¿Capabilities for publish only instances of a set of content types?

Hi, I have a problem:

I have several content instances of a content type associated to different VCM sites. The problem is that if the user of site A publish an instance that is already associated to site B, the instance is also published to site A and site B so and I dont want that the user could publish this kind of instances.

I wanted to avoid that users can publish instances of this particular content type but I dont find the capabilities to achieve this.

How could I resolve this problem?

Thanks to everybody!!

Find more posts tagged with

Comments

Mario_DAnna

You don't publish to a site, you publish to a stage. My suggestion is to split your sites to different stages according to your user model and grant/deny publish capabilities to all sites belonging to a certain stage.
M

From: eLink Entry: Discussion Group - Web Experience Management <v7webcontentmanagement@elinkkc.opentext.com>
To: eLink Recipient <devnull@elinkkc.opentext.com>
Sent: Wed Apr 06 11:00:44 2011
Subject: ¿Capabilities for publish only instances of a set of content types?

¿Capabilities for publish only instances of a set of content types?

Posted bydavid_garciagonzalez@ieci.es (García González, David)On 2011/04/06 04:56

Hi, I have a problem:I have several content instances of a content type associated to different VCM sites. The problem is that if the user of site A publish an instance that is already associated to site B, the instance is also published to site A and site B so and I dont want that the user could publish this kind of instances.I wanted to avoid that users can publish instances of this particular content type but I dont find the capabilities to achieve this.How could I resolve this problem? Thanks to everybody!!

[To post a comment, use the normal reply function]
Forum:	Discussion Group - Web Experience Management
Livelink Server:	knowledge-wlweb01

David_GarcAa_GonzAlez

Yes, you publish to a stage but the problem is that all the sites has the same stage and I can't change this :-(

Is there any other way to prevent the users to publish this kind of contents or the contents inside a channel? Pehaps disabling the Publish button?

Thanks.

Srinivasa_Rao_Nalluri

1) Try:VCM:DEPLOY_AND_UNDEPLOY to DENY for a user group from the channel -> security -> advanced -> group -> add the group and set the capability.

2) You can protect site A or Project A by adding the groupA.

Tomas_Briceno_Fernandez

Hola David,

Please understand that, in practice, content is not published to sites but to stages. Thus, users having different capabilities for publishing/deploying in sites that share the same stage, can create a false sensation of security.

The user may be unable to publish in site A but, if he can do it in site B and both sites deploy to the same stage, he can get the content published. If the content already had channel assignments for site A those will be published too and there’s no way to avoid it.

Regards,

Tomás

David_GarcAa_GonzAlez

Thanks Tomas, but, Is there no way to avoid publishing with a trick like disabling the "Publish" button?

David_GarcAa_GonzAlez

Quoted Srinivasa Rao Nalluri (srinivasa.nalluri@foxnews.com) on 2011/04/08 09:49:

1) Try:VCM:DEPLOY_AND_UNDEPLOY to DENY for a user group from the channel -> security -> advanced -> group -> add the group and set the capability.

2) You can protect site A or Project A by adding the groupA.

Thanks, I have tried this, but with this capability you can ensure the user can not publish the site, but the user stil can publish the contents inside the channel.

Thanks.

Tomas_Briceno_Fernandez

Hola David,

There are a number of possible ways to avoid that the user publishes in site A (the one we want the user not to publish). But, what do you plan to do with site B? Do you have the option to deny the user publish capability to all sites?

Regards,

Tomás

David_GarcAa_GonzAlez

Hola,

In site B, there is a special group with the capabilites to publish these type of content intances, and I wanted that this group was the only group that could publish/unpublish these content instances in all the sites that they were associated. Is this possible with only a stage?

Tomas_Briceno_Fernandez

Ahhh, ok. I think there was some misunderstanding on this.

If what you want is to have a set of users to control publishing then you have to make sure they belong to a group that:

1.- Has a role assigned that contains VCM:DEPLOY_AND_UNDEPLOY and VCM:SITE_PUBLISH capabilities.

2.- Is authorized in the site and the channel

The rest of the users should belong to groups that DOESN’T include that capability.

Regards,

Tomás

David_GarcAa_GonzAlez

Yes, but If I apply this security, the users of site A could not publish any kind of content instance, but they must publish/unpublish every content instances of all types except of this special one. I wanted to avoid the users to publish the contents of a special content type or the contents of a special channel.

How could I achieve this?

Thanks.

Srinivasa_Rao_Nalluri

Hi David,

You can apply capability to specific channel also as I said above. And did you try by removing Your_CTD_MODIFY capability for the users who shouldn't above to publish this type's content?

thanks

David_GarcAa_GonzAlez

I have tried to remove the capability VCM:DEPLOY_AND_UNDEPLOY to one channel and the "Publish" button is disabled for that channel but not for the contents inside that channel.

I have also removed the capability CT_MODIFY but the users can still publish the contents because they are not modifying the content.

How could I remove the capability to publish only the content instances of an special content type? Do you think is it possible in Vignette to achieve this?

Thanks.

Srinivasa_Rao_Nalluri

David,

If they don't have access to the project where this content is there, then they can't publish this content.

thanks

Srini

David_GarcAa_GonzAlez

Quoted Srinivasa Rao Nalluri (srinivasa.nalluri@foxnews.com) on 2011/04/11 09:59:

If they don't have access to the project where this content is there, then they can't publish this content.

No, they have access to the project where these contents are stored because they have the capability to assocciate these contents to the channels of their site.

I think the solution is one of these 3:

a) Configure one stage for every site. (Imposible in my case).

b) Deny the capability to some users to publish the contents of one special content type. (I havent found how to achieve this).

c) Deny the capability to some users to publish the contents inside one channel. (I havent found how to achieve this, if I deny the capability DEPLOY to the channel, the users can't publish the channel, but they can still publish the contents of the channel).

Anybody knows how to achieve option b or c?.

Thanks.

Tomas_Briceno_Fernandez

Hello,

Going through your options:

a) Configure one stage for every site. (Imposible in my case).

Forget about this. This is a solution to a problem different from yours. It was a misunderstanding.

b) Deny the capability to some users to publish the contents of one special content type. (I havent found how to achieve this).

You haven’t found how to do this because this can’t be done. VCM was never designed to do that.

The advanced security settings of objects do not involve CBS (container based security), that is, they do not get automatically applied to the contents as it happens with the Authorized groups. Therefore, I guess you’d need to apply the settings one by one to each of the objects you want to secure. If this works this could be automated with a MOPrePresistence.Create listener.

Regards,

Tomás

David_GarcAa_GonzAlez

"The advanced security settings of objects do not involve CBS (container based security), that is, they do not get automatically applied to the contents as it happens with the Authorized groups. Therefore, I guess you’d need to apply the settings one by one to each of the objects you want to secure. If this works this could be automated with a MOPrePresistence.Create listener."

Thanks!!,

I am trying to deny explicitily the capability VCM:DEPLOY_AND_UNDEPLOY to a group of the user, but the user still can Publish and Unpublish. If I deny the capability: VCM:CONTENT_TYPE_NAME_READ, the user cant open the content instance.

Am I denying the wrong capability?

What is the capability that permits and denies the publication of content instances?

Are these capabilities applied instantly or they must wait for a deployment process that applies the security?

Thanks.

Michael_Gallant

I believe that the publish capability SITE_PUBLISH is defined at the ROLE and not specific to content types.

Michael

David_GarcAa_GonzAlez

I am reviewing the documentation about this. In VCM 7.5 Administration Guide. Section "Understanding Default Roles and Capabilites", page 191:

To Publish or unpublish a:

• Channel

• Content item from within a site or channel (including from within a site’s default channels)

• Site

You need the required capabilites:

VCM:SITE_PUBLISH which also requires these implied capabilities:

• VCM:DEPLOY_AND_UNDEPLOY

• VCM:PROMOTE_AND_DEMOTE

• VCM:SNAPSHOT_CONTENT

The VCM:SITE_PUBLISH capability is defined in the Role based capabilities. If I assign this capability to a group, the group can always publish all the content instances and channels of the site althoug I deny explicity in the content instance the capabilites VCM:DEPLOY_AND_UNDEPLOY and VCM_PROMOTE_AND_DEMOTE.

Is this a bug or am I doing something wrong?

Michael_Gallant

David,
Maybe I missed this in an earlier thread, but what is the use-case for what you are trying to achieve? There might be another solution than assigning / denying capabilities.

Michael

Mark_Scheevel

No, this is not a bug: it’s the way the system has always workedand it is intentional. The SITE_PUBLISH capability (and its ilk) does NOT applyto content instances (or content types), and making that so would open aparticularly nasty can of worms (because of the semantics of publishingreferenced objects).

Mark

From: eLink Entry:Discussion Group - Web Experience Management[mailto:v7webcontentmanagement@elinkkc.opentext.com]
Sent: Wednesday, April 13, 2011 7:53 AM
To: eLink Recipient
Subject: RE Re ¿Capabilities for publish only instances of a set ofcontent types?

RE Re ¿Capabilities for publish only instances of a set of content types?

Posted by david_garciagonzalez@ieci.es (García González, David) On 2011/04/13 08:49

I am reviewing the documentation about this. In VCM 7.5 Administration Guide. Section "Understanding Default Roles and Capabilites", page 191:

To Publish or unpublish a:

• Channel

• Content item from within a site or channel (including from within a site’s default channels)

• Site

You need the required capabilites:

VCM:SITE_PUBLISH which also requires these implied capabilities:

• VCM:DEPLOY_AND_UNDEPLOY

• VCM:PROMOTE_AND_DEMOTE

• VCM:SNAPSHOT_CONTENT

Is this a bug or am I doing something wrong?

[To post a comment, use the normal reply function]
Topic:	¿Capabilities for publish only instances of a set of content types?
Forum:	Discussion Group - Web Experience Management
Livelink Server:	knowledge-wlweb01

David_GarcAa_GonzAlez

Quoted Michael Gallant (michael.gallant@bhs.org) on 2011/04/13 16:24:

Maybe I missed this in an earlier thread, but what is the use-case for what you are trying to achieve? There might be another solution than assigning / denying capabilities.

Hi Michael,

I wanted to avoid that users could publish instances of this particular content type but I dont find the capabilities to achieve this.

Do you know how to achieve this? Thanks!

David_GarcAa_GonzAlez

No, this is not a bug: it’s the way the system has always worked and it is intentional. The SITE_PUBLISH capability (and its ilk) does NOT apply to content instances (or content types), and making that so would open a particularly nasty can of worms (because of the semantics of publishing referenced objects).

But if I want to avoid that a user/group could publish a determined content instance, how could I deny to the user/group this capability?

Thanks!

Mark_Scheevel

You can’t. You can only prevent the user/group from publishing *anythingat all* on that site. Either they can publish everything on the site, orthey can publish nothing on the site.

Mark

From: eLink Entry:Discussion Group - Web Experience Management[mailto:v7webcontentmanagement@elinkkc.opentext.com]
Sent: Wednesday, April 13, 2011 9:31 AM
To: eLink Recipient
Subject: RE Re ¿Capabilities for publish only instances of a set ofcontent types?

RE Re ¿Capabilities for publish only instances of a set of content types?

Posted by david_garciagonzalez@ieci.es (García González, David) On 2011/04/13 10:26

No, this is not a bug: it’s the way the system has always worked and it is intentional. The SITE_PUBLISH capability (and its ilk) does NOT apply to content instances (or content types), and making that so would open a particularly nasty can of worms (because of the semantics of publishing referenced objects).

But if I want to avoid that a user/group could publish a determined content instance, how could I deny to the user/group this capability?

Thanks!

[To post a comment, use the normal reply function]
Topic:	¿Capabilities for publish only instances of a set of content types?
Forum:	Discussion Group - Web Experience Management
Livelink Server:	knowledge-wlweb01

Michael_Gallant

David,
If the user can read / write to the content-type and they are allowed site-wide publish capabilities, then you cannot limit publish capabilities to that particular content type.

If you are allowing the user/group to a make a change to the content type, then how would the changes to a particular content instance get published?

It appears through your use-case that :

you are using a content-type that is associated to two sites.
user/groups associated to the two sites have the capabilities to make changes to the content instances of the content-type
you do not want users of site A to be able to make changes to a content-instance that is also used on Site B.
Question: do you have circumstances where changes to a content-instance would be published to both Site A and Site B?

There are two possible resolutions that come to mind.

If the content-instances are always site specific, create two indentical content-types, but permssion them to the appropriate user/group and associate each to their appropriate site, or
If the content-instances may or may not be published to both sites, create a workflow that handles the correct publishing circumstances

Michael

David_GarcAa_GonzAlez

You can’t. You can only prevent the user/group from publishing *anything at all* on that site. Either they can publish everything on the site, or they can publish nothing on the site.

Thanks Mark!!

From my Proof of Concept, I think this is the real scenario in VCM. If a user has the VCM:SITE_PUBLISH capability, this user is able to publish all the channels and contents inside the site. If the user has not the VCM:SITE_PUBLISH capabilty, this user is not able to publish anything at all.

Anybody could confirm this?

Thanks.

Michael_Gallant

Quoted David García González (david_garciagonzalez@ieci.es) on 2011/04/13 13:05:

Anybody could confirm this?

In my experience, this is correct.

Michael

eLink User

In administration guide (chapter 6) it mentions that you need VCM:SITE_PUBISH to publish a site, a channel or any content item within a site.

Regards,

Sohail

On Wed, Apr 13, 2011 at 1:10 PM, eLink Entry: Discussion Group - Web Experience Management <v7webcontentmanagement@elinkkc.opentext.com> wrote:

RE RE Re ?Capabilities for publish only instances of a set of content types? ? Posted bymichael.gallant@bhs.org (Gallant, Michael)On 2011/04/13 13:05
?
Quoted David Garc?a Gonz?lez (david_garciagonzalez@ieci.es) on 2011/04/13 13:05:

From my Proof of Concept, I think this is the real scenario in VCM. If a user has the VCM:SITE_PUBLISH capability, this user is able to publish all the channels and contents inside the site. If the user has not the VCM:SITE_PUBLISH capabilty, this user is not able to publish anything at all.
Anybody could confirm this?

In my experience, this is correct.

Michael

[To post a comment, use the normal reply function]
Topic:	?Capabilities for publish only instances of a set of content types?
Forum:	Discussion Group - Web Experience Management
Livelink Server:	knowledge-wlweb01

--
Regards,
Sohail Aboobaker.
Accumulate Consulting Inc.
www.letsaccumulate.com.
Ph: 416 907 9050

David_GarcAa_GonzAlez

But, I am thinking if it is possible to implement a listener where I would check some conditions, and if these conditions are true stop the deployment process.

Is it possible to stop or skip the deployment process of a content instance with a listener??

Thanks.

Tomas_Briceno_Fernandez

No, it isn’t.There isn’t anything like a PreDeployment event to be fired.

However you can try by developing a custom publishing policy. This is a very little extension point that allows to create a validation and label a item as eligible or uneligible for publishing.

To give you an idea, the OOTB policy is eligible if “approved” and “uneligible” otherwise. I’m not sure how much contextual info is available to this extension but it may help you.

Regards,

Tomás

Mark_Scheevel

Custom publishing policies are only used in conjunction with scheduledpublishing, and aren’t really intended to deal with this sort of requirement(they’re really intended to identify whether an object is ready to be publishedto a particular stage, and if so, when). Publishing authorization is applied atthe site level, and there is no provision to limit it at the CT level. Somebodymay be able to cobble something together, but it’s going to be difficult, if it’spossible at all.

Mark

From: eLink Entry:Discussion Group - Web Experience Management[mailto:v7webcontentmanagement@elinkkc.opentext.com]
Sent: Monday, May 09, 2011 10:06 AM
To: eLink Recipient
Subject: RE Capabilities for publish only instances of a set of contenttypes?

RE Capabilities for publish only instances of a set of content types?

Posted by tbriceno (Briceno Fernandez, Tomas) On 2011/05/09 11:04

No, it isn’t.There isn’t anything like a PreDeployment event to be fired.

However you can try by developing a custom publishing policy. This is a very little extension point that allows to create a validation and label a item as eligible or uneligible for publishing.

To give you an idea, the OOTB policy is eligible if “approved” and “uneligible” otherwise! . I’m not sure how much contextual info is available to this extension but it may help you.

Regards,

Tomás

[To post a comment, use the normal reply function]
Topic:	¿Capabilities for publish only instances of a set of content types?
Forum:	Discussion Group - Web Experience Management
Livelink Server:	knowledge-wlweb01