Gloabally Change Permissions

[markorjj]

The issue:

I have a folder tree that, for all intents and purposes, contains 10,000 + Parent folders that need to have the see - see contents permissions to several of the Child objects contained within them removed for a single group of users.

I currently have no way of doing this right now unless I manually remove see-see contents privileges from each of the child objects. This wold be an onerous task, and take several weeks. An Oracle script might be able to be written, but this might get me into more problems then its worth, and wouldn't be an auditable event.

I know the Collections 2.5 module has the ability to collect all of the folders by name and globally add a category to each of these folders. I would think that if I can globally add a category to a folder using the collections module, there should be some way of doing a global permissions change on a set of collected objects also.

Each of the objects is consistently named, i.e., if a child object is named 'Object A' it will be named 'Object A' in each of the parents. Not all of the parents will have all of the same children, but when they do, they are at least consistent in their naming convention.

Does anyone know of a custom module that will allow me to do this kind of a change?

 

[appnair]

If you seriously talk to anybody within OpenText you will understand why manipulating a livelink table by direct database calls is next to impossible.I leave it to you to research why to avoid that if possible.In these kind of changes several avenues do exist

By Use of WebReports each of these offending nodes(pardon) can be found by as you guessed a oracle /live report.Then you can use the nodeid,remember that is the most important thing in the permission/category anything object based arena,passed to a webreport tag library action like permchange.When the webreport call is received by the livelink server oscript code will do the necessary to change the permissions.If you were to do this strictly database wise you would have to know every major tale involved,with how many other module dependencies(one kind of node does certain things or in simple terms node call backs will not run when direct database updates happen)

By Use of ObjectImporter XML files.You will thru Oracle have to find again the offending node and put a permission change action in the xml file.Again when OI sees the permission cation it will put oscript to work.

By Use of Blubaker XS a highly touted commercial module

http://www.blubaker.com/livelink_DataXS.htm

which I guess is doing exactly what I was writing earlier finding the node and setting permissions.

If you are a programmer you can do this by use of LAPI,webservices or oscript for that matter.

Your statment about collections is very valuable.Collection schema has the info on the contained nodes but changing permissions is probably not a capability.If I were you I would use the collected nodes and write oscript to do the necessary changes.

Please try to do due diligence before emabrking on a direct table update in LES

Well, if I called the wrong number, why did you answer the phone?
James Thurber, New Yorker cartoon caption, June 5, 1937
Certified OT Developer,Livelink ECM Champion 2008

http://www.tek-tips.com/faqs.cfm?fid=2884

http://www.linkedin.com/in/appunair

 

[appnair]

BTW my statment about OI may not be correct.I rememebr that permission removal was not supported with OI but amending was pls check its release notes.
Also for a really bright livelink programmer/developer/oracle dba if you put the connect logs of livelink and change permission of a example node it may indicate which tables are being called for that set.This IMHO is very challenging to do and I will never do that kind of thing.

Well, if I called the wrong number, why did you answer the phone?
James Thurber, New Yorker cartoon caption, June 5, 1937
Certified OT Developer,Livelink ECM Champion 2008

http://www.tek-tips.com/faqs.cfm?fid=2884

http://www.linkedin.com/in/appunair

 

[markorjj]

Thanks for the tip on WebReports, while I didn't see that kind of capability in version 5.0.0, I looked at the 5.0.1 version and lo and behold, there was the capability.

What I did to test this out was:

1) Installed the upgrade to 5.0.1 in our Dev Environment
2) Created a small tree called Parent, with three children (child 1, child 2 and child 3)
3) Created a folder called 'PermissionsTest' in each child folder.
4) Created a livereport which simply searched the Dtree for all objects named 'PermissionsTest' that were folders.
5) Created a WebReport based on that, and used the PERMACTION sub tag to change the permissions on each object named 'PermissionsTest' that it found.

I was successfully able to add See and See Contents privileges to the ACL for each object, so it appears to be very workable, esxpecially within the time frame I have to do this.

Thanks again for the info.

 

[appnair]

BTW webreports is perhaps the most widely and useful tool for people out there who do not want to mess with programming.WR adds new features(you just ask and they give it) and is one of the most value for money OT modules an org can buy.Recently they added a lot of workflowing capabilities that peopl wanted and were not happy doing with OT's own module called XMLWF Extensions.I plan to evaluate that.Good that you have decided webreports Good Luck

Well, if I called the wrong number, why did you answer the phone?
James Thurber, New Yorker cartoon caption, June 5, 1937
Certified OT Developer,Livelink ECM Champion 2008

http://www.tek-tips.com/faqs.cfm?fid=2884

http://www.linkedin.com/in/appunair

 

[markorjj]

I was duly impressed with the capabilities of the WebReports 5.0.1 module in regard to the PERMACTION command. For example, we have a document store that has approximately 1.5 million objects in it, scattered among 15,000 separate folders.

I was tasked with removing see-see contents privileges from the documents - which I was able to do with the WebReports module by writing a SQL Query that located the folder names (They were all consistently named, just in different parent folders), and then using the WebReports module to remove the group in question from the ACL for the appropriate folder.

I could have also written a query the located the children of all of the parent folders, and then ran the WebReport on this query, but I reached a point where my web browser timed out - this was a more elegant solution.
This was accomplished in approximately 10 minutes using WebReports - I estimated that it was removing the group from the ACL at a rate of approximately 1000 objects per minute.