I have a folder that is layered deep within the repository. I have several user groups each with their own folder. What I would like to do is only make the child folder visible in the Laserfiche Client, not the parent. Is this possible. So if the documents they need are in "Repository/District/School/Campus/Failed Group 1" , is it possible to only show the Failed Group 1 folder to those users?
Question
Question
Parent\Child folder permissions
Replies
This is possible, but there's a catch. If the parent folder is not accessible directly, then you would need to create a desktop shortcut or .lfe file that opens the client directly to that folder.
I am doing something like this for some of our users. If they log into the repository normally, they see nothing, but if they use a desktop shortcut that opens directly to the folder they're good.
Basically, the challenge is that by default the client opens the repository at the root. If the users can't access anything at the root level, they see nothing.
Another option, which may be better in your situation, would be to create a repository shortcut at the root that is only visible to the target group and links to their folder. That way they can log in normally and still have a way to navigate.
What if I only want them to see the containing folders but not any of the other contents.
Folder Structure
Repository
Incoming Docs
Registration
Failures
101-Building Name
Documents inside
102-Building Name
Documents inside
So in the "repository, incoming doc, registration, failures" folders they would only see the child folder. I tried only allowing read access, but the user could not see any of the children inside.
It would depend on the scope of the permission, such as “this entry only,” “this entry and sub folders,” etc.
So in your case, you would want the "Read" permission on the parent folder to have a scope of "This folder, subfolders and documents"
Which would provide read access to that folder and anything beneath it.
Guess this is where I'm getting confused. I don't want them to read other folders only their folder specifically.
What's the difference between read and browse?
Repository
Other Folder 1
Incoming Docs
Other Folder 1
Other Folder 2
Registration
Other Folder1
Failures
101-Building Name
Documents inside
102-Building Name
Documents inside
For instance I don't want them to see the "other Folders" I thought setting read access on that folder would work, but I set read access from Repository with the scope of this entry only then the Incoming Docs with entry only then.... to the 101-Building Name folder with Read-Browse and other properties. They can't see the folders though when I do that. I had to add Browse to all the parent folders which allowed them to see the "other Folders"
It sounds like the part that's tripping you up a bit is that you cannot have a gap between folders and still view the children.
Try to think of it like line-of-sight. If you don't have direct line-of-sight to a folder, you won't see it in the repository regardless of your access rights.
Therefore, if any parent folder is hidden from the user it disrupts the line-of-sight for anything below it in the folder tree.
For example,
- REPOSITORY
- Folder 1 - This entry only
Folder 2- No RightsFolder 3 - This entry only
- Folder 1 - This entry only
Although the user has rights to Folder 3, if he/she logs into the repository at the root level, Folder 3 will not be visible because the line-of-sight is broken at Folder 2.
Folder 3 is not a direct child of Folder 1, so it will not appear in Folder 1 since access rights do not affect how the folder structure is presented.
What you need to do is set the permissions AND establish an alternate "line-of-sight" path so they can get to the folder.
There are a couple of good ways you can do this;
- Create an LFE link the user can have on their desktop that bypasses Folder 1 and Folder 2 entirely and leads directly to Folder 3.
- Add shortcuts to Folder 3 in Folder 1 to bridge the gap.
For the shortcut example,
- REPOSITORY
- Folder 1 - This entry only
Folder 2- No RightsFolder 3- This entry only
- Folder 3 Shortcut ^
- Folder 1 - This entry only
By adding the shortcut, you can bypass the hidden Folder 2 and still provide a path from Folder 1 > Folder 3 Shortcut > Folder 3
Then, you give users access to their respective folder as well as the associated shortcut; only they will see the shortcuts, and it will allow them to navigate to the folder despite lacking access to the parent folder.
I understand the line of sight issue...I just can't explain well. I had a line of sight to the folder with read permissions but not browse. Still couldn't see the folder. When I added browse then I could see the folder, but all others as well.
Just to confirm, you gave them Read permissions on every folder in the path?
EDIT: I think I might know the problem. Check the Admin console to see if they have Bypass Browse enabled under "assigned privileges"
Browse is needed, but if they have bypass browse privileges it will not hide the inaccessible folders because it skips that check.
I just checked and they are not set to "Bypass Browse"
That's very strange. I just did a test to confirm, and when the parent folder has rights with a scope of This Entry Only, the user account I tested could only see folders with assigned access rights unless Bypass Browse was enabled.
- Folder 1 - Browse, Read: This Entry Only
- Folder 1A (Visible) - Browse, Read: This Entry and Children
- Folder 1B (Hidden) - No Rights
Is there a way to impersonate a user? I don't want to call users to "try it out" lol.
Yes. You can do it with either a Laserfiche account or a Windows account, and you can have multiple instances of the client signed in with different accounts.
When you open the LF Client, uncheck "Use Windows Authentication" and manually enter the user credentials.
- Laserfiche account: Enter username and password normally
- Windows/AD account: Enter domain\username and password
I find it useful to have a test account ready at all times to test new permissions and permission groups.