InfoPath Dev

Hi,  I have DBXL v 2.3.

I have a document type set up.  On the Permissions Tab I have Enforce permissions ticked.  I have 5 Names/Role Names set up (I am assuming that the roll name has to be domain\username  - is that correct ?).

I have tested access to documents of this type and with my test account, which is NOT one of the 5 Names/Role Names I can access the documents.   I don't believe my test account should have access as it is not in the Document type level permissions list

What am I missing ?  .  A listing of the permissions section of my web config is shown here http://www.infopathdev.com/forums/p/17595/61351.aspx#61351.

Catharine

Hi Catharine,

Yes, the role name is DOMAIN\username.

You have done everything correct.

Check the global permissions in your web.config. Maybe you are a DBXL Admin. If so, try from a different account.

More later,

My username is DBXL Admin.  But the account I am logging on with (even using a different PC) is my test account - which I intentionally keep with user priveleges.

Catharine

There are three global groups in 2.3 (Reader, Writer, and Admin). If the Test user is in Reader group, that could explain why they have access.

http://www.infopathdev.com/files/folders/installation/entry56212.aspx 

The Reader and Writer groups are empty in my web config. 

Catharine.

The permissions section you pasted in the other thread is helpful, but there is a second permissions section farther up in the web.config. Can you paste that here? Thanks!

Is this the bit you mean ?

<add key="ConnectionString" value="Data Source=rudb001;Initial Catalog=QdabraDBXL;Integrated Security=True" />

<add key="DocumentLockDurationInMinutes" value="60" />

<add key="SyncronozationLockWaitTimeOutInMilliSeconds" value="60" />

<!-- Global security settings -->

<add key="ReaderGroupAlias" value="BUILTIN\Users" />

<add key="AdminGroupAlias" value="BUILTIN\Administrators" />

<add key="RoleCheckTimeoutInMinutes" value="10" />

<add key="CompressData" value="false" />

<add key="FailOnShredError" value="false" />

<add key="UnlockOnSetDocument" value="false" />

<add key="MaxReturnedDocuments" value="-1" />

<add key="DocumentHandlerPath" value="http://invistanet-eur.dtinet.net/QdabraWebService/Documents" />

<add key="TemplateHandlerPath" value="http://invistanet-eur.dtinet.net/QdabraWebService/Forms" />

<add key="ActiveDirectoryPath" value="LDAP://DC=dtinet,DC=net" />

<add key="UseAlternativeUserInfo" value="false" />

</appSettings>

Yes, thank you. So this section tells us the following:

<add key="ReaderGroupAlias" value="BUILTIN\Users" />
<add key="WriterGroupAlias" value="BUILTIN\Users" />

<add key="AdminGroupAlias" value="BUILTIN\Administrators" />
<add key="DbxlAdminAlias" value="BUILTIN\Administrators" />

The other section has:

     <group name="Readers">
     <alias name="" />
    </group>
    <group name="Writers">
     <alias name="" />
    </group>
    <group name="Admins">
     <alias name="BUILTIN\Administrators" />
    </group>
    <group name="DbxlAdmins">
     <alias name="BUILTIN\Administrators" />

Is the user in question a member of BUILTIN\Users? 

Where do I look for Builtin\Users ? 

I have gone into the server which runs the webservice and in the Users group on that server the standard value is domain\domainusers. - So my test account will be in there - so will everyone else in the domain.

I thought the document type level permissions would take precedence over the general permissions. - So I could give wider access in the General settings - then for each individual document type, if I "enforced permissions" the Document type permissions would be valid. 

If I have to have narrower permissions in the general permissions I will have to keep adding people in both places is that right ?

 Catharine

The Users group will be on the same server where the DBXL web service is installed. Check the membership on that group.

The general permissions are always valid. To turn off general permissions:

<!-- Global security settings -->

You can set CheckUserPermissions to false to turn these off and rely on the document type permissions.

I thought I was getting a better understanding of this but.......

In config it says "If CheckUserPermissions is false, the group aliases below are used as defaults for new document templates if no permissions are specified....."

My reading of that is that the "group aliases below" are not used unless the CheckUserPermissions is false.

In mine the CheckUserPermissions is true - so they should not be used

BUT you say I should set CheckUserPermissions to false to switch them off...

I AM CONFUSED

What does the <permissions> group do.  What does the Enforce Permissions box do - when does it come into play

The area of permissions and how DBXL works has never been clear to me.  There are several areas where permissions stuff is done - I have no comprehension of how those areas fit together - what changes to make where to achieve desired "lock down/open up". Would it be possible to put more scenarios into the documentation to try and make it clearer ?

I have some document types where it is critical I control who sees them.  And some document types where it doesn't really matter.

I have a group "domain\everyone". Where should I give access to everyone in the domain ?  Is it enough to un check the Enforce Permissions box ? Or do I need to put a group in document type level permissions ? 

Thank you for your help.

Catharine 

Hi Catharine,

The following document describes DBXL permissions and should answer your questions: http://www.infopathdev.com/files/folders/installation/entry56212.aspx.

Please let us know if this helps at all and if you have any questions.

Thank you for pointing me at this documentation - I didn't know how valid it was for v2.3.

I am still not clear about how the 2 different sections in webconfig work. 

Catharine

Hi Catharine!

The web.config needs to be cleaned up a bit. We've left the old section in for compatibility purposes. Basically, the only section that matters is the one commented as "global security". You can ignore the other. These global security settings handle security even if you don't have permissions enforced for the doctype. They provide default permissions for all doctypes. For example, if you have a user in the ReaderGroupAlias they will always be able to read a doctype regardless of the doctype or doclevel permissions.

Hope this provides some elucidation. Please let us know how your DBXL lobotomy is progressing ...  :)