Workarea. Not even the read access.

In your case, check what are the access rights for the defined user on branch or if the user is a member of any such group which has access to branch.

kaalraa

Yes I have denied the read access but then also branch is visible

Have you checked the group members as well? If yes, then please provide the code snippet of iw.cfg where you have defined the security features to 'ON'.

Adam Stoller

Yes I have denied the read access but then also branch is visible

Some questions come to mind:

There may be more - but those should help narrow down the issue a bit.

cheeku

Is there any option in teamsite(front end) by which we can restrict the read or write property on any branch

Sailesh

What version of Teamsite?

kaalraa

Is there any option in teamsite(front end) by which we can restrict the read or write property on any branch

I don't think so if the user does not have a master role.

cheeku

I can log in as Master. So Is there any option in teamsite that while creating a new branch I can restrict any user from read/write access

cheeku

[QUOTE=ghoti]Some questions come to mind:

TS is 6.5User log in as editorUser is not a member of that group

kaalraa

I can log in as Master. So Is there any option in teamsite that while creating a new branch I can restrict any user from read/write access

There is nothing like "Grant to group A except User Z". The only thing you can do is that User Z should not be the member of Group A and the User should not be granted any access rights explicitly.

cheeku

This thing I have already implemented.The user is not the member of the group then also he his able to see the branch

kaalraa

This thing I have already implemented.The user is not the member of the group then also he his able to see the branch

Hi,

Have you checked the issue of displaying the branch with any other who also does not have read access to that branch.

Also provide the snippet of the code from iw.cfg file... where you have changed branch and workarea security to 'ON'.

cheeku

Yes I have checked with other members also. They also are able to see the branch. One thing I am not able to understand is that for Workarea security is working but why not for branch.

[iwserver]
server_locale=English_UnitedStates.MS1252@Binary;
cachesize=30000
rpc_threadcount=64
fs_threadcount=2
thruputmonitoring=off
thruputmonitor1=1 # 1 minute
thruputmonitor2=15 # 15 minutes
thruputmonitor3=60 # 1 hour
thruputmonitor4=480 # 8 hours
thruputmonitor5=1440 # 24 hours
thruputmonitor6=2880 # 48 hours
thruputmonitor7=5760 # 96 hours
thruputmonitor8=-1 # forever
disklow_mbytes=50 # freeze server if disk space falls below this number (in MB)
disklowpercent=2 # freeze server if disk space falls below this pct
main_lock_model=submit_lock
main_owner=Administrator
main_group=Administrators
event_log_size=64
branch_security=on
workarea_security=on

homesick123

Is there any option in teamsite(front end) by which we can restrict the read or write property on any branch

Try using submit.cfg for this purpose.

cheeku

Try using submit.cfg for this purpose.

What change shall I make in submit.cfg?

Adam Stoller

What change shall I make in submit.cfg?

The submit.cfg file is used to set permissions on files and directories within the workarea (staging, edition) when those files are submitted and/or the directories are submitted for the first time.

This is not the same thing as setting the permissions on the branch and/or workarea itself such that branch and workarea security will be able to hide the branch and/or workarea from view of people who are not supposed to have access to them.

Am I correct that this is a Windows environment?

- what do you see as results?

cheeku

[QUOTE=ghoti]

Am I correct that this is a Windows environment?

Yes I have webserver_group entry in my iw.cfg & the group exist on my server. On reunning the command it displays the groups having permissions.It also displays"Everyone" groupNow if I make branch_default_perm=0 in iw.cfg then it will not give permission to "everyone" group. It will solve my purpose. But it does not affect the already created branches.So Can anyone tell how to remove "Everyone" group. Is there some command line tool for that.If I remove "Everyone" group from file properties or deny the permissions then It does not allow anyone to open the folder.

Adam Stoller

Yes I have webserver_group entry in my iw.cfg & the group exist on my server. On reunning the command it displays the groups having permissions.It also displays
"Everyone" group
Now if I make branch_default_perm=0 in iw.cfg then it will not give permission to "everyone" group. It will solve my purpose. But it does not affect the already created branches.
So Can anyone tell how to remove "Everyone" group. Is there some command line tool for that.If I remove "Everyone" group from file properties or deny the permissions then It does not allow anyone to open the folder.

My guess is that the webserver_group group did not exist before the initial reboot of the TeamSite server after installation. If the group doesn't exist, TeamSite uses Everyone to fill the purpose, and so any branches or workareas that were created prior to that group being created will have Everyone access on it.

Note: do not get confused about Everyone access on intermediary TS directories like Y:\, Y:\default, ...\STAGING, ...\WORKAREA, and ...\EDITION - there's a fairly recent Support KB article about that.

While you can fix permissions on the workarea (Y:\default\main\...\WORKAREA\wa_name) via the Windows Explorer or cacls command, I don't recall if you can fix the permissions on a branch (Y:\default\main\****) via those mechanisms. You may need to re-create the branch and transfer the content in order to do so (but try changing it first to save the hassle if possible). Again this is just with regard to the branch direcory itself - not recursively through its sub-directories.

You can also check with Support - it's possible that an iwmigrate into a new store and then back into the default store will fix the problem, and it's certainly worth a try...