nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

workarea access control issue

waikong

Hi there,

I am developing using TeamSite 6.5 SP2, and I have a branch which have several workarea (products, promotions, and etc.), and in each workarea, I have one DCT.

[+]branch
   [+]products (workarea)
      [+]tm (category)
         [+]products (type)
            [+]data
            [+]presentation
            datacapture.cfg
   [+]promotions (workarea)
      [+]tm (category)
         [+]promotions (type)
            [+]data
            [+]presentation
            datacapture.cfg

After I press submit the workarea to staging, then do a get Latest. I notice that both workareas are visible is to others.

In the content center, how and where can I configure the permission setting to restrict the user from products not to see the DCT in promotions workarea, meanwhile the user from promotions not see to the DCT in products workarea.

Find more posts tagged with

Comments

Yukka

In the content center, how and where can I configure the permission setting to restrict the user from products not to see the DCT in promotions workarea, meanwhile the user from promotions not see to the DCT in products workarea.

This is handled in the templating.cfg
Check the "Mapping Users, Templates, and Content Records chapter" in the templating guide.

waikong

This is handled in the templating.cfg
Check the "Mapping Users, Templates, and Content Records chapter" in the templating guide.

I doesn't find a way to hide the DCT from different workarea.

Perhaps I didn't elaborate the situation good enough, please allow me to rephrase:

My ultimate goal is to limit the use of a DCT in only one workarea. (e.g products DCT only accessible in Content Center if the author is in the user group that own the products workarea.)

or

How to configure a DCT so that it only accessible within a particular workarea?

or

Is there such a capability?

I not sure which is the correct way to ask this question. Hopefully there are someone can understand what I am trying to ask.

Adam Stoller

Hi there,

I am developing using TeamSite 6.5 SP2, and I have a branch which have several workarea (products, promotions, and etc.), and in each workarea, I have one DCT.
[+]branch
   [+]products (workarea)
      [+]tm (category)
         [+]products (type)
            [+]data
            [+]presentation
            datacapture.cfg
   [+]promotions (workarea)
      [+]tm (category)
         [+]promotions (type)
            [+]data
            [+]presentation
            datacapture.cfg
After I press submit the workarea to staging, then do a get Latest. I notice that both workareas are visible is to others.

In the content center, how and where can I configure the permission setting to restrict the user from products not to see the DCT in promotions workarea, meanwhile the user from promotions not see to the DCT in products workarea.

There are two issues here

If all you were concerned about was #1 above - then hopefully the response previously provided will solve your issue.If, on the other hand, you were concerned about #2 above - you need to re-think your overall design strategy with respect to using TeamSite (either you don't need that degree of differentiation, or you need to use distinct branches, or you need to use some other product)Alternatively - if you were, in fact, talking about branches and not workareas and you're concerned about users from one group being able to see another group's branch's and/or workarea's - and/or if you're confused as to why each branch can see the other branch's DCTs when selecting New Form even though they do not have that DCT within - you need to look up branch and workarea security in the TeamSite Administrator's Guide and/or read more about the templating.cfg in the TeamSite FormsPublisher Developer's Guide (specifically with regard to branch vpath regex's and/or the prune-missing-files attribute).

Sailesh

Hi there,

I am developing using TeamSite 6.5 SP2, and I have a branch which have several workarea (products, promotions, and etc.), and in each workarea, I have one DCT.
[+]branch
[+]products (workarea)
[+]tm (category)
[+]products (type)
[+]data
[+]presentation
datacapture.cfg
[+]promotions (workarea)
[+]tm (category)
[+]promotions (type)
[+]data
[+]presentation
datacapture.cfg
After I press submit the workarea to staging, then do a get Latest. I notice that both workareas are visible is to others.

In the content center, how and where can I configure the permission setting to restrict the user from products not to see the DCT in promotions workarea, meanwhile the user from promotions not see to the DCT in products workarea.

If you just want that user should not able to see each others workareas you need to modify iw.cfg

[left][iwserver]

branch_security=on

workarea_security=on
[/left]

Adam Stoller

My ultimate goal is to limit the use of a DCT in only one workarea. (e.g products DCT only accessible in Content Center if the author is in the user group that own the products workarea.)

Assuming that all three workareas have all three DCTs present (see my previous post if this is not the case) - then the templating.cfg is what you want to concentrate on - read the FormsPublisher Developer's Guide specifically with regard to the templating.cfg and it's vpath regex's and allowed/cred elements.

If you're still having problems with this (after doing the reading) - you will probably have to post your templating.cfg (either as an attachment, or embedded within [html]...[/html] tags)

Yukka

Read the chapter for templating.cfg in the templating guide.

My ultimate goal is to limit the use of a DCT in only one workarea. (e.g products DCT only accessible in Content Center if the author is in the user group that own the products workarea.)

The "allowed" tag lets you set an ACL to specify which users can or cannot use a specific data type. The subelement "cred" lets you name a user, role, or group in the ACL. This might work for you if you have diffenent user groups in your WAs.

or
How to configure a DCT so that it only accessible within a particular workarea?

Setting the prune-missing-files attribute to 't' allows form filtering behavior of TeamSite and controls the list of available forms. This feature lets you filter templates based on workarea and restrict certain users from creating new records. This is done via the locations tag, because the branch tag is useless in your case.

This may slower the "New Form" functionality.

Regards,
Oliver

waikong

If you just want that user should not able to see each others workareas you need to modify iw.cfg
[left][iwserver]

branch_security=on

workarea_security=on
[/left]

I've tried to turn it "on" but when I login as products author, I still be able to see both DCT.

could that because I already did a get latest earlier, so workarea not contain both DCT?

waikong

The "allowed" tag lets you set an ACL to specify which users can or cannot use a specific data type. The subelement "cred" lets you name a user, role, or group in the ACL. This might work for you if you have diffenent user groups in your WAs.

I read through the TeamSite Form Publisher Developer Guide Release 6.5 what is stated in there is only set the <allowed> <cred> to user or role.

or did I miss something? would you mind to explain further about that?

Thanks

waikong

Assuming that all three workareas have all three DCTs present (see my previous post if this is not the case) - then the templating.cfg is what you want to concentrate on - read the FormsPublisher Developer's Guide specifically with regard to the templating.cfg and it's vpath regex's and allowed/cred elements.

If you're still having problems with this (after doing the reading) - you will probably have to post your templating.cfg (either as an attachment, or embedded within [html]...[/html] tags)

Thanks ghoti,

I wonder instead of specifying the branches, can we specify the workarea path?

in the same time I also didnt found the <cred> to set the allowed user group syntax.

anyway here is my templating.cfg hope you can address more on this

appreciate your help

regards,
Pang Wai Kong

Yukka

I read through the TeamSite Form Publisher Developer Guide Release 6.5 what is stated in there is only set the <allowed> <cred> to user or role.

sorry, this was introduced in TeamSite 6.7.

Yukka

I wonder instead of specifying the branches, can we specify the workarea path?

try something like this:
[html]

...

...

[/html]

waikong

I am developing using TeamSite 6.5 SP2, and I have a branch which have several workarea (products, promotions, and etc.), and in each workarea, I have one DCT.
...

sorry, this was introduced in TeamSite 6.7.

sorry dude, I mentioned it in the 1st post Smiley Very Happy

waikong

try something like this:
[html]

...

...

[/html]

Thanks Yukka,

I've tried

it filtered out the missing file, but this will only will helps when the Advance user didn't perform the Get Latest to the whole workarea.

I also tried this part, but it doesn't work:
[HTML]

[/HTML]
Do you mean the

locations>

is place beneath the

<data-type>

instead of

Adam Stoller

Thanks Yukka,

I've tried
<templating prune-missing-files="t">
it filtered out the missing file, but this will only will helps when the Advance user didn't perform the Get Latest to the whole workarea.

I also tried this part, but it doesn't work:
[HTML]

[/HTML]
Do you mean the
<
locations>
is place beneath the
<data-type>
instead of
<presentation><template>
?

The suggesting post was incorrect, an effort to be helpful after suggesting functionality that only exists in 6.7, but wrong - as you've already determined.

The directory element is (first) a sub-element of the branch element - not, as shown, a sibling element. And the DTD clearly stipulates that it should only be used when the branch element is placed as a sub-element of the template element (which is for the PTs associated with a data-type, not the data-type itself).

Unfortunately, I believe there is only one supported way to do group-restrictions via the templating.cfg mechanism in 6.5 - which is to manually expand the membership of the group and list each user separately via the aforementioned allowed / cred / user mechanism.

When you upgrade to 6.7+ you'll get the ability to specify groups at that level and can remove all the individual user entries.

You could do some "clever" inline or FormAPI / CallServer code that would prevent users other than those in the group from being able to do anything within the DCT - but it's a "hack" and doesn't really provide a good UI.

Frederik

I believe you can get what you want out of

templating prune-missing-files="t"

, if you apply security

- create 2 groups A and B (OS or teamsite)
- give permissions
rwxr-x--- /templatedata/tm/products
rwxr-x--- /templatedata/tm/promotions
- set group-ownership
A -> /templatedata/tm/products
B -> /templatedata/tm/promotions
- assign users to groups

you would only need one workarea, I believe

You'll need to submit the folders after changing the security, which can only be done via iwsubmit CLT. The gui doesn't permit submitting a folder other than the first time (AFAIR)

EDIT:
this only works on Solaris though... in Windows, the prune-missing-files="t" will hide form types for which the DCT doesn't exists. In UNIX, prune-missing-files="t" will hide form types for which the user can't read the DCT (either missing or not permitted).

waikong

Thanks for your suggestion Frederik, but unfortunately I am working on a Windows environment.

OK I have something new this time:

I have 3 groups of user (A, B, C) then I got a DCT which is intent to be used by 1st & 2nd groups of user (A,

and the 3rd group (C) should not be able to see or use the DCT.

lets say 1st group user owns the A workarea, 2nd group author owns the B workarea, 3rd group author owns the C workarea.

is there any attribute in the templating.cfg file taht we can set to only allow certain WORKAREA (in this case -- A and B but not C) to use the DCT?

[HTML]

[/HTML]

Adam Stoller

OK I have something new this time:

I have 3 groups of user (A, B, C) then I got a DCT which is intent to be used by 1st & 2nd groups of user (A, and the 3rd group (C) should not be able to see or use the DCT.

lets say 1st group user owns the A workarea, 2nd group author owns the B workarea, 3rd group author owns the C workarea.

is there any attribute in the templating.cfg file taht we can set to only allow certain WORKAREA (in this case -- A and B but not C) to use the DCT?

If/when you upgrade to TS 6.7+ - you will be able to use a 'group' attribute for the cred element within the allowed element for the data-type. Until then, there is no supported way to prevent visibility of a DCT at the workarea level (assuming that workareas are truly complete views of the branch's staging area plus modified files).

You can hack work-arounds in which users in group-C would be given a warning and/or all fields within the DCT would be marked read-only for them - but they will still see it as a possible option when they go to create a new form. This then falls back to user-training.