Enable Security at List Item Level by Customizing the Security Group Definition

ListItem Level Customization

The security group definition available at the Repository level and List level can be customized at the List Item level by copying all the security groups available at the immediate parent level to the list item level.

You can change the definition available for a security group and customize the security group definitions at the list item level.

Note: Do not update the security definition at levels if it is explicitly customized at that levels.

Security Group Customization

Example: This example shows how to customize the Contributor security group definition at the list item level. The Contributor security group at the repository level is customized at the List level and List Item level. (Here the Workflow listitem is considered). The contributor user can design and publish workflows at the repository level but cannot create workflow associations at the repository level.

The intention here is to allow association at the workflow list level for the contributor user and restrict the contributor user to publishing the item at item level.

Considered that a user called 'Kevin', who belongs to the contributor security group, exists in the repository.

To accomplish the scenario described above, perform the following steps:

1. Log on as the administrator.

2. In the Enterprise Console, point to admin, and then click Repository Settings. The Repository Settings page appears.

3. In the Standard Settings tab, click View Security Mapping at Repository Level. The View Security Mapping at Repository Level page appears. This page shows the mapping at the repository level before enabling security at the list level. The following image shows that the user 'Kevin' belongs to the contributor security group:

4. Click the Contributor security group to view the rights mapped to this security group at the repository level. The following image shows the contributor user behavior at the repository level. At the repository level, the contributor user can design and publish workflows, but cannot associate the workflows at the repository level.

5. Login as 'Kevin' who belongs to the Contributor security group.

6. Go to Workflows.

7. Before the security settings are changed, the contributor can design and publish the workflow. If this user tries to associate an event with the workflow, the following warning message appears: You do not have the rights to perform this action.

8. To enable security at the Workflow list level, log on as the administrator.

9. Go to Workflows.

10. Click Security to set security at the List level. By default, the Standard Settings tab is selected.

11. In the Advanced Settings, click Enable List Specific Security to enable security at the Workflow list level, and click Next.

12. Click Next. The Security Group page appears.

13. Select the Contributor security group, and then click Edit on the ribbon bar, or right-click and then click Edit from the context menu to customize the security definition of the group. The Modify a Security Group page appears.

14. Check the Can Create Association right, and then click Save. The Synchronizing the Security Group dialog box appears. Click Yes to synchronize the changes to its below level, or click Cancel. The following message appears: Security Group has been modified successfully.

15. Click OK.

16. After changing the security settings, click the Navigation icon to check what is the behavior of this user.

17. Click View Security Mapping at List Level. The mapping at list level after security is enabled at the list level.

18. Click the Contributor security group to view the rights mapped to this group at the list level. At the list level, the contributor user can design workflow and publish. After changing the security settings, the Contributor user can also associate events with workflow.

19. To check, log on as 'Kevin' who belongs to the Contributor security group.

20. Go to Workflows.

21. After security settings at the list level, the contributor can design a workflow, publish the workflow and also associate the workflow with events.

22. Before enabling security at the list item level, the same security settings will be available for the list item too. If no security is enabled at the list item level, it will copy the security settings available at the immediate parent level. To enable security at the Workflow list item level, login as the administrator user.

23. Go to Workflows.

24. Select any workflow.

25. In the Advanced Settings tab, click Enable ListItem Specific Security. The following Enabling Security Wizard page appears.

26. Select the Security Group Customization check box, and then click Next.

27. Click Next. Select the Contributor security group, and click Edit on the ribbon bar, or right-click the security group and click Edit from the context menu to customize its security definition.

28. Disallow the Can Publish Item right for the Value for the Rights column, and the Follower specific value for the Rights column.

29. Click Save. The Synchronizing the Security Group dialog box appears.

30. Click Yes to synchronize the changes to its below level, or click Cancel. The following message appears: Security Group has been modified successfully.

31. Click OK.

32. After changing the security settings, click the Navigation icon to check the behavior of this user.

33. Click View Security Mapping at List Item Level.

34. Click the Contributor security group to view the rights mapped to the security group at list level. At the list level, the contributor user can design workflow and associate events with workflow but will not be able to publish the workflow.

35. To check, log on as 'Kevin' who belongs to the Contributor security group.

36. Go to Workflows.

37. Double-click a workflow. For example, Design a workflow called 'TestWF'. Associate this workflow with events, and then publish this workflow. The following warning message appears: You do not have permission to perform this action.

After the security settings at the list item level, the contributor will not be able to publish the workflow. The contributor user can still design and publish a workflow and associate an event with other workflow list items.

Here, the Workflows list has its own security and other list levels like Users List, SOA Folder, File Watcher list etc do not have security enabled at their list level. Whatever the security defined at the repository level will apply to these lists.

Note: You can enable Resource Mapping and customize the security group at the same time. The LastUpdatedDateTime column in the Security Group list displays the modified date and time of a particular security group, only when it is updated at the Repository level.