User sees more permissions than they should.

We are not using LDAP. We have many Windows Groups and we add Active Directory users into those groups. Then, we set the groups associated to mbin containers. For the most part, it all works well.

However, we have some users that seem to have elevated permissions, they can see EVERYTHING and that's bad. We've spoken to mbin support several times and they have told us that a user is embedded in a group or something that gives them the additional permissions. No love there.

We've combed the specific users' permissions both on the server, Windows Groups, MediaBin, objects in Active Directory security groups, and naa daa.

In fact, we just added two brand new users, never used any of our systems before and they have permissions to EVERYTHING. Has anyone else had this issue or any ideas how to address it?

Find more posts tagged with

Comments

msrinivas

What do you mean (in terms of MB permissions) by they have permissions to EVERYTHING or they can see EVERYTHING?

Does this happen in any other environment like dev or qa?

Is there a common AD group that all these "troubled" users belong to? Have you tried to remove the users from all MB active directory groups?

Migrateduser

Hi Srinivas,

They have permissions to MediaBin to see everything and do whatever they like.

We recently have acquired test server hardware and we are heading down that road to try and reproduce the issue. We haven't had the license or hardware in the past to recreate the issue.

I can see a list of all AD groups that the user is associated with and I have looked at every one of those groups to ensure that it not associated to the Windows box.

Yes, if we remove users from the Windows groups, they will lose their permissions.

So here is an example.

1. We do not setup permissions for User A.
2. User A connects to server and they can't see anything.
3. We grant User A permissions to Windows Group "testing group."
4. The "testing group" only has mb permisissions to one container under the $\Production\Test container where $ represents the ROOT.
5. The user can see everything. Not just the $\Production\Test group.

It seems like the user is part of another elevated permissions group but, we have personally combed through the entire server, all Windows groups, and the AD groups.

Thanks for your assistance.

lyman

Group permissions are handled in AD transitively so if x iis in A and all A's are in B etc. you gain the union of permissions (assuming there are no "deny" clauses here). Unfortunately to my knowledge there is not simple Windows application that will print out all groups to which a user belongs.

Remember that in addition to the security descriptor, one also has to check what users have been made MB Admins.

The resolution of groups for AD is a Windows system call and so there is really no way for it to half work! I am certain if we dig far enough we will find the line of memberships tracing back to a group with access.

Cheers,

Lyman Hurd

msrinivas

Hi Srinivas,

They have permissions to MediaBin to see everything and do whatever they like.

We recently have acquired test server hardware and we are heading down that road to try and reproduce the issue. We haven't had the license or hardware in the past to recreate the issue.

I can see a list of all AD groups that the user is associated with and I have looked at every one of those groups to ensure that it not associated to the Windows box.

Yes, if we remove users from the Windows groups, they will lose their permissions.

So here is an example.

1. We do not setup permissions for User A.
2. User A connects to server and they can't see anything.
3. We grant User A permissions to Windows Group "testing group."
4. The "testing group" only has mb permisissions to one container under the $\Production\Test container where $ represents the ROOT.
5. The user can see everything. Not just the $\Production\Test group.

It seems like the user is part of another elevated permissions group but, we have personally combed through the entire server, all Windows groups, and the AD groups.

Thanks for your assistance.

Do you have any groups nested? As Lyman pointed out check your MBPAdmins MediaBin group. Is the issue with this one "testing group" or does this happen to any group in the AD?

And just to throw it in (you never know) do you have "Everyone - Change" at the root level Smiley Wink

Migrateduser

Hi Everyone,

Just so you know, we figured out the permissions issue. It was as described, it was something on our end.

Thanks for all your help.

msrinivas

Can you get into any specifics?