A simple requirement?We have a bunch of 1st liners who are members of the group “sub_admins”. Their main role is to edit the members field of all groups. sub_admins is in the DD as authors with group modifier role.
Now we have a requirement to exclude their edit rights to a few select groups.
I have just spent 6 hrs toiling with xACL possibilities to no avail. Has anyone out there found a way to do this?
Thanks
Subject: deny edit rights to selected groups for group administrators. xACL??
Steve,
If you needed to block them from editing the MEMBERS field of any group, xACL would work. But to block them from editing only certain group docs is too dynamic for xACL.
I would store a document somewhere, or a profile doc somewhere, that contains a list of the groups. Or, if you’re lucky, they all start with “CORP” or something. Then I’d use some PostOpen and QueryModeChange code to check for the user’s roles and the group name and block their ability to edit depending upon the match.
It’s a bit of a hassle for everyone to endure the 1/2 second of code execution, but it’s a tricky requirement, really.
I see changing your roles and the roles that are allowed to edit the various doc types being worse because you’re hacking the template which feels like a maintenance nightmare. Whereas hacking just this form’s PostOpen/QueryModeChange seems really easy in comparison.
good luck,
raphael
Subject: deny edit rights to selected groups for group administrators. xACL??
Do you have dozens of groups or thousands of groups?Especially if it is a small number, using the authornames field in the Group document is the best answer. That is much better than customizing your addressbook template. Try it. Edit a group and click on the “Administration” tab. Keep the ACL normal (they should be authors with no special roles). Put their groupname into the “Administrators” field and voila’ they will be able to edit this group. You could easily write a little temporary agent to update this field in all docs.