Restricting custom menu for roles and branch possible?

Keywil

Hello all,

TS6.7.2, Win2K3,

I've been trying to enable a custom menu for certain groups within different branches. Everything I've read in documentation or on the forum suggest that custom menu items can be restricted by roles only - not branches. This thread was helpful.

Scenerio: Two branches... in Branch A we want to enable the 'Files>>Delete' capability for users. In Branch B we don't want users to have access to 'Files>>Delete'.

We add an "authorWhoDeletes" role along side our (ootb) 'author' role. We modify our ui_custom.xml and userops_custom.xml and restrict authors from seeing the 'Files>>Delete' "AuthorWhoDeletes" users can see the 'Files>>Delete' option. Everything is good until.. one user is a member of both groups.

Now this member can delete items in the branch that shouldn't allow deleting...

What do you do when a user spans multiple groups across multiple branches?

Any advice is appreciated.

Adam Stoller

Hello all, TS6.7.2, Win2K3, I've been trying to enable a custom menu for certain groups within different branches. Everything I've read in documentation or on the forum suggest that custom menu items can be restricted by roles only - not branches. This thread was helpful. Scenerio: Two branches... in Branch A we want to enable the 'Files>>Delete' capability for users. In Branch B we don't want users to have access to 'Files>>Delete'. We add an "authorWhoDeletes" role along side our (ootb) 'author' role. We modify our ui_custom.xml and userops_custom.xml and restrict authors from seeing the 'Files>>Delete' "AuthorWhoDeletes" users can see the 'Files>>Delete' option. Everything is good until.. one user is a member of both groups. Now this member can delete items in the branch that shouldn't allow deleting... What do you do when a user spans multiple groups across multiple branches? Any advice is appreciated.

If the user has been granted the specific role in the given branch - then they should be able to see the option - right?

Or are you saying that you created a big monolithic group (e.g.: "users_who_can_delete") and then assigned the group to the custom role (e.g.: "authors_who_can_delete") on several branches - and you have a situation where a user who is a member of that group rightlfully should be able to perform the operation on one branch but not on another? If that's the case you need to do a better job on your group-assignment and role-assignment process.

Also - make sure you're not getting confused by inheritance (where a sub-branch may inherit roles from a parent branch) - most of the time it's a "good thing" - but you might have entered into a situation where that isn't true - in which case you need to disable the inheritane and add the group / individuals you want to have that role individually.