nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Remove Permissions for Deleted Users

Robert_Anderson_(robanderson_-_(deleted))

I need a report that removes "access list" permissions to documents for deleted users. The only way I can think of doing this--going document by document, looking at the permissions, and looking for any users that are deleted in that list--seems that it would be way too intensive of a query.Is there a simpler way to do this?

Find more posts tagged with

Comments

Robert_Anderson_(robanderson_-_(deleted))

I know that by nature a deleted user won't be able to access anything. The reason we're doing this is to clean up the permissions in livelink.

Robert_Anderson_(robanderson_-_(deleted))

I want to remove deleted users from the access lists, not just remove all of their permissions.

Appu_Nair

First off removing users from dtreeacl and dtree using SQL updates is not a very good idea.If this is intended as house keeping one would simply write out all these document dataid's to a file and using lapi,oscript or webservices (yes it is out) do exactly the steps that you manually are doing currently.Do you actually put user's in the objects ACL most livelink organizations use groups so it is easy for them,if you delete the user from the group,there is really nothing to maintain on the objects ACL.The chores I performed when i was a sysadmin is I would reassign all tasks to the deleted user,remove him/her form any nested groupsclean up the personal workspace etc etc.I don't think I ever saw anything in my folder structure that said [jane doe delete]Wait somebody might be able to help you more simply,I just don't like attacking the livelink database if I can.

Jim_Coursey

Message from Coursey, Jim <jim.coursey@ngc.com> via eLink

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">eLink

The more you can use groups for permissioning and the less you give individuals direct permissions on items, the fewer clean up problems you have. Assigning individuals permissions on objects should be a rare exception.

For your container structure, there should be a roughly corresponding group "structure"

From: eLink Discussion: Livelink LiveReports Discussion [mailto:livereportsdiscussion@elinkkc.opentext.com]
Sent: Wednesday, June 25, 2008 9:07 AM
To: eLink Recipient
Subject: More clarification

More clarification		Posted by robanderson (Anderson, Robert) on 06/25/2008 09:03 AM
In reply to: Remove Permissions for Deleted Users		Posted by robanderson (Anderson, Robert) on 06/25/2008 08:54 AM

I want to remove deleted users from the access lists, not just remove all of their permissions.

Robert_Anderson_(robanderson_-_(deleted))

We are fully aware that we shouldn't have been putting users themselves in the access lists, and are working to fix this problem (using only groups). However, right now we still do have a number of single deleted users in access lists, which is what we're trying to fix. A relatively large number of documents/folders have this problem, and to fix it manually would be quite the task.

Jeff_Brown_(G*_ECM_Champ)

Do you have specific permissions that are supposed to be applied to folders, or do you allow users to change their own permissions?If you have specific high level permissions that should be on a folder and subfolders (and items), you could try using the "Edit permissions of sub-items" and "Clear existing access lists of sub-items" and then reapply the "correct" permissions and push them down. However, this won't work if your users have gone helter-skelter and permissions are all over the place. There might be some external modules for this or maybe use LAPI?This is one of the nasty surprises that Livelink Admins get stuck with. Most places I've seen don't allow end users to set their own permissions and restrict the setting of permissions to "groups" only.

Robert_Anderson_(robanderson_-_(deleted))

Is there a way to automate cleaning up these permissions?

Jim_Coursey

Message from Coursey, Jim <jim.coursey@ngc.com> via eLink

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">eLink

I believe serious problems with having users with individual permissions should be solved in the sequence:

1. (It should be relatively straight-forward to) Analyze the structure and determine what groups you need to provide view and add/update capability with the same group having the same permissions throughout contiguous workareas with homogeneous viewers or updaters then give those groups. Create the groups and assign the appropriate permissions.

2. (It should be relatively straight-forward to) Assign group leaders for those groups to a lead person within the workarea each group has permissions on.

3. (It should be relatively straight-forward for) Workarea admin to add customview messages to let people know who controls group membership for the workarea.

4. (It should be relatively straight-forward) In Oracle to write a query which would walk the structure and remove anyone with user-level (i.e. not by group) permissions. Anyone who has a continuing need for a level of access to workarea(s) can contact the applicable group leaders to be added to the appropriate group(s). If you give them URLs in their work areas that point to the Add/Remove User menu for that group, it will be very easy for the group leaders to maintain membership in the groups for which they are responsible.

"It should be relatively straight-forward ..." is with respect to manually browsing the entire structure to locate and fix all the permissions problems. Depending on the size of your instance and the prevalence of user-level permissions, the above may probably still be a lot of work even if it is straight-forward, especially if your permissions need to be highly granular.

Robert_Anderson_(robanderson_-_(deleted))

I'm sorry, I should have stated this sooner. We currently have over 2 million objects and over 9000 users. So, tackling that is quite a headache.

Jeff_Brown_(G*_ECM_Champ)

I'm not a developer, but what I would do is develop an agent-like program that will crawl through your Livelink instance and update/remove permissions according to some basic logic rules. These rules might be something like "if object owner = deleted then replace owner with Admin and apply parent folder ACL" or "if object ACL contains deleted user then remove user" or "if object ACL contains deleted user (only) then remove user and add parent folder ACL. Changes made by the agent get written to a log and you manage the exceptions to the rules.

Robert_Anderson_(robanderson_-_(deleted))

Can anyone recommend a pre-developed tool that we might use as a solution?

Jamie_Hari

Perhaps along this line, you could use LAPI (or Web Services for Livelink 9.7.1) to create an application which recursively traverses your hierarchy, checking-for and adjusting permissions, as necessary.I would also like to mention that while read-only database queries may be able to generate the information you are looking for, writing to the database is unsupported and can cause all sorts of adverse effects.For more information on how to make such a LAPI application, our Global Services could be consulted, if necessary.Jamie Hari, OTLSAProduct Specialist, SDK SpecialistOpen Text

Serge_van_Lith

Hi Robert,I don't know if anybody has answered your question yet directly but I think I can assist in this matter.Open Text Technical Services has created a module called the Deleted User Cleanup Module which does exactly that.The module allows an administrator to select a deleted user and assign all documents owned by that user to the target user. It also creates a shortcut to the deleted users personal workspace.If you want I can send you the fact sheet for the module?Let me know,Regards,Serge van LithTechnical Consultant Open Text

NATS_Support

I'd like details of this module please,Thanks,Louise

komments

Message from Greg Kellogg <gkellogg@opentext.com> via eLink

eLink

Serge,

Could you send me a copy of that module aswell? Is there any documentation that comes with it? Does it work for the 9.7.1version? Thanks in advance.

Greg Kellogg

(361) 815-8950

From: eLink Discussion: Livelink LiveReports Discussion[mailto:livereportsdiscussion@elinkkc.opentext.com]
Sent: Tuesday, November 04, 20085:42 AM
To: eLink Recipient
Subject: Hi Robert,

Hi Robert,		Posted by svanlith (van Lith, Serge) on 11/04/2008 06:37 AM
In reply to: Can anyone recommend a pre-developed tool that we might use as a solution?		Posted by robanderson (Anderson, Robert) on 06/26/2008 03:58 PM

Hi Robert,

I don't know if anybody has answered your question yet directly but I think I can assist in this matter.
Open Text Technical Services has created a module called the Deleted User Cleanup Module which does exactly that.

The module allows an administrator to select a deleted user and assign all documents owned by that user to the target user. It also creates a shortcut to the deleted users personal workspace.

If you want I can send you the fact sheet for the module?

Let me know,

Regards,

Serge van Lith
Technical Consultant
Open Text

Lee_Butler

Message from Lee Butler <lbutler@opentext.com> via eLink

eLink

Hi,

Per a request from Tim a while back we added the ability set thedocument owner via the WebReports NODEACTION sub-tag.

From WebReports 5.0 you will be able to do [LL_REPTAG=DATAIDNODEACTION:OWNEDBY /] to change ownership. This means all you need to dois create a LiveReport that returns items from the deleted items volume for aspecific user or users and apply the action sub-tag above.

Thanks,
Lee.

From: eLink Discussion:Livelink LiveReports Discussion[mailto:livereportsdiscussion@elinkkc.opentext.com]
Sent: Tuesday, November 04, 2008 2:27 PM
To: eLink Recipient
Subject: RE Hi Robert,

RE Hi Robert,		Posted by gkellogg (Kellogg, Gregory) on 11/04/2008 08:26 AM
In reply to: Hi Robert,		Posted by svanlith (van Lith, Serge) on 11/04/2008 06:37 AM

Message from Greg Kellogg <gkellogg@opentext.com> via eLink

Serge,

Could you send me a copy of that module as well? Is there any documentation that comes with it? Does it work for the 9.7.1 version? Thanks in advance.

Greg Kellogg

(361) 815-8950

From: eLink Discussion: Livelink LiveReports Discussion [mailto:livereportsdiscussion@elinkkc.opentext.com]
Sent: Tuesday, November 04, 2008 5:42 AM
To: eLink Recipient
Subject: Hi Robert,

Hi Robert,		Posted by svanlith (van Lith, Serge) on 11/04/2008 06:37 AM
In reply to: Can anyone recommend a pre-developed tool that we might use as a solution?		Posted by robanderson (Anderson, Robert) on 06/26/2008 03:58 PM

Hi Robert,

I don't know if anybody has answered your question yet directly but I think I can assist in this matter.
Open Text Technical Services has created a module called the Deleted User Cleanup Module which does exactly that.

The module allows an administrator to select a deleted user and assign all documents owned by that user to the target user. It also creates a shortcut to the deleted users personal workspace.

If you want I can send you the fact sheet for the module?

Let me know,

Regards,

Serge van Lith
Technical Consultant
Open Text

<hr

[To reply to this thread, use your normal E-mail reply function.]
Topic:	Remove Permissions for Deleted Users
Discussion:	Livelink LiveReports Discussion
Livelink Server:	knowledge-wlweb01

To Unsubscribe from this Discussion, send an e-mail to unsubscribe.livereportsdiscussion@elinkkc.opentext.com.