Apparently, we have a very complicated repository, and our vendor does not know how to handle our situation.
We have 105 locations and several types of documents (Leases, Certs Permits and Licenses, environmental records, etc.) Let's take User A as an example.
User A should only be able to access location leases and Certs Permits and Licenses for Location 1, but their rights are different per doc type. Here's a simplified example of how our repo is organized, with User A's rights in parentheses:
- Location 1
- Leases (READ-ONLY Access with only Search as a feature right)
- Certs Permits and Licenses (WRITE Access with full feature rights)
- Environmental Records (NO ACCESS)
- Location 2 (NO ACCESS to any type of document)
- Leases
- Certs Permits and Licenses
- Environmental Records
Our AD groups work great for controlling what the user should see in the tree view. Our problem comes when User A does a search. When the search is executed for all documents with the Location Leases Template, they get all Leases for ALL Locations, not just the one they can see in their tree view.
Now we have users who may only need to see 10 leases, but when they do a search, it returns all 225.
We have a separate group for each Location, as well as separate read and write groups for each document type). Like I said, these work great for the tree view. The problem is that search is letting them see all leases across all locations. We already have about 150 AD groups to handle what is working on the tree view, and we would like to avoid having to create AD groups for each location, doc type, and access level combination, if possible.
Anyone out there have a similar situation that you've solved for?