Figure: Access Control Editor
The Access Control Editor provides the option to control user access, e.g. for reading or modifying folders and documents and to give permission on access control settings on these. Please note that document permissions on folders are working recursively, thus if modify access to a folder is not permitted, none of the documents in this folder or sub-folders can be modified.
The editor contains the following two tables:
Figure: Access Control Editor
Note
To use security with Jackrabbit in the rapid application environment,
you have to enable security setting as described in the following section.
To make security work with Jackrabbit, perform the following steps:
Figure: Replaced security files in RAD.
Please note that implicit policies are only set on folder creation with the security enabled. In case you set the security after a folder is already created from a non security enabled repository access, the policy is not retroactively set. A user without administrator role does not have access to this folder. In this case a user with administrator role has to set policies on the folder manually. For example to make it possible to upload documents, policies on the folder /process-instances have to be set manually if it was created before the security setting.
For the following folder pattern, the permission ALL is set on creation for everyone in case security is enabled:
The following permissions are provided for participants:
: inherit permission for according action on folder/document
: allow according action on folder/document
: deny according action on folder/document
The table with inherited permissions lists the permissions inherited from parent folders. These entries are not editable.
The following columns are listed for inherited permissions on folders:
Figure: Inherited Permissions for a folder.
Per default, inherited permissions for Administrators and Everyone are set. Administrators have the grant Allow for all permissions. Everyone has an Allow value set for the reading grant, whereas all other permissions for Everyone are Inherit (indicated by three dashes) by default.
The following columns are listed for inherited permissions on documents:
Figure: Inherited Permissions for a document.
Per default, inherited permissions for Administrators and Everyone are set. Administrators have the grant Allow for all permissions. Everyone has an Allow value set for the reading grant, whereas all other permissions for Everyone are Inherit (indicated by three dashes) by default.
Depending on whether the Access Control Editor was opened for a folder or for a document, one of the following tables are available:
The following operations on permissions are provided:
Granted permissions on folders have a table with the following columns:
Figure: Granted Permissions on a Folder
Granted permissions on documents have a table with the following columns:
Figure: Granted Permissions on a Document
To add a participant to change the permission of, click the Add Participant icon:
Figure: Add Participant
The Select Participant dialog opens, where you can select the participant in a list. The allowed participants are role, organization, department and its sub-organization and children.
Figure: Select a Participant
OR
Click the link Pick from Tree. The participant tree gets displayed. Select the participant from the tree.
Figure: Participant Tree
The selected participant is created in the table with editable permissions.
Figure: Participant added to table
Note that the access can be granted to a role but when the role is scoped, the accessing user's scope that is department is also displayed. So, if a user would not be allowed to see or work with a process instance due to department association then similarly, the access to the process attachment is denied to that user.
To remove selected participant(s) from the permissions table, you can either:
Figure: Removing a Participant from the List.
Figure: Removing a Participant via Remove action.
Selecting one or more participant(s) in the table is done by clicking directly on the according row(s). For details on selecting rows in tables, refer to chapter Selecting Rows in a Table. Note that administrators cannot be removed and will remain even in case all rows are selected.
To edit selected permission(s) you can do one of the following:
Figure: Edit a Permission
Figure: Editing all selected Permissions
Now the permission for the participant(s) can be edited.
Figure: Permissions can be edited now.
You can switch the granted permissions in the columns between the following values provided in the drop-down list:
Figure: Set the Permission.
Click Apply to apply your changes.