Question

How can an access right be denied if it never denied at any parent folder

Security

Updated January 22, 2020

asked on December 6, 2019 • Show version history

You can see from this screenshot that there is no denied at any parent folder, under the detailed inheritance window. The only right configured for this account is "Allow", yet it is not checked.

Also, this user does not have the read-only checkbox checked on their account and is using a Full license type.

0 0

Replies

replied on December 6, 2019

It might just not be set anywhere up the chain, so there's nothing to inherit. Click on the row you're interested in and the bottom of the dialog will tell you how it's calculated.

0 0

replied on December 6, 2019

There is nothing to inherit. I agree. Why is it denied then? I have clicked on the row I am interested in and I am looking at how it is calculated.

How does allow = deny?

0 0

replied on December 6, 2019

Does the row you're looking at say it's inheriting from somewhere? Because if it's not set directly on the entry for the user and not set at a higher level or for one of the user's groups, then it's not set. That would result in a deny since there is nothing saying it's allowed.

0 0

replied on December 6, 2019

It is explicitly set on the folder I am looking at here in the screenshot, but in any case, the calculation is "has Modify Contents allowed" with no deny. No matter which folder it is set on (parent or this), it should result in allowed, not denied unless there is a deny listed in the calculation.

0 0

replied on January 22, 2020

I just want to make one thing very clear on this. The screenshot, although cropped to hide the full username clearly shows that the detailed inheritance view is only one configuration.

Modify Contents Allowed

Therefore we can deduce that it is IMPOSSIBLE for Modify Contents not to be checked here. (if there was an inheritance issue, it would show as a second line)

Yet Modify Contents is unchecked. This is why I can not fix this myself, it must be fixed in the code. We did spend months trying to shotgun fix it, by deleting and re-creating the account, switching to different license types, and manually setting up licensing instead of using Sync, etc. But none of this will fix the basic logic issue in the code that seems to be saying Modify = Deny.

0 0

You are not allowed to follow up in this post.

Question

Question

How can an access right be denied if it never denied at any parent folder

Replies

Sign in to reply to this post.