How to minimize acl count?

Hi,

Consider we have a requirement where we automate the folder (custom folder type) creation using TBOs.

Here for each new folder created, the acl should be applied based on the custom attribute which will have list of users whom should be given access to that folder.

Say the user count is 200. So there can be lot of combinations of users which will lead to lots of acl.

If i go for PST (Template acl), again I see that acls are getting created in the form of instances of the acl template. So there is no use in going with PST apart from the fact that changes to the acl if any will be easier in future. Is my understanding correct??

What is best possible way to minimize the count of acls in this scenario?

@Jhonny

I have already went through your posts on PSTs but i still i have the above question in my mind ... Even usage of PST creates new acls.. am i correct ?

Find more posts tagged with

Comments

DCTM_Guru

It does. PSTs does not minimize ACL count, it minimize administration of ACLs. If you need to grant access to a specific alias defined in the PST, you would only have to update it one object and the content server will update all of the related ACLs that are tied to PST.

You didnt answer my question in the other posts:

Are you saying that the 200 users do not belong to a department/group? If these users are truly random and cannot be grouped to gether, I dont think using PSTs will help you. Also, I dont think there is any solution out there that is going to solve your problem if you are talking about adding users 1 by 1 in a totallly random fashion.

You need some sort of order to introduce automation or efficiency

prabhu

Yes. We do have 8 groups.

As i said, acls will be formed based on the custom attribute values. I will create a folder of custom folder type. An acl will be framed based on the values from 8 custom attributes of that folder type and will be applied to the folder.

Put together, users are given access to the folder based on custom attribute values. These custom attributes are populated with the user names retrieved by DQL.

Every custom attribute corresponds to a group. So choosing a value for a custom attribute means a user is selected from a group.

Out of 8 attributes, one is repeating, so for any folder --> 7 users + No. of users for 8th attribute should be given access to the folder i.e., a new acl is created.

Now, there are 200 users. Any combination is possible. So we predict lots of acls which we dont want to have. Any suggestions.

DCTM_Guru

You must be working with the other person who asked about adding users from a group 200 users dynamically to an ACL. I dont have a OOTB solution for you if the eight groups you are dealing with are not somewhat static (ie group membership is consistent across set documents).

Are you using a custom UI or are you extending Webtop? If you are building a custom UI, you're probably better off using query filters on your document display than trying to come up with ACL solution. If you are using Webtop, its probably going to be much harder to modify the Webtop/WDK components to set up custom filter, since you have to apply this filter across multiple components (eg doclist, search results, etc).

prabhu

Thanks for the time you spent for this ...

I dont know if MAC (Mandatory access control) could play any role here ? Your thoughts .

and i am not going to use any custom UIs ... trying to do things with webtop and i understand the difficulties but still figuring out if there is a way for this..

Can i get brief information on "Dynamic and logic based acls" which i came across while going through documentation on Trusted Content Services.

DCTM_Guru

I havent personally used dynamic groups or TCS, so I cant speak to the feature. AFAIK, MAC is additional security layer on top of ACL. It was developed for the intelligence community where even though you may belong to a specific group that has permissions on it, the document needs to be restricted to a certain classification level (eg sensitive information).