You are viewing limited content. For full access, please sign in.

Question

Question

Security

asked on May 2, 2013 Show version history

The customer has a user that has been assigned to a group that has full feature rights.  The customer would like one user in the group not to be able to move folders.  I thought by assigning all feature rights to that user minus the right to move folders would trump the move folder assigned to the group, but that does not seem to be the case.  Am I incorrect?   

 

From Introduction to security:

 

“When calculating whether a user should be able to perform a particular task, Laserfiche will take into account both the security settings applied to the user and the security settings applied to a group. If a user has been denied the ability to perform a function or access a document—whether that deny was set directly on the user, or was inherited from a group—they will not be able to perform that task, even if they have also been allowed it in another setting. In other words, deny trumps allow.”

 

 

 

 

0 0

Answer

APPROVED ANSWER
replied on May 3, 2013 Show version history

You’re definitely on the right track here. If you look closely on what you quoted, you said In other words,DENY trumps allow.” Whenever you’re talking about security and you see the terms allow and deny, it’s referring to the access rights in the client, not the feature rights. The feature rights found in the admin console work hand in hand with the access rights that are set in the Laserfiche client.  You need to have both rights in order to actually perform that task. This allows you to apply security pretty much however you like. In your case, if you wanted to prevent a user from moving folders around, you would have to deny that user the access right to Create Folders. This will prevent them from moving folders.

 

 

Another thing to note is that based on the image above, the user will still be able to move documents if the group is allowed to move documents. If you wanted to prevent the user from being able to move both documents and folders, you would need to deny the right to Create Documents as well.

0 0

Replies

You are not allowed to reply in this post.
You are not allowed to follow up in this post.

Sign in to reply to this post.