Retreive all folders that a specific group has access to

[Former Member]

Hi Folks

I would like to know if there's a way to retreive folders that a specific group has access too using query builder.

I tried the UserGroup-Folder relationship function without any results. I know that it's possible to go through all folders hierarchy using recusrion and to check if the group has access privileges on it, but a huge amount of queries will have to be executed against the CMS.

So again, is it possible to to such thing using only a few queries ?

Thank you !

[ted_ueda · Accepted solution]

For newer versions of Enterprise, look up the SI_ID of the UserGroup. Say if SI_ID = 116, then try running:

Select TOP 10 SI_ID, SI_NAME, SI_CUID, SI_KIND From CI_INFOOBJECTS, CI_SYSTEMOBJECTS, CI_APPOBJECTS WHere SI_KIND='Folder' And IsAllowed(116, 3)

I haven't blogged about the IsAllowed query function, but IsAllowed(principal_id, right_id) essentially is true if the User or UserGroup identified by principal_id has the right identified by right_id. In the above, right_id = 3 is View rights.

You can look up the rights ID from CeSecurityID.Right enumerated int values.

Sincerely,

Ted Ueda

[Former Member · Accepted solution]

Ted -

1) What is "newer versions", exactly?

2) Can you rate the performance, of, say, looping over 100 principals for "View Objects" on a Folder (i.e. SELECT ....IsAllowed(a,b) . x 100) vs. performing the same security query using ISecCacheControllerAdmin?

Thanks as always

[Former Member · Accepted solution]

Hi,

I'm a French student so I'm sorry if my English is not perfect.

I am contacting you because I can see on this topic that you used the 'isAllowed()' function. I understand well how it works but I don't find the correspondance between the rights IDs ans their signification. I think it's something like "description" but I would like to have the complete list of the IDs. If you globaly explain more this function it will be great.

Moreover, do you know if it's possible to retreive the level access (Full control, No Acces, View, View on demand...) instead of a typical right?

For information, I'm working on the construction of a matrix of folders in one side and users in the other and put this level of acces in each cell in VBA.

I'm using XI 3.1version and Excel 2010.

Thanks for your answer.

Yoann

[Former Member]

I tried the query you suggested. It seems that my version of BO XI is not higher enough since I have an "invalid arguments" error. As soon as I removed the IsAllowed from the WHERE clause, query is executed without errors.

Thanks anyway

We are planning to migrate to 3.1 soon so I'll stick this somewhere by that time

[Adam_Stone]

It all depends on how you have permissions set up for the users. If you have them setup so that the user will not see folders that they don't have access to, then you are able to just log in as that user into querybuilder, and query for all folders. If the users are still able to see the folders, then you will have to look at the security settings on each folder to check the users permissions.