Deny an object store administrator access to a document
The following procedure provides specific steps needed to create a marking that denies an object store administrator access to a document. It follows the general steps described in the procedure Create a marking set.
Creating a marking set and applying it to a class of objects is a multi-step procedure. Refer to Markings if you need more information about the options mentioned below (and especially about how to set the marking's Constraint Mask and Security). The following procedure is a sample, designed to accomplish one simple task and could be modified to accomplish additional tasks required by your security design.
CAUTION Any time you deny basic administrative privileges, like to an object store administrator, you run the risk of unintended errors
NOTE This procedure will deny access only to new documents based on the document class to which you add the property template created below. It will not automatically or instantly deny access to any existing documents.
To create a marking set that will deny an object store administrator access to a document
- Create the marking.
- Right click the Enterprise Manager's P8 domain root property sheet and select the Marking Sets tab. All marking sets already defined for the P8 domain appear in this list.
- Click Create to launch the Create a Markings Set Wizard. The Welcome page of the wizard opens.
- Click Next. The Select Markings Set type page opens.
- Select List (non-ordered) and click Next. The Add Markings page appears.
- Type a name for the marking set. For example, you could enter "Deny Admin Access". Click New Marking. The Create New Marking property sheet appears.
- In the General tab, type a name for the Marking Value that will deny object store administrators access to the affected documents. For example, you could enter "Modify Owner" (since it is the Modify Owner right that will be denied in the constraint mask).
- Click the Constraint Mask tab and click Deselect All, then select only Modify owner. This is the access right that will be denied by the marking.
- Click the Security tab and then click Add. This opens the Select Users and Groups dialog box.
- Use the dialog box to find and and then add the names of all users and groups that should be allowed access to the document. For these accounts make sure the Use Marked Objects right is selected. The marking's constraint mask will have no effect on these users and groups.
- Use the dialog box to find and then add the names of all users and groups that should be denied the Modify Owner right. For these accounts make sure the Use Marked Objects right is deselected. The marking's constraint mask will apply to these users and groups.
(The other two rights, Add Marking and Remove Marking, are administrative permissions. For explanations, see Markings. )
- Click OK to close the Select Users and Groups dialog box and return to the Create New Marking property sheet's Security tab.
- Click Next to proceed to the Completing the Create a Marking Set Wizard page.
- Click Finish to complete and close the wizard. Click OK if a dialog box pops up to confirm that you have successfully created a Marking Set. The marking set you just created shows up in the P8 domain property sheet's Markings Set tab.
- Click OK to close the property sheet return to the default view of the Enterprise Manager.
- Create the Property Template.
- Create a new property template. Right click the Enterprise Manager's Property Template node and select New Property Template. This launches the Create a Property Template wizard.
- In the Wizard's Welcome page, click Next.
- In the Name and Describe the Property Template page, enter a name and optional description. For example, you could enter "Marking – Deny Admin Access". Click Next.
- In the Select the Data Type page, select String type. Click Next.
- In the Select a Choice List page, select Assign marking set and pick the marking set you created from the drop down list. Click Next.
- In the Single or Multi-Value? page, select Single for the purposes of this sample. Optionally, you could click More and use the More tab to specify the desired marking value as the default value of the string property, rather than having to set it on each new document
- Click Finish to complete and close the wizard. Click OK if a dialog box pops up to confirm that you have successfully created a Property Template. The property template you just created shows up in the Enterprise Manager's list of property templates.
- Assign the property template to a class.
- Select and expand the Enterprise Manager's Document Class node. Select the document class that should be associated with the new marking set and select Add properties to class. This launches the Add Properties to a Class Wizard which will let you add a property based on the new property template you just created. The new custom property shows up on the right side of the Enterprise Manager when you select the class.
- Create a document based on the class.
- Run the Create a New Document wizard to create a document based on that document class. Unless you set a default value for the property as described above, the wizard you use to create the object will not set the marking value for the marking-enabled property. You have to do that in the next step.
- Set the markings on the document (but see the Note below):
- Right-click the document and select Properties. Select the Properties tab.
- In the property grid's Property Name column, find the property you added to the class in the step above.
- Click either the Property Value cell or the cell's drop down arrow. Any markings that have already been set as values for the property will appear in the drop down list. You will also see Edit List... .
- Click Edit List... to open the Add/Remove List Items dialog box which you can use to add or remove markings. Note that you will only be able to see those markings that you have permissions to apply.
- When you are done setting values, click OK to close the object's property sheet. The object store administrators whose names were added to the first marking above will be able to run the Enterprise Manager but will not be able to see the documents.
NOTE If you created a single marking and if you set the default value as described above, you will not have to explicitly set the value as described in this step.