[4.0] Privileges group / user

[bidouille]

Hello,

My user "intranet" is in UserRole group but has only read access on a document.

grant_access.jpg (24.19 KiB) Viewed 2826 times

But he can still move or delete.

I don't understand

[jllort]

You must not propagate UserRole grant because is used for all users to get connection, It might be deleted from okm:root at first time by administrator and create your own roles there.

Privileges are grants roleX + grants roleY ( and UserRole has write and read grants ) that's the reason

[bidouille]

It might be deleted from okm:root at first time by administrator and create your own roles there.

OK but I already create some users. Can I roll back?

You must not propagate UserRole grant

Argh! A warning message will be welcome to prevent it.

[pavila]

Well, it depends on your security policy. This goes into the "best practices" manual