nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Problem with OS users & Teamsite Groups

Bala_R

Teamsite version : 6.7.1 sp1
OS: Solaris 10

I am having a problem related to OS users & Teamsite groups.
I have created OS user,by default the primary group of it is "others".
Then I have created Teamsite groups(using Admin tab) and added these users in that groups.
Under tamplatedata i am created a category folder called "category" and it containes datatypes such as intranet,internet,webroots etc...
Each datatype is associated with Teamsite group.The user will create a dcr and its owner is logged in user and GROUP is set to OTHERS.(Since this user primary group is OTHERS)
Hence all the users( primary group : others)who belong to OTHERS primary group can able to edit other's DCR.How to overcome this

Is this Interwoven product bug?Help me to resolve this....

Thanks in Advance,
Balaprakash R

Find more posts tagged with

Comments

Jcse

Hi

As you told that each datatype is associated with Teamsite group then
users of that TS group will definitely able to edit DCRs irrespective of their membership to the primary group(Others).

Do you want that a user of TS group should not edit the DCRs if he is also a member of primary group(Others) ?If it is so then i think you need to change the permissions of primary group for that category folder.

Else please explain it a little bit more ?

Adam Stoller

Teamsite version : 6.7.1 sp1
OS: Solaris 10

I am having a problem related to OS users & Teamsite groups.
I have created OS user,by default the primary group of it is "others".
Then I have created Teamsite groups(using Admin tab) and added these users in that groups.
Under tamplatedata i am created a category folder called "category" and it containes datatypes such as intranet,internet,webroots etc...
Each datatype is associated with Teamsite group.The user will create a dcr and its owner is logged in user and GROUP is set to OTHERS.(Since this user primary group is OTHERS)
Hence all the users( primary group : others)who belong to OTHERS primary group can able to edit other's DCR.How to overcome this

Is this Interwoven product bug?Help me to resolve this....

Thanks in Advance,
Balaprakash R

Since you're on Solaris - you can handle this at the file system level.
Let's say you have two groups (tsg1, tsg2) and two datatypes (dtype1, dtype2) in branch ****:

% cd /default/main/****/WORKAREA/wa/templateadata/category
% find dtype1 | xargs -n 1 iwchgrp tsg1
% find dtype2 | xargs -n 1 iwchgrp tsg2
% find dtype1 dtype2 -type d | xargs chmod g+s

If when you create a new datatype - do the same thing after you've created the initial directory structure (dtype/data, dtype/presentation) before you open it up for anyone to use.

The first and second find commands are used to ensure that all the existing directories and files within the directory structure have the correct group associated within them - I believe you have to use iwchgrp instead of chgrp because the latter doesn't know anything about TS groups. Unfortunately, the former (I believe) only takes a single path as an argument and doesn't recurse - so you have to use the

-n

flag.

The last find command then sets the setgid bit (often incorrectly referred to as sticky-bit) on the directories so that any new files or directories created within will automatically inherit the same group-ownership (sub-directories will also inherit the setgid bit). It's kind of like using the submit.cfg functionality before the file gets submitted.

tanguyr

Hello,

You should look at either

1) setting the "sticky bit" (sgid) in iw.cfg, by editing the line "directory_default_perm" in the section [iwserver]. This should work, but only for work areas created after you make this change and then stop/start the server. See this thread for more info:
http://devnet.interwoven.com/forums_vb/showthread.php?t=24305&forumid=11&highlight=sgid

2) you should be able to write a submit.cfg file (look in the unix admin guide for more info) that will set the correct group ownership based on the path of the file upon submit.

The difference between these two approaches (as i understand them) is that the first will make all files belong to the group of the folder they are created in, whereas the second will assign a defined group to all files under a given path.

/t

Adam Stoller

1) setting the "sticky bit" (sgid) in iw.cfg, by editing the line "directory_default_perm" in the section [iwserver]. This should work, but only for work areas created after you make this change and then stop/start the server. See this thread for more info:
http://devnet.interwoven.com/forums_vb/showthread.php?t=24305&forumid=11&highlight=sgid

It is not the "sticky bit" - it is the "set-group-ID-on-execution bit" - they are two different things.
The setting in iw.cfg may work - but you would still have to make sure to chgrp (or in this case, iwchgrp) the pre-existing files and directories you want to have specific group ownership.

2) you should be able to write a submit.cfg file (look in the unix admin guide for more info) that will set the correct group ownership based on the path of the file upon submit.

The difference between these two approaches (as i understand them) is that the first will make all files belong to the group of the folder they are created in, whereas the second will assign a defined group to all files under a given path.

/t

The difference is that the first will ensure that files within the workarea have the correct group ownership when they are created - before they are submitted, and the latter will set / change the permissions on files when they get submitted. Both are useful.

Bala_R

Hi all,
Thanks for your reply
Let me explain this scenario little bit clear.

1.I have created OS users using "useradd" command in solaris. (e.g users) my_user1,my_user2.
The primary group of this user is "Other" - by default.

2.In TS 6.7.1, I have created two groups 'my_group1' and added user my_user1 in it.
And second group 'my_group2' and added user my_user2 in it.

3.Under category i have two datatype --> "Intranet", "webroots"
Datatype --> 'Intranet' Group: my_group1
Datatype --> 'webroots' Group: my_group2

4.I have login as 'my_user1' and created a DCR --> dcr_intranet inside "Intranet".
Now if u look at the properties of the dcr_intranet it say owner as 'my_user1' and group as 'other'.(The primary group of 'my_user1' user is 'other' .coz, this user is OS level user)

5.Similarly, I am creating a another DCR --> 'dcr_webroots' using 'my_user2' inside webroots.
Now if u look at the properties of the 'dcr_webroots' it say owner as 'my_user2' and group as 'other'.(The primary group of 'my_user2' user is 'other' .coz, this user is OS level user)

6.Now the user 'my_user2' can navigate to data folder of 'intranet' and he was able to edit the DCR --> dcr_intranet.Eventhough he don't have the permission to create new dcr in that datatype(intranet) he is having the permission to edit that dcr.(Both user belongs to same primary group - 'other' ,since they are OS level users with Teamsite groups and not belong to OS groups.).

I have to avoid the my_user1 not able to edit the dcr in the webroots and vice versa.

Thanks in advance,
Balaprakash.R

tanguyr

It is not the "sticky bit" - it is the "set-group-ID-on-execution bit" - they are two different things.

Apologies, i stand corrected. Live and learn Smiley Wink

Adam Stoller

Hi all,
Thanks for your reply
Let me explain this scenario little bit clear.

I believe I understood what you were asking before - and provided the answer as to how to fix things - have you tried any of that information?

Bala_R

Hi Gothi,
Thanks for your reply.As per your information ,Its working fine for me.

Regards,
Balaprakash.R