Chapter 07. Object Security

In this chapter, we will explore the following concepts:

• Basic and extended object permissions

• Creation and assignment of permission sets

• Object owner and superusers

• Folder security

Security — A Recap

In previous chapters, we studied various features of Documentum security including users, groups, roles, domains, authentication, client capabilities, and basic and extended privileges. These aspects focus primarily on the identity of the user. The other side of security concerns is the resource being accessed, i.e. an object. The object security defines access restrictions applied at the object-level granularity.

This chapter introduces the concepts associated with object security and how these concepts relate to other security parameters for specifying the overall access control configuration for Documentum.

The object security applies to objects of type dm_sysobject or one of its subtypes. All discussion in this chapter assumes the objects to be of this type unless...

Security — A Recap

In previous chapters, we studied various features of Documentum security including users, groups, roles, domains, authentication, client capabilities, and basic and extended privileges. These aspects focus primarily on the identity of the user. The other side of security concerns is the resource being accessed, i.e. an object. The object security defines access restrictions applied at the object-level granularity.

This chapter introduces the concepts associated with object security and how these concepts relate to other security parameters for specifying the overall access control configuration for Documentum.

The object security applies to objects of type dm_sysobject or one of its subtypes. All discussion in this chapter assumes the objects to be of this type unless stated otherwise.

Object Permissions

Each object in the repository is associated with permission settings that grant specific permissions to certain users and groups. These permissions are categorized into basic and extended permissions.

Basic Permissions

Basic permissions relate to accessing and manipulating an object's content and metadata and include the following levels:

Level	Value	Description
NONE	1	No access is allowed.
BROWSE	2	View metadata (properties).
READ	3	View the associated content.
RELATE	4	Create relationships, such as between annotations and PDF files, documents, and lifecycles. Documentum uses various types of relationships to manage content effectively.
VERSION	5	Create new version.
WRITE	6	Modify without changing version (modify properties without checkout or modify and check in as same version).
DELETE	7	Delete the object.

The basic permissions are hierarchical in nature implying that a particular permission level includes all the lower permission...

Special Users

There are two special types of users who implicitly get certain permissions — object owners and users with Superuser privilege. Ordinary users (other than these two types) must be granted specific permissions for them to be able to access the object in the desired manner.

Object Owner

Each object is associated with a user or group, which is referred to as its object owner. The object owner is special as far as the particular object is concerned and gets the following permissions on this object automatically:

1. 1. READ permission

2. 2. All extended permissions except Extended Delete

Usually, the object owner is assigned higher permissions through the applied permission set. Permission sets are discussed later in this chapter.

Managing Object Ownership

An object can only have one specified owner (dm_sysobject.owner_name) at a time, which can be a user or a group. By default, the user creating the object becomes the owner of that object. Object ownership can be reassigned to another...

Permission Sets (ACLs)

So far we have seen the basic and extended permission levels. In order for the permissions to be assigned to an accessor (user or group), they need to be placed inside a permission set. A permission set (also known as ACL or Access Control List) is simply a set of basic and extended permissions associated with different accessors.

A permission set is stored as an object of type dm_acl. Permission sets are used for controlling access only to the objects of type dm_sysobject (or any of its subtypes). The valid operations on renditions are controlled by the permission set on the primary object. Recall that renditions cannot be edited or checked out.

There are four categories of accessors that can be granted permissions in a permission set — owner (dm_owner is the alias for owner), specific users, specific groups, and world (dm_world is the alias for world). These categories are intended to be able to resolve the permissions of any user who may attempt to access an object...

Folders and Permission Sets

Just like other sysobjects, each folder (and cabinet) is also assigned a permission set. This permission set is used for two purposes:

1. 1. Controlling access to the folder object

2. 2. Assigning to the objects that have this folder as their primary folder when the server's default ACL mode is set to folder

A folder's permission set does not restrict access to the objects linked to it unless the folder security is enabled for the repository.

The folder security can be used for securing folders by adding restrictions based on links to the folders. When folder security is in use, object security is necessary, but not sufficient for adding documents to or removing documents from a folder. When folder security is enabled, a WRITE permission is required on the folder to link (create, import, copy to) or unlink (move, delete) content within it. Appropriate object permissions are still required for the operation to succeed. Other operations can be performed on the content...

Help—Some DQL Queries

Some helpful queries related to object security are described in this section. These queries are based on the information presented in this chapter.

The following query retrieves basic permissions granted on a given object:

SELECT r_accessor_name, r_accessor_permit
FROM dm_acl
WHERE object_name =
(SELECT acl_name
FROM dm_document
WHERE r_object_id = '0900006480000509')
AND owner_name =
(SELECT acl_domain
FROM dm_document
WHERE r_object_id = '0900006480000509')

Note a few things in this query. DQL doesn't allow joins when retrieving repeating properties (accessor name and permit) — this query achieves the same effect using subqueries. Also note that both acl_name and acl_domain should be checked when looking up the ACL for an object.

It is not straightforward to check extended permissions through queries since they return an integer value that needs to be decoded. It is best to view extended permissions through an application such as Webtop or Documentum Administrator...

Documentum Product Notes

The Administration node in Webtop or Documentum Administrator can be used for creating and managing permission sets. The permissions tab on object properties can be used for reassigning a permission set or for modifying permissions. System Administrator client capability is needed for these operations.

Trusted Content Services (TCS) is an optional component of Documentum architecture and requires a separate license to use with the Content Server. It provides enhanced security features such as encrypted communication (SSL) and storage, electronic signatures, and additional restrictions in addition to the usual object security.

Checkpoint

At this point you should be able to answer the following key questions:

1. 1. What is a permission set and how is it different from a permission?

2. 2. What are basic permissions? What are extended permissions?

3. 3. How is a permission set selected to be assigned to a new object?

4. 4. What is a custom permission set? Who can create it and why is it needed?

5. 5. How does folder security provide additional object security beyond the permission sets?

6. 6. What kind of security is provided by Trusted Content Services?

Test Your Understanding

1. 1. A user with Extended Delete permission automatically gets WRITE permission as well (True/False).

2. 2. A permission set can contain multiple ACLs (True/False).

3. 3. The VERSION permission implies the following permissions:

   a. WRITE

   b. READ

   c. BROWSE

   d. DELETE

4. 4. The object owner automatically gets all the extended permissions (True/False).

5. 5. A permission set created by a user without Sysadmin or Superuser privilege is called a custom permission set (True/False).

6. 6. The default ACL mode for the server is set to folder. A user creates an object in folder A and then moves it to folder B. The final permission set on the object is the same as:

   a. The permission set of the user

   b. The permission set of the type of the object

   c. The permission set of the folder A

   d. The permission set of the folder B

7. 7. The same object from question 6 is now linked to folder C as well. The permission set of the object:

   a. Changes to the permission set of folder C

   b. Remains unchanged

   c. Changes...

The rest of the chapter is locked

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Renews at $15.99/month. Cancel anytime

Start free trial

Previous Chapter

Chapter 1 of 23

Next Chapter

Special Users

There are two special types of users who implicitly get certain permissions — object owners and users with Superuser privilege. Ordinary users (other than these two types) must be granted specific permissions for them to be able to access the object in the desired manner.

Object Owner

Each object is associated with a user or group, which is referred to as its object owner. The object owner is special as far as the particular object is concerned and gets the following permissions on this object automatically:

1. 1. READ permission

2. 2. All extended permissions except Extended Delete

Usually, the object owner is assigned higher permissions through the applied permission set. Permission sets are discussed later in this chapter.

Managing Object Ownership

An object can only have one specified owner (dm_sysobject.owner_name) at a time, which can be a user or a group. By default, the user creating the object becomes the owner of that object. Object ownership can be reassigned to another...

Permission Sets (ACLs)

So far we have seen the basic and extended permission levels. In order for the permissions to be assigned to an accessor (user or group), they need to be placed inside a permission set. A permission set (also known as ACL or Access Control List) is simply a set of basic and extended permissions associated with different accessors.

A permission set is stored as an object of type dm_acl. Permission sets are used for controlling access only to the objects of type dm_sysobject (or any of its subtypes). The valid operations on renditions are controlled by the permission set on the primary object. Recall that renditions cannot be edited or checked out.

There are four categories of accessors that can be granted permissions in a permission set — owner (dm_owner is the alias for owner), specific users, specific groups, and world (dm_world is the alias for world). These categories are intended to be able to resolve the permissions of any user who may attempt to access an object...

Folders and Permission Sets

Just like other sysobjects, each folder (and cabinet) is also assigned a permission set. This permission set is used for two purposes:

1. 1. Controlling access to the folder object

2. 2. Assigning to the objects that have this folder as their primary folder when the server's default ACL mode is set to folder

A folder's permission set does not restrict access to the objects linked to it unless the folder security is enabled for the repository.

The folder security can be used for securing folders by adding restrictions based on links to the folders. When folder security is in use, object security is necessary, but not sufficient for adding documents to or removing documents from a folder. When folder security is enabled, a WRITE permission is required on the folder to link (create, import, copy to) or unlink (move, delete) content within it. Appropriate object permissions are still required for the operation to succeed. Other operations can be performed on the content...

Help—Some DQL Queries

Some helpful queries related to object security are described in this section. These queries are based on the information presented in this chapter.

The following query retrieves basic permissions granted on a given object:

SELECT r_accessor_name, r_accessor_permit
FROM dm_acl
WHERE object_name =
(SELECT acl_name
FROM dm_document
WHERE r_object_id = '0900006480000509')
AND owner_name =
(SELECT acl_domain
FROM dm_document
WHERE r_object_id = '0900006480000509')

Note a few things in this query. DQL doesn't allow joins when retrieving repeating properties (accessor name and permit) — this query achieves the same effect using subqueries. Also note that both acl_name and acl_domain should be checked when looking up the ACL for an object.

It is not straightforward to check extended permissions through queries since they return an integer value that needs to be decoded. It is best to view extended permissions through an application such as Webtop or Documentum Administrator...

Documentum Product Notes

The Administration node in Webtop or Documentum Administrator can be used for creating and managing permission sets. The permissions tab on object properties can be used for reassigning a permission set or for modifying permissions. System Administrator client capability is needed for these operations.

Trusted Content Services (TCS) is an optional component of Documentum architecture and requires a separate license to use with the Content Server. It provides enhanced security features such as encrypted communication (SSL) and storage, electronic signatures, and additional restrictions in addition to the usual object security.

Checkpoint

At this point you should be able to answer the following key questions:

1. 1. What is a permission set and how is it different from a permission?

2. 2. What are basic permissions? What are extended permissions?

3. 3. How is a permission set selected to be assigned to a new object?

4. 4. What is a custom permission set? Who can create it and why is it needed?

5. 5. How does folder security provide additional object security beyond the permission sets?

6. 6. What kind of security is provided by Trusted Content Services?

Test Your Understanding

1. 1. A user with Extended Delete permission automatically gets WRITE permission as well (True/False).

2. 2. A permission set can contain multiple ACLs (True/False).

3. 3. The VERSION permission implies the following permissions:

   a. WRITE

   b. READ

   c. BROWSE

   d. DELETE

4. 4. The object owner automatically gets all the extended permissions (True/False).

5. 5. A permission set created by a user without Sysadmin or Superuser privilege is called a custom permission set (True/False).

6. 6. The default ACL mode for the server is set to folder. A user creates an object in folder A and then moves it to folder B. The final permission set on the object is the same as:

   a. The permission set of the user

   b. The permission set of the type of the object

   c. The permission set of the folder A

   d. The permission set of the folder B

7. 7. The same object from question 6 is now linked to folder C as well. The permission set of the object:

   a. Changes to the permission set of folder C

   b. Remains unchanged

   c. Changes...