Going crazy with security...

[jaburke]

Hi,
I have BOE 3.1. I have found a problem with my security after being in production for a while. I do not want any of the users to be able to modify a webi doc and save the changes back to the public folders. They can save to their favorites all day long, but they should get an error when trying to save back to a public folder.
I have a custom access level. I am using LDAP security. So let's say my LDAP group is called USERS. I have the USERS applied to the DATA folder with custom_access_level rights. I have set in the custom access level explicitly denied on 'add objects to the folder'. It doesn't matter - with my test account, I can edit a webi doc and can still save back to the DATA folder. What am I missing? I have a ticket open with BO, but so far it hasn't panned out. Thanks for any insight!!

 

[skrandel]

If you give users Edit Objects on a folder, then they will be able to save. I HATE the way the product works, right now.

They can use interactive mode to change a doc and then they can't save to the public folder. But, they can't use modify without Edit Objects.

What should be blocked is saving (as you say).

Disable Edit Objects and it will work.

Steve Krandel
Intuit

 

[jaburke]

Hey Steve,
I just went and tried this. It does prevent saving back to the public folder, but it also removes my 'edit' button from the report. I want the user to be able to edit the report and not save any changes back to the public folder.
Any ideas?

 

[skrandel]

Sorry, not possible. It is a big design flaw. You have to have rights on the folder in order for the edit button to exist. The proper workflow, unfortunately, requires them to copy the report to their favorites BEFORE using Modify mode.

It's OK to want it to work differently. It just won't do it.

Steve Krandel
Intuit

 

[jaburke]

BO tech support confirmed the same to me on Friday. It worked great in XI R2. How frustrating. Thanks for the feedback.

 

[skrandel]

You are correct. It did work that way in R2. BO claims it was a bug before.

The workflow you want makes perfect sense.

Steve Krandel
Intuit