Issue of ACL

Question

hi Experts,
I am using wcc11.1.1.7, according to Kyle's blog:
https://blogs.oracle.com/kyle/entry/new_security_configuration_flag_ucm_ps3
I finished ACL configuration as the following:
in $domain/ucm/config/config.cfg, added:
UseEntitySecurity=true
SpecialAuthGroups=ACLGroup
AllowQuerySafeUserColumns=true
I restarted ucm server, then user1 checkin a doc with security grp name of ACLGroup, add user2 with RWDA for user access list, but user2 can not search this doc out, what could be the issue for this?
Best regards

Answer 1

Hi ,
I think the problem here is about understanding how ACL's work .
Basically , ACL is not meant to give / revoke security access / privileges for a document on the fly . It is used to tighten security structure by 1 more notch so that security can be applied on item level . This means that an item can be sub-classified among users who share the same security group / roles to the content item .
Please read through the following forum post which illustrates this point : https://forums.oracle.com/thread/1003039?t
Also , go through the ACL Documentation : http://docs.oracle.com/cd/E28280_01/doc.1111/e26692/securityacls.htm#BEIEIHCA
Section : 21.4 Access Control List Permissions
This line captures the core of ACL functionality :
However, users must also satisfy security criteria for access through the Content Server security group and the account (if Accounts are enabled). If any of these security criteria deny a certain permission, users will not have that permission to the content item.
When a user searches for a content item, all three ACL rights fields are combined as an "OR" condition. That result is combined in an "AND" condition with the result of the Security Group and Account fields. The user conducting the search must have Read permission to the security group, to the account (if accounts are enabled), and to at least one of the three ACL fields to be able to find the content item.
Thanks,
Srinath