Qdabra Database Accelerator

Re: Permissions on DBXL

Patrick Halstead — Tue, 16 Nov 2010 12:57:33 GMT

Hi Catharine!

The web.config needs to be cleaned up a bit. We've left the old section in for compatibility purposes. Basically, the only section that matters is the one commented as "global security". You can ignore the other. These global security settings handle security even if you don't have permissions enforced for the doctype. They provide default permissions for all doctypes. For example, if you have a user in the ReaderGroupAlias they will always be able to read a doctype regardless of the doctype or doclevel permissions.

Hope this provides some elucidation. Please let us know how your DBXL lobotomy is progressing ... :)

Re: Permissions on DBXL

Catharine — Mon, 15 Nov 2010 17:53:12 GMT

Thank you for pointing me at this documentation - I didn't know how valid it was for v2.3.

I am still not clear about how the 2 different sections in webconfig work.

Catharine

Re: Permissions on DBXL

Patrick Halstead — Mon, 15 Nov 2010 12:35:14 GMT

Hi Catharine,

The following document describes DBXL permissions and should answer your questions: http://www.infopathdev.com/files/folders/installation/entry56212.aspx.

Please let us know if this helps at all and if you have any questions.

Re: Permissions on DBXL

Catharine — Mon, 15 Nov 2010 11:20:58 GMT

I thought I was getting a better understanding of this but.......

In config it says "If CheckUserPermissions is false, the group aliases below are used as defaults for new document templates if no permissions are specified....."

My reading of that is that the "group aliases below" are not used unless the CheckUserPermissions is false.

In mine the CheckUserPermissions is true - so they should not be used

BUT you say I should set CheckUserPermissions to false to switch them off...

I AM CONFUSED

What does the <permissions> group do. What does the Enforce Permissions box do - when does it come into play

The area of permissions and how DBXL works has never been clear to me. There are several areas where permissions stuff is done - I have no comprehension of how those areas fit together - what changes to make where to achieve desired "lock down/open up". Would it be possible to put more scenarios into the documentation to try and make it clearer ?

I have some document types where it is critical I control who sees them. And some document types where it doesn't really matter.

I have a group "domain\everyone". Where should I give access to everyone in the domain ? Is it enough to un check the Enforce Permissions box ? Or do I need to put a group in document type level permissions ?

Thank you for your help.

Catharine

Re: Permissions on DBXL

ErnestoM — Fri, 12 Nov 2010 17:53:14 GMT

The Users group will be on the same server where the DBXL web service is installed. Check the membership on that group.

The general permissions are always valid. To turn off general permissions:

<add key="CheckUserPermissions" value="true" /><!--

If CheckUserPermissions is false, the group aliases below

are used as defaults for new document templates if

no permissions are specified

-->

You can set CheckUserPermissions to false to turn these off and rely on the document type permissions.

Re: Permissions on DBXL

Catharine — Fri, 12 Nov 2010 17:24:48 GMT

Where do I look for Builtin\Users ?

I have gone into the server which runs the webservice and in the Users group on that server the standard value is domain\domainusers. - So my test account will be in there - so will everyone else in the domain.

I thought the document type level permissions would take precedence over the general permissions. - So I could give wider access in the General settings - then for each individual document type, if I "enforced permissions" the Document type permissions would be valid.

If I have to have narrower permissions in the general permissions I will have to keep adding people in both places is that right ?

Catharine

Re: Permissions on DBXL

ErnestoM — Fri, 12 Nov 2010 13:54:09 GMT

Yes, thank you. So this section tells us the following:

The other section has:

Is the user in question a member of BUILTIN\Users?

Re: Permissions on DBXL

Catharine — Fri, 12 Nov 2010 13:45:00 GMT

Is this the bit you mean ?

<add key="logShredWarnings" value="true" /><!--

RoleMembershipLogging

0 == No logging

1 == Errors

2 == Warnings

--><add key="RoleMembershipLogging" value="1" />

<add key="CheckUserPermissions" value="true" /><!--

If CheckUserPermissions is false, the group aliases below

are used as defaults for new document templates if

no permissions are specified

-->

<!--

UnlockOnSetDocument is provided for backward compatibility

This value should be false unless you need to maintain compatibility

with older apps that relied on this behavior

-->

<!--

MaxReturnedDocuments limits the number of documents returned by

GetDocumentsByType|GetDocumentSummaryByType|QueryDocuments2

-1 = No limit

-->

</appSettings>

Re: Permissions on DBXL

ErnestoM — Fri, 12 Nov 2010 13:36:22 GMT

The permissions section you pasted in the other thread is helpful, but there is a second permissions section farther up in the web.config. Can you paste that here? Thanks!

Re: Permissions on DBXL

Catharine — Fri, 12 Nov 2010 13:28:20 GMT

The Reader and Writer groups are empty in my web config.

Catharine.

Re: Permissions on DBXL

Patrick Halstead — Fri, 12 Nov 2010 12:49:38 GMT

There are three global groups in 2.3 (Reader, Writer, and Admin). If the Test user is in Reader group, that could explain why they have access.

http://www.infopathdev.com/files/folders/installation/entry56212.aspx

Re: Permissions on DBXL

Catharine — Fri, 12 Nov 2010 12:36:24 GMT

My username is DBXL Admin. But the account I am logging on with (even using a different PC) is my test account - which I intentionally keep with user priveleges.

Catharine

Re: Permissions on DBXL

Patrick Halstead — Fri, 12 Nov 2010 12:32:54 GMT

Hi Catharine,

Yes, the role name is DOMAIN\username.

You have done everything correct.

Check the global permissions in your web.config. Maybe you are a DBXL Admin. If so, try from a different account.

More later,

Permissions on DBXL

Catharine — Fri, 12 Nov 2010 10:40:17 GMT

Hi, I have DBXL v 2.3.

I have a document type set up. On the Permissions Tab I have Enforce permissions ticked. I have 5 Names/Role Names set up (I am assuming that the roll name has to be domain\username - is that correct ?).

I have tested access to documents of this type and with my test account, which is NOT one of the 5 Names/Role Names I can access the documents. I don't believe my test account should have access as it is not in the Document type level permissions list

What am I missing ? . A listing of the permissions section of my web config is shown here http://www.infopathdev.com/forums/p/17595/61351.aspx#61351.

Catharine