Question

Temporarily remove users rights until task is complete, then restore rights

Version 9 Workflow Security

Updated October 23, 2014

asked on October 22, 2014

Hello,

I need help designing a workflow. I have a business requirement to lock users out of most of Laserfiche if they don't sign off on/acknowledge a document after a period of time. Ideally the process would look like this:

User receives an email with a link to a document in Laserfiche for them to acknowledge
User receives daily reminder emails until acknowledgement is complete
If user reaches deadline without acknowledging the document user is locked out of everything in Laserfiche but that document.
Once user acknowledges the document, users access rights are restored throughout the system.

The part I am struggling with is how to restore the original access rights throughout the system via workflow after the user acknowledges the document. The complex piece of Laserfiche security it controlled through references to a SQL table, I could list the simpler pieces of individual user security there as well if needed.

Any suggestions would be greatly appreciated.

0 0

Replies

replied on October 22, 2014 • Show version history

Here's an idea:

Create a security tag called Normal Access. Everyone is part of this tag, it's applied to every document.

Create a security tag for each user with their username in it.

When people are not doing what you want, make a copy of whatever document, put it in a folder in the root of Laserfiche with their "username" security tag and put that security tag on the folder it's sitting in so it's hidden from other users as well. Make sure the "normal access" tag is not on that copied document/folder. Then use workflow to remove the "Normal Access" security tag from that user.

When they log in they will only see one folder with their one document in it.

When they complete their changes copy those changes to the other document, delete the extra copy and folder it's sitting in and then add the "Normal Access" tag back to their account.

You'll want to email them a reminder as well that they need to log out/log back in to have their access restored.

Either that or get some more managers with stronger backbones to lean on them so they don't ignore the emails!

2 0

replied on October 22, 2014

Hi Britta,

There is no way currently to do add users to groups via workflow.

One way I thought about doing this is to have a folder which contains all other folders in your repository. This folder is not given any access rights, and lower tier folders would handle all normal security. However, if you wanted to "Lock a user out", you could move the one document they're supposed to interact with to the root of the directory and then change the access rights to the main repository container folder to deny. Then when they acknowledge the document move it back and reset the access rights on the repository container folder.

This might not work with your current structure but another possible idea for a workaround.

-Kevin

1 0

replied on October 23, 2014

Hi Britta-

Workflow can do this through the use of an SDK script, if you're comfortable going that route. I have a situation where users must agree to the terms in a form, then Workflow moves them from a group with no rights into a group with rights. Note that in this case, it is accessing tokens from a database lookup within the workflow to determine the user name and what group to move the person into.

The person in question is studentUser, the new group is studentGroup and the old group is newUsers.

LFUser studentUser = this.Database.GetTrusteeByName(this.GetTokenValue("QueryData_UserName").ToString()) as LFUser;

LFGroup studentGroup = this.Database.GetTrusteeByName(this.GetTokenValue("QueryData_UnivShort").ToString()) as LFGroup;
LFGroup newUsers = this.Database.GetTrusteeByName("New Users") as LFGroup;

studentGroup.AddTrustee((ILFTrustee) studentUser);
studentGroup.Update();

newUsers.RemoveTrustee((ILFTrustee) studentUser);
newUsers.Update();

1 0

replied on October 22, 2014

Another option would be by manipulating groups via workflow. Is there a way to add and subtract users from Groups via workflow?

0 0

You are not allowed to follow up in this post.

Question

Question

Temporarily remove users rights until task is complete, then restore rights

Replies

Sign in to reply to this post.