nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Group Permissions

Greg Kellogg

I have seen a lot of posts about showing folder permissions. I have a bit of a different cat to skin.

I need to be able to tell what folders a specific group has permissions on. I don't want a list of documents because that would get way too big. Just folders.

So if I have Group A, I need to produce a list of all folders that it has permissions to. See and See Contents or greater.

Then I can compare that with Group B so I can tell User A why they get different search results from User B. Also, am I correct in assuming that System Admin privileges overrides Group permissions? In other words, if User A has group permissions that give him access to 80% of the enterprise but then his account is granted System Administration privileges he will now have access to 100% of the Enterprise?

Find more posts tagged with

Comments

Greg Kellogg

And actually just getting a count on the folders would be a good start. Getting the names would allow us to fix the potential issues but getting a count allows us to identify if there even is a problem.

Greg Kellogg | gkellogg@iqbginc.com | P 361-758-3762 | C 361-413-9200

the iQ Business Group

intelligence. applied.

www.IQBGinc.com

From: eLink Entry: Content Server LiveReports Forum <livereportsdiscussion@elinkkc.opentext.com>
Sent: Friday, May 20, 2016 12:55:51 PM
To: eLink Recipient
Subject: Group Permissions

Group Permissions

Posted by Kellogg, Greg On 05/20/2016 01:52 PM

I have seen a lot of posts about showing folder permissions. I have a bit of a different cat to skin.I need to be able to tell what folders a specific group has permissions on. I don't want a list of documents because that would get way too big. Just folders.So if I have Group A, I need to produce a list of all folders that it has permissions to. See and See Contents or greater.Then I can compare that with Group B so I can tell User A why they get different search results from User B. Also, am I correct in assuming that System Admin privileges overrides Group permissions? In other words, if User A has group permissions that give him access to 80% of the enterprise but then his account is granted System Administration privileges he will now have access to 100% of the Enterprise?

[To post a comment, use the normal reply function]
Forum:	Content Server LiveReports Forum
Content Server:	Knowledge Center

****** CONFIDENTIALITY NOTICE ****** This message and any attachments are confidential and for the sole use of the intended recipient. If you are not the intended recipient, any copying, forwarding, disclosure, distribution or use of any part of this message or its attachments is strictly prohibited and may be unlawful. If you believe that you received this email in error, please do not read it or any attachments thereto, and notify the sender immediately by email and then delete this message from your system. Thank you.

Colin_Schmidt

Try this in Oracle:

select k.name "Group", dt.dataid, dt.name "Folder", case dta.see when 1 then 'See' when 2 then 'See Contents' when 3 then 'Modify' when 4 then 'Delete' end Seeder,

case dta.acltype when 1 then 'Owner' when 2 then 'OwnerGroup' when 0 then 'Assigned' end ACLTYPE

from dtree dt

join dtreeacl on dta dt.dataid = dta.dataid and dta.rightid = <GroupID> and dta.see > 0

join kuaf k on dta.rightid = k.id

where dt.subtype = 0 and dt.ownerid = -2000 /* keeps it out of RecycleBin */

You scan the DTREE (or DTREECORE), match against the DTREEACL with the DataID and then add the RIGHTID (is basically the User/Group ID) and SEE (> 0 is at least SEE) and you pull out the Group name (if you don’t want, delete the line and reference in the SELECT). It also tells you whether it’s the Owner or was manually assigned. There are probably less you could leave in or more you could add.

Colin J. Schmidt

Knowledgelink Support

CapitalOne | Collaboration Technology

From: eLink Entry: Content Server LiveReports Forum [mailto:livereportsdiscussion@elinkkc.opentext.com]
Sent: Friday, May 20, 2016 2:13 PM
To: eLink Recipient
Subject: Re Group Permissions

Re Group Permissions

Posted by Kellogg, Greg On 05/20/2016 02:12 PM

Greg Kellogg | gkellogg@iqbginc.com | P 361-758-3762 | C 361-413-9200

the iQ Business Group

intelligence. applied.

www.IQBGinc.com

From: eLink Entry: Content Server LiveReports Forum <livereportsdiscussion@elinkkc.opentext.com>
Sent: Friday, May 20, 2016 12:55:51 PM
To: eLink Recipient
Subject: Group Permissions

Group Permissions

Posted by Kellogg, Greg On 05/20/2016 01:52 PM

I have seen a lot of posts about showing folder permissions. I have a bit of a different cat to skin.

I need to be able to tell what folders a specific group has permissions on. I don't want a list of documents because that would get way too big. Just folders.

So if I have Group A, I need to produce a list of all folders that it has permissions to. See and See Contents or greater.

[To post a comment, use the normal reply function]
Forum:	Content Server LiveReports Forum
Content Server:	Knowledge Center

[To post a comment, use the normal reply function]
Topic:	Group Permissions
Forum:	Content Server LiveReports Forum
Content Server:	Knowledge Center

The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.

Bo Warburton

Doesn't the Fastman stuff do this?

- Bo Warburton

On Fri, May 20, 2016 at 11:25 AM eLink Entry: Content Server LiveReports Forum <livereportsdiscussion@elinkkc.opentext.com> wrote:

Re Group Permissions Posted byKellogg, GregOn 05/20/2016 02:12 PM

And actually just getting a count on the folders would be a good start. Getting the names would allow us to fix the potential issues but getting a count allows us to identify if there even is a problem.

Greg Kellogg | gkellogg@iqbginc.com | P 361-758-3762 | C 361-413-9200
the iQ Business Group
intelligence. applied.
www.IQBGinc.com

From: eLink Entry: Content Server LiveReports Forum <livereportsdiscussion@elinkkc.opentext.com>
Sent: Friday, May 20, 2016 12:55:51 PM
To: eLink Recipient
Subject: Group Permissions

Group Permissions

Posted by Kellogg, Greg On 05/20/2016 01:52 PM

[To post a comment, use the normal reply function]
Forum:	Content Server LiveReports Forum
Content Server:	Knowledge Center

[To post a comment, use the normal reply function]
Topic:	Group Permissions
Forum:	Content Server LiveReports Forum
Content Server:	Knowledge Center

Bo M (702) 580-3409

Greg Kellogg

Sorry Colin - I should have said - SQL Server DB.

Greg Kellogg | gkellogg@iqbginc.com | P 361-758-3762 | C 361-413-9200

the iQ Business Group

intelligence. applied.

www.IQBGinc.com

From: eLink Entry: Content Server LiveReports Forum <livereportsdiscussion@elinkkc.opentext.com>
Sent: Friday, May 20, 2016 1:40:24 PM
To: eLink Recipient
Subject: RE Re Group Permissions

RE Re Group Permissions

Posted by Schmidt, Colin On 05/20/2016 02:40 PM

Try this in Oracle: select k.name "Group", dt.dataid, dt.name "Folder", case dta.see when 1 then 'See' when 2 then 'See Contents' when 3 then 'Modify' when 4 then 'Delete' end Seeder, case dta.acltype when 1 then 'Owner' when 2 then 'OwnerGroup' when 0 then 'Assigned' end ACLTYPEfrom dtree dtjoin dtreeacl on dta dt.dataid = dta.dataid and dta.rightid = <GroupID> and dta.see > 0join kuaf k on dta.rightid = k.idwhere dt.subtype = 0 and dt.ownerid = -2000 /* keeps it out of RecycleBin */ You scan the DTREE (or DTREECORE), match against the DTREEACL with the DataID and then add the RIGHTID (is basically the User/Group ID) and SEE (> 0 is at least SEE) and you pull out the Group name (if you dont want, delete the line and reference in the SELECT). It also tells you whether its the Owner or was manually assigned. There are probably less you could leave in or more you could add. Colin J. SchmidtKnowledgelink SupportCapitalOne | Collaboration Technology

Re Group Permissions

Posted by Kellogg, Greg On 05/20/2016 02:12 PM

Greg Kellogg | gkellogg@iqbginc.com | P 361-758-3762 | C 361-413-9200

the iQ Business Group

intelligence. applied.

www.IQBGinc.com

From: eLink Entry: Content Server LiveReports Forum <livereportsdiscussion@elinkkc.opentext.com>
Sent: Friday, May 20, 2016 12:55:51 PM
To: eLink Recipient
Subject: Group Permissions

Group Permissions

Posted by Kellogg, Greg On 05/20/2016 01:52 PM

I have seen a lot of posts about showing folder permissions. I have a bit of a different cat to skin.

I need to be able to tell what folders a specific group has permissions on. I don't want a list of documents because that would get way too big. Just folders.

So if I have Group A, I need to produce a list of all folders that it has permissions to. See and See Contents or greater.

[To post a comment, use the normal reply function]
Forum:	Content Server LiveReports Forum
Content Server:	Knowledge Center

[To post a comment, use the normal reply function]
Topic:	Group Permissions
Forum:	Content Server LiveReports Forum
Content Server:	Knowledge Center

[To post a comment, use the normal reply function]
Topic:	Group Permissions
Forum:	Content Server LiveReports Forum
Content Server:	Knowledge Center

Alister Grigg

Thanks Bo, yes it does. Permissions search is fundamentally missing in CS out of the box. It is one of the many gaps our Permissions Manager product addresses and we get a lot of enquiries about it.

Of course it's not a single dimensional topic. In addressing these questions you also need to take into account factors such as permissions through ownership, public access, group memberships, nested group memberships, what types of objects are you searching for (as in your case, just search for folders and not getting a huge list of documents, tasks, whatever - remembering that almost all objects in CS have a permissions profile of some sort), what part of the system are you searching from, what do you want to do with the results, does the person searching have enough privileges to actually see this information, and so on.

Greg - suggest you start with slide 18 of this deck for an indication of what we provide:

http://www.fastman.com/wp-content/uploads/2016/02/permissions-manager-presentation.pdf

The other use case you mention is dealt with on slide 38, the Compare Groups function. You can use that to see the differences between two users and normalise them through "copy" and "leave" functions.

Let me know if you want to see a demo.

Quoted Bo Warburton on 05/20/2016 06:05 PM:

Doesn't the Fastman stuff do this?

- Bo Warburton

On Fri, May 20, 2016 at 11:25 AM eLink Entry: Content Server LiveReports Forum <livereportsdiscussion@elinkkc.opentext.com> wrote:

Re Group Permissions Posted by Kellogg, Greg On 05/20/2016 02:12 PM

And actually just getting a count on the folders would be a good start. Getting the names would allow us to fix the potential issues but getting a count allows us to identify if there even is a problem.

Greg Kellogg | gkellogg@iqbginc.com | P 361-758-3762 | C 361-413-9200

the iQ Business Group

intelligence. applied.

www.IQBGinc.com

From: eLink Entry: Content Server LiveReports Forum <livereportsdiscussion@elinkkc.opentext.com>
Sent: Friday, May 20, 2016 12:55:51 PM
To: eLink Recipient
Subject: Group Permissions

Group Permissions Posted by Kellogg, Greg On 05/20/2016 01:52 PM

I have seen a lot of posts about showing folder permissions. I have a bit of a different cat to skin.

I need to be able to tell what folders a specific group has permissions on. I don't want a list of documents because that would get way too big. Just folders.

So if I have Group A, I need to produce a list of all folders that it has permissions to. See and See Contents or greater.

Then I can compare that with Group B so I can tell User A why they get different search results from User B. Also, am I correct in assuming that System Admin privileges overrides Group permissions? In other words, if User A has group permissions that give him access to 80% of the enterprise but then his account is granted System Administration privileges he will now have access to 100% of the Enterprise?

[To post a comment, use the normal reply function]
Forum: Content Server LiveReports Forum
Content Server: Knowledge Center
****** CONFIDENTIALITY NOTICE ****** This message and any attachments are confidential and for the sole use of the intended recipient. If you are not the intended recipient, any copying, forwarding, disclosure, distribution or use of any part of this message or its attachments is strictly prohibited and may be unlawful. If you believe that you received this email in error, please do not read it or any attachments thereto, and notify the sender immediately by email and then delete this message from your system. Thank you.
[To post a comment, use the normal reply function]
Topic: Group Permissions
Forum: Content Server LiveReports Forum
Content Server: Knowledge Center

Bo M (702) 580-3409

Alister Grigg

Sorry, should also say we show you how the access shown is derived, as in by what group memberships or nested memberships, which is really helpful for figuring out these sort of questions. And of course once you see what us in place you can make changes to that set of results.

Walt Ruppar

Greg- these should work for SQL Server.:

For Just a Count:
SELECT COUNT(*)
FROM DTreeAcl dta
JOIN dtree dt1 on dta.dataid = dt1.dataid and dt1.subtype = 0 and dt.ownerid = -2000
WHERE dta.rightid =%1 and dta.see > 0

For a List of Objects:
SELECT dta.rightid "GroupID", k.name "GroupName", dta.parentid "ParentID", dt2.name "ParentFolder",
dta.dataid "DataID", dt1.name "FolderName"
FROM dtreeacl dta
JOIN dtree dt1 on dta.dataid = dt1.dataid and dt1.subtype = 0 and dt.ownerid = -2000
left outer join kuaf k on dta.rightid = k.id
left outer join dtree dt2 on dta.parentid = dt2.dataid
WHERE dta.rightid = %1 and dta.see > 0

Or, if you want to limit the columns (test this one as I did not run it to be sure):
SELECT dta.rightid "GroupID", dta.parentid "ParentID", dta.dataid "DataID"
FROM dtreeacl dta
JOIN dtree dt1 on dta.dataid = dt1.dataid and dt1.subtype = 0 and dt.ownerid = -2000
WHERE dta.rightid = %1 and dta.see > 0