ACL Inheritance in DMS

Hello DMS experts,
Scenario:
Folder 1(Created by ABC user)---XYZ user is not authorized (by creating ACL in folder with NoAutho as activity for XYZ )
Document 1(Created by ABC user)--A new document checked into this Folder1.
Issue:
According to inheritance, this document is suppose to carry the ACL authorization from Folder 1, but currently unless we create the ACL manually (By navigating to Authorization tab in the document properties, and clicking on "Create Admin Authorization")these inheritance is not copied to the document automatically. If this is standard SAP behavior, then what is the use of Inheritance?. (Registry key AutoInheritedAuth=1 maintained)
It is practically not possible to manually create these ACL for all sub folders and documents when they are created.
Need your suggestion/clarification on this....

Hello Deepak,
Option 1:
My question is related only to Inheritance of ACL authorization and lets assume that PFCG objects are in line with it.
Option 2:
Lets say, I have Folder1 with 10 documents inside, I have not assigned ACO_SUPER for ABCD user and ACL is created for Folder1 with "NoAutho" to ABCD user to this folder. ABCD user is authorized to access this Folder1 and its documents as per the PFCG objects.(Hence, my requirement is, according to PFCG roles the user is authorized for relevant document types and objects but i want to restrict the user only to certain folder and its documents using ACL)
1. What is the need of assigning superior document, when the definition of inheritance itself says that properties of superior folder is copied to child items?
2. Those 10 documents are visible to ABCD user or not?.
*Currently only the folder is not displayed to user, wherein if the user searches the documents, it is visible. If we manually create ACL in the properties of each of these documents, then it copies the ACL (from inheritance) and stops displaying to user even in search (which is desired). Hence, the only issue here is, copying of inheritance ACL automatically.

Similar Messages

Mass change in ACL Authorizations in DMS

Hi guru
I'm working with ACL authorizations in DMS. I don't know how delete (one shot) the authorizations of the user that is resigned. For example I have many documents where I set the write access for the user : Jack.
If Jack is resigned is there a transaction or report to:
mass delete this data or
sostituite the user JAck with new employee ?
Thanks in advance
Ciao

Hi,
I create the report as written in the note. The report doesn' solve my problem because:
select only for a document not for a range of documents
I know the user resigned not the document so I should have a report for a user , the report should show me all the document where the user has been assigned a acl authorizations.
According to you, is there a standard solution or is possibile to realize a custom solution?
thanks in advance
Vanessa

DFS ACL Inheritance issue

We have an interesting problem for the forums. We have implemented Distributed File Services for managing our shares.
SecurityGroupA has similar ACL assignments to FolderA and FolderB.
SecurityGroupB has limited ACL assignments to FolderB.
When a member of SecurityGroupA moves a file from FolderA to FolderB, the file does not not inherit from FolderB. We believe the issue is the DFS link gets redirected, but since the file's physical location doesn't actually move so no ACL changes happen
and SecurityGroupB cannot see the file.
If we break folder inheritance, then reapply inheritance to all child objects, this "fixes" ACL assignments and SecurityGroupB can see the file.
One process I am considering is enabling file auditing and using event log "file creation" to trigger an ACL refresh script. That's about as far as I have got to developing the process, though.
Has anybody with DFS implementations run into this? If so, how did you address the ACL refresh?
Thanks,
CS

Hi,
I'm a little unclear about the structure but it should be the default behaviour of NTFS permission. Please see this article:
http://support.microsoft.com/kb/310316
Also it provided steps to change the NTFS permission behaviour.
Meanwhile if both folders are located in same volume, maybe you can workaround this with putting one of them to another volume so permission will be refreshed by a move.
If you have any feedback on our support, please send to [email protected]

ZFS ACL Inheritance

Hi All,
On our proxy server, I would like to have access granted to our monitoring software userid to any log file created. The proxy server rotates its logs once per day, by appending the date and time to the rotated log file.
It appears, from the ZFS Administration guide, that I can do this by setting an ACE in the ACL of the log directory using the file_inherit inheritance flag. However, I cannot seem to make this function correctly.
For my logs directory, I did the following:
chmod A+user:patrold:read_data/execute:file_inherit:allow logs
This results in the following ACL for the logs directory:
root@testpxyt1# ls -ldv logs
drwxr-xr-x+ 2 webservd webservd 29 Mar 29 02:00 logs
0:user:patrold:read_data/execute:file_inherit:allow
1:owner@::deny
2:owner@:list_directory/read_data/add_file/write_data/add_subdirectory
/append_data/write_xattr/execute/write_attributes/write_acl
/write_owner:allow
3:group@:add_file/write_data/add_subdirectory/append_data:deny
4:group@:list_directory/read_data/execute:allow
5:everyone@:add_file/write_data/add_subdirectory/append_data/write_xattr
/write_attributes/write_acl/write_owner:deny
6:everyone@:list_directory/read_data/read_xattr/execute/read_attributes
/read_acl/synchronize:allow
However, when I look at the ACL for a newly created log file, I see this ACL:
root@testpxyt1# ls -lv access.201003290000
-rw-------+ 1 webservd webservd 396686 Mar 29 00:00 access.201003290000
0:user:patrold:read_data/execute:deny
1:user:patrold:read_data/execute:allow
2:owner@:execute:deny
3:owner@:read_data/write_data/append_data/write_xattr/write_attributes
/write_acl/write_owner:allow
4:group@:read_data/write_data/append_data/execute:deny
5:group@::allow
6:everyone@:read_data/write_data/append_data/write_xattr/execute
/write_attributes/write_acl/write_owner:deny
7:everyone@:read_xattr/read_attributes/read_acl/synchronize:allow
Somehow, the account patrold account is first denied access and then allowed access. Unfortunately this seems to result in a deny, as the ID is unable to read the file.
Did I misunderstand the way that this is supposed to work, or have I implemented it incorrectly?
Thanks,
Chris

Thanks, that is exactly what it was.
Once I set the aclmode to passthrough, the permissions were set correctly.
Thanks again!

ACL inheritance

A short description of our filesharing system:
We have five Macs, all with 10.5.1. We got no central server to store the files because all the macs are portables and often they are on the go and need the data on their own harddrive. But we also have to do file-sharing when we are at the office. For that, every user has an account on every mac. But only on his own mac he got a folder in his home directory which is called "Office (user1)" and there are all his documents stored. On the macs are also some users which aren't from the office, so they won't have access to the office folder. There exists a group called "ouroffice" and all the office-users belong to this group. All those should be able to make everything inside the office folders of the others. They should be able to create files, delete file etc. But when they have created a file, the others should be still able to make everything with the file.
To manage that, I thought ACL would be something great. I created for the office folders the following ACL:
+drwxrwx--- 18 silu ouroffice 612 5 Jan 15:26 Office (silu)+
+0: group:ouroffice inherited allow list,addfile,search,delete,add_subdirectory,delete_child,readattr,writeattr,writeextattr ,readsecurity,writesecurity,chown,file_inherit,directoryinherit+
+1: group:everyone inherited deny list,addfile,search,delete,add_subdirectory,delete_child,readattr,writeattr,writeextattr ,readsecurity,writesecurity,chown,file_inherit,directoryinherit+
When I create a new folder or copy a file to the "Office (silu)" folder, then all ACL are also on the new folder/file. But when I move a file or create a file (e.g. with Word), then no ACL are defined for this file. Why are ACL only inherited to copied files and not to created oder moved files? And how I could solve this problem?

<BLOCKQUOTE><font size="1" face="Verdana, Arial, Helvetica">quote:</font><HR>Originally posted by Vijay(Oracle):
Are you asking that whenever a document is added to a folder,
should the Folder's ACL become Document's ACL ?
- This is not good scheme. That is because, what will happen
if the document is multiply linked ? What will be the ACL
of the document ? If your iFS instance is guaranteed
to not have links, then you can customize by using server
side override.
A better approach would be to make the user's folders
have Published ACL and have a common folder for
sharing documents.
Thanks,
Vijay
<HR></BLOCKQUOTE>
Thanks for your reply. I'm just fearing that you didn't get my point correctly.
I am not asking that the Document should get the Folder ACL. But the Document should get an ACL which is the concantenation of the Document and Folder ACL.
Multiply linked Documents are a problem. My Environment certainly makes heavy use of multiple links. Is there a way to have different ACLs for the same Document in different Folders ?
The aim is to share Files. But not via a single Folder.
Users should contribute files to a collection of files. Then a special group of collection administrators need to sort these files into the collection. They are allowed to read the files of the users but are unable to delete or move them unless I give them administration privilege which I certainly do not want.
So I've got 2 groups of users (or 2 users for simplicity). User 1 puts something in a folder owned by user 2. User 2 is unable to move or delete the Document of user 1 out of this folder.
On a Unix filesystem I would set the SetGID-Bit on the folders an create a special group for user 2. I'm unable to do this in iFS. And I'm looking for to achieve the same result in iFS.
Hope. It got clearer now.
Regards,
Jens
null

ACL - Inheritance of settings

Hello
I'm trying to configure my acl on a directory. I set it up for a group to have rwx settings. Then with user 1 I make a folder. the owner is the user the group is inheritted of the parent folder. On the parent folder acl is set.
How can I stop having to execute setfacl on the new directory?

u can use umask to set settings for user permission, also, the execute permission for a directory means that it is traversable, without it you wont be able to enter the directory.

ACL Inheritance Problem

Hi all,
I want to assign permissions to a folder/document programatically after creating it.But i don't want to inherit the permission from the parent.
For example, take the hierarchy:-
Folder_1
    Folder_11
    Folder_12
    Folder_13
If Folder_11 is first sub-folder to be created programatically, then the permission for Folder_11 share the same ACL for the Folder_1 i.e. parent folder. The permisssion inheritance is not broken even if child folder(Folder_11) ACL are modified.
My code is somewhat like this.
ResourceContext context = null;
context = new ResourceContext(loggedOnUser);
RID aRid = RID.getRID(folderName);
IResource resource =
          ResourceFactory.getInstance().getResource(aRid, context);
ISecurityManager sm =
     resource.getRepositoryManager().getSecurityManager(resource);
IResourceAcl ra;
if (sm != null && sm instanceof IAclSecurityManager) {
     IAclSecurityManager asm = (IAclSecurityManager) sm;
     IResourceAclManager ram = asm.getAclManager();
ram.removeAcl(resource);
     ra = ram.getAcl(resource);
     if (ra == null) {
          ra = ram.createAcl(resource);
IUMPrincipal user =WPUMFactory.getUserFactory().getUser("testuser");
IResourceAclEntry readUsr =ram.createAclEntry(user,false,ram.getPermission(IAclPermission.ACL_PERMISSION_READ),0);
flag = ra.addEntry(readUsr);

Even if I was sceptic about this kind of solution, I gave it a chance on yesterday evening, but the final result is still the same. First two attempts (unbind ports from ACL, add a MAC to ACL, bind ports back to ACL) were fine, but on the third one (bind ports back to ACL a save settings) I got the same error message as before. There's no chance to bind ports back to ACL now, so I have to reset the switch again in the evening.

ACL Inheritancy

I've read some messages, but still not understanding a solution.
I have a directory where I drop documents into. Can be one at a time or 20 or so at a time using FTP / Windows mapped drive.
Because there are more than one user who have access to place documents into this directory, others only read. I want to be able to initially apply a specific ACL (the diretory ACL) to all objects in this directory automatically when the object is uploaded.
This is so that upload users don't have to go to each object and change the ACL everytime. At the present the only way I can do this is by setting the default ACL for the user to the ACL assigned of the directory.
Is there a way, and how to set this up?
It seems that the Home directory area is set up this way. When any object is uploaded into the home directory it picks up the private ACL and not the default for the user, can this be extended to other directories..?
Cheers
Andy

Hello, Andrew:
The behavior you're describing is what we are calling "ACL Scalability," and is one of the new features of 9iFS version 9.0.2,
our next release.
Currently, you have the option to do as you've said, and set the User's default ACL to match the folder where the document is stored.
This would only make sense, though, if this were the user's primary task in working with 9iFS. You also have the option of creating a
custom parser that could set the ACL for the document based on your business logic as the file is inserted to 9iFS.
I hope this helps,
Dennis Dawson

ACL granularity on XML element

Hello,
when I store a XML in a XMLTYPE (column or table) can I define an ACL on a specific XML element(node)? How fine grained is the ACL restriction? on the whole XML document or even lower to elements and attributes? If it is fine grained to elements can someone provide an example?

As far as I know, it is top down...
In http://www.oracle.com/technology/products/database/oracle11g/pdf/xml-db-11g-whitepaper.pdf it is described as follows (the 11g extras):
ENHANCED ACL SECURITY
In Oracle Database 11g, the Oracle XML DB ACL-based security model has been enhanced in a number of ways, including the following:
• ACL Inheritance.
ACL inheritance simplifies the process of defining, managing, and enforcing a common set of security policies across all of the documents stored in Oracle XML DB Repository. These rules can be organization-wide policies or policies specific to certain types of documents. These rules are specified by creating one or more master ACLs. With ACL inheritance it is possible to ensure that all new ACLs must be based on an existing ACL. This ensures that the newly created ACL inherits all of security policies defined by the ACL it is derived from, ensuring that the policies defined by the parent ACL are enforced whenever the new ACL is used.
• DAV ACL Compliance.
The Oracle XML DB ACL model has been enhanced to provide more complete support for the DAV ACL specification. This will allow improved interaction with clients that provide support for the DAV ACL security model.
• User defined ACLs.
In Oracle Database 11g the set of permissions defined by Oracle XML DB can be extended to allow the ACL based security model to be used to secure other kinds of database object.
• Time-sensitive ACLs.
In Oracle Database 11g it is possible to create ACLs that enforce access control polices in a timesensitive manner. This can be used to automatically publish and then expire content, based on rules defined by the ACL.

Propagate ACLs

Hi all,
I have a client who is running OS X Server 10.4.9 and has an odd problem with ACLs not fully propagating. We enabled ACLs on the server, rebooted and went about setting ACL permissions on the root of a share point. When propagating, it stopped at about halfway though it seems; meaning that the ACLs show up fine in the "Access" tab and are working on half the folders, but not the other half. There doesn't seem to be anything particularly different about the folder it stops at either.
Hope someone can shed some light on this, thanks!

Depending on what permissions were set before, we used to have problems with propagating NON-ACL (POSIX) permissions (Panther, Tiger) from WGM.
This was probably because the user/admin that was logged in in WGM didn't have the permissions to alter all files/folders from their current settings.
I can't say I have encountered the same problem with ACLs.
If the volume is set to use ACLs (inherited permissions dimmed) I guess you should perhaps first check the volume with a disk tool. You then might have to use CLI tools: chown, chgrp, chmod to set ACLs. I haven't used those myself for setting ACLs since it seems a pain compared to using the WGM. For setting POSIX permission the CLI tools are relatively easy.
Did yoy try changing only ACLs or ACLs and POSIX at the same time?
Changing only ACLs should suffice (I don't bother with POSIX if not neccessary) for user rights as they are used before POSIX.

Windows file permissions problems

We have an Xserve G5 that was running Server 10.3. I upgraded it directly to Server 10.5. Since then, I am having problems with some of our Windows users.
When they create a new folder, it puts them as the owner, but gives them NO rights. I am using ACLs to give full rights to the group that needs access, and also setting the POSIX group rights to read/write. So once they leave that folder, they can no longer get back in. I have SMB set to inherit rights from the parent, and the ACL is set to inherit as well. Other people in the group can access the folder, just not the owner! I change the owner permissions and all is well (for that folder at least). How do I need to set SMB so it follows the inheritance I set?
Once I have the folder set correctly, any new files created there have the POSIX group set to read only. The ACL inherits properly and still has full control. The owner is set correctly, usually. It is not consistent.
Once someone creates a file in any folder, if a Windows user modifies a file someone else created, it changes the owner name and gives them no rights. It also creates a new ACL record. If the original owner was a Mac user, it creates a new explicit ACL with all rights except execute and delete. If the file has ACL records already, it duplicates them and gives whatever rights it feels like (it seems). One new record may say Allow Delete only, and the next one say Allow Read except for execute. The only thing for certain is it will never match the original ACL. It always adds the new ACLs at the top of the list, and the duplicates are grayed out as if they were actually inherited that way. The most 'popular' file I've found so far had 128 "inherited" ACL records!
It is also denying access to some folders that the user has the correct permissions for. For instance, I can create/modify/delete files logged in on the Mac side, but when I log in on Windows, I have problems accessing files/folders. It shows everything as read only. Even if I change the properties in Windows, it will revert back to read-only when I apply the change.
We have a new Xserve that we will be moving the file services to. At that time, all the Windows users will be moved completely to the Mac side - currently the Windows users are accessing the Xserve and a Novell server.
Thanks in advance for any help.

Hi Thy,
Based on my research, the Trusted Installer is a service, for those resources which only allow Trusted Installer to modify, neither Administrator nor System can modify them.
I am wondering that how secure the network and physical environment is that you need to create a GPO to prevent users making permissions changes on system files. These system files normally only can be modified by Administrators,
System or Trusted Installer, which is secure enough when we don’t add users we don’t trust enough to Administrators group.
>What is the best way to undo this while leaving the audit failures turned on and still retaining the correct permissions on all the files?
As long as administrators on these machines are qualified, you can remove the Group Policy. If not, please don’t make any user you don’t trust as Administrator.
>What happens to the files that aren't owned trustedinstalled than now have the trustedinstaller default permissions under system32 and syswow64 if I were to remove the gpo? What file permissions would be retained?
We should keep the default permissions, if those files weren’t owned by Trusted Installer before, we should change the original owner back, vice versa.
Here are some related articles below I suggest you refer to:
New ACLs Improve Security in Windows Vista
http://technet.microsoft.com/en-us/magazine/2007.06.acl.aspx
SYSK 277: How-To Bring Back the TrustedInstaller
http://blogs.msdn.com/b/irenak/archive/2007/01/30/sysk-277-how-to-bring-back-the-trustedinstaller.aspx
Best Regards,
Amy

Exchange 2007 - Send As Permission

Hello, I have Exchange Server 2007 installed on my Windows Server 2008 system and am using an ASP.NET web application to send an e-mail message when certain events occur. My problem is that I have everything set up and functioning properly, the e-mail message is sent with the designated e-mail address and I receive the e-mail message with no problems. In order to do this, I have a generic e-mail address that I created for my domain and granted that generic e-mail address "Send As" permission for a different domain e-mail address and use the generic e-mail address in my ASP.NET web application for security purposes.
My problem is the "Send As" permission seems to disappear very frequently. It seems that I need to go into the Exchange Management Console and grant this Send As permission every time my server is rebooted, or even after going into Exchange Management Console to "Look around" and see what I have set up. Does anybody know if there is a way to make the grant of Send As permission permanent so I don't have to constantly re-grant it? I have applied SP1 to Exchange Server 2007 and am always sure to apply the most recent patches, etc. as soon as they are released.
Thanks in advance!
Tim

Dear customer:
Thanks for Bala’s reply. He is right.
Active Directory uses a protection mechanism to make sure that ACLs are set correctly for members of sensitive groups. The mechanism runs one time an hour on the PDC operations master. The operations master compares the ACL on the user accounts that are members of protected groups against the ACL on the following object:
CN=adminSDHolder,CN=System,DC=<MyDomain>,DC=<Com>
Note "DC=<MyDomain>,DC=<Com>" represents the distinguished name (DN) of your domain.
If the ACL is different, the ACL on the user object is overwritten to reflect the security settings of the adminSDHolder object (and ACL inheritance is disabled). This process protects these accounts from being modified by unauthorized users if the accounts are moved to a container or organizational unit where a malicious user has been delegated administrative credentials to modify user accounts. Be aware that when a user is removed from the administrative group, the process is not reversed and must be manually changed.
The following list describes the protected groups in Windows Server 2003 and in Windows 2000 after you apply the 327825 hotfix or you install Windows 2000 Service Pack 4:
• Administrators
• Account Operators
• Server Operators
• Print Operators
• Backup Operators
• Domain Admins
• Schema Admins
• Enterprise Admins
• Cert Publishers
Additionally the following users are also considered protected:
• Administrator
• Krbtgt
So first, please check whether the user that you grant “sends as” permission for it belongs to the above group. If so, open ADSIEDIT.msc, Check"Allow inheritable permissions from the parent to propagate to this object and all child objects. Include these with entries explicitly defined here" option on the adminSDHolder. And replicates all the DC, and grant “send as” permission for the user again via EMC, check whether the “send as” work fine.
For more information about adminSDHolder, please refer to “MORE INFORMATION” section in the following article:
Delegated permissions are not available and inheritance is automatically disabled
http://support.microsoft.com/kb/817433/en-us
Additionally, for more information about Exchange 2007 Permissions, please refer to the following documents:
Exchange 2007 Permissions: Frequently Asked Questions
http://technet.microsoft.com/en-us/library/bb310792.aspx
Hope it helps. If you have any question, please feel free to let me know.
Rock Wang - MSFT

Photoshop CS6 create permissions OS X

Hi there,
this issue is discussed for OS X Server but i didn't find something for my situation, where files are stored locally and different users ON THE SAME MACHINE want to work on these files: a Mac Pro running Mountain Lion is set up for 2 users (both members of group 'staff') who are both creating new files in Photoshop CS6. So far i found out that Photoshop writes new files with limited ownership and permissions: owner is the user creating the file, group is set to the ID of this specific user. Permissions are set to -rw-rw----. ACL inheritance of the folder where the file is created in is ignored.
This is what Terminal ls -le shows for the folder 'TEST' itself i am saving into as user 'foto':
drwxrwx---+ 4 foto staff 136 16 Mai 15:39 TEST
0: group:staff inherited allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeex tattr,readsecurity,file_inherit,directory_inherit
These are the permissions set for a file 'Testfile-1.jpg' created in folder 'TEST' using Photoshop:
-rw-rw---- 1 foto 502 36608 16 Mai 13:03 Testfile-1.jpg
QUESTION: Is there an AUTOMATED way to at least have group ownership 'staff' for these files? At the moment i am forced to do this manually (Terminal chown, chmod) every time the user is changed, what happens quite often. As we work with files in many different folders assigning Folder Scripts wouldn't be practical too (Folder Scripts are not recursive and have to be assigned to every single folder). A Chron job might be a solution, but i am not sure if i understand the principle right - it can be triggered every hour?
Any suggestion or link is highly appreciated, thanks Achim

Your user account was migrated from an early version of OS X and needs to be modified slightly.
Open the Users & Groups preference pane in System Preferences. If the lock icon is closed, click it and authenticate with your administrator name and password.
Right-click or control-click the entry for your account in the user list, and select Advanced Options... from the popup menu. In the sheet that opens, change the value of Group to "staff". Click OK to save your changes, then close System Preferences.

Photoshop CS6 create permissions

Hi there,
this issue is discussed for OS X Server but i didn't find something for my situation, where files are stored locally and different users ON THE SAME MACHINE want to work on these files: a Mac Pro running Mountain Lion is set up for 2 users (both members of group 'staff') who are both creating new files in Photoshop CS6. So far i found out that Photoshop writes new files with limited ownership and permissions: owner is the user creating the file, group is set to the ID of this specific user. Permissions are set to -rw-rw----. ACL inheritance of the folder where the file is created in is ignored.
This is what Terminal ls -le shows for the folder 'TEST' itself i am saving into as user 'foto':
drwxrwx---+ 4 foto staff 136 16 Mai 15:39 TEST
0: group:staff inherited allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextat tr,writeextattr,readsecurity,file_inherit,directory_inherit
These are the permissions set for a file 'Testfile-1.jpg' created in folder 'TEST' using Photoshop:
-rw-rw---- 1 foto 502 36608 16 Mai 13:03 Testfile-1.jpg
QUESTION: Is there an AUTOMATED way to at least have group ownership 'staff' for these files? At the moment i am forced to do this manually (Terminal chown, chmod) every time the user is changed, what happens quite often. As we work with files in many different folders assigning Folder Scripts wouldn't be practical too (Folder Scripts are not recursive and have to be assigned to every single folder). A Chron job might be a solution, but i am not sure if i understand the principle right - it can be triggered every hour?
Any suggestion or link is highly appreciated, thanks Achim

Your user account was migrated from an early version of OS X and needs to be modified slightly.
Open the Users & Groups preference pane in System Preferences. If the lock icon is closed, click it and authenticate with your administrator name and password.
Right-click or control-click the entry for your account in the user list, and select Advanced Options... from the popup menu. In the sheet that opens, change the value of Group to "staff". Click OK to save your changes, then close System Preferences.

Create folders in ara:/applications from permission catalog?

We want to start implementing advanced authorizations and we are wondering if it is possible to group applications together in folders for the location ara:/applications (accessible via System Administration > Permissions >> folder 'Applications')
If we could use also here folders then through ACL inheritance this would make it easier to define application pemissions.
We know for security zones (ara:/security) this grouping into folders is defined in the portalapp.xml - is there also a way to do this for ara:/applications ?
Any direction where to change this is welcome!
Many thanks,
Geert

As it turns out, Delete Subfolders and Files needs to be checked in order for users to be able to rename folders.

ACL Inheritance in DMS

Similar Messages

Maybe you are looking for