Automatically grant access to parent folders when giving access to a subfolder
Automatically grant access to parent folders when giving access to a subfolder
1 vote
Hello Devoltuions,
I ran into a bit of an issue with permissions in RDM and wanted to suggest a possible improvement.
At the moment, if you create a permission group and assign it to a subfolder, the user gets access to that folder, but not to the folders above it.
For example:
Customers
-> Customer 1
-> Customer 2
-> Customer 3
If I assign a permission group to Customer 1, but the user doesn't have access to the Customers folder, the user won't actually see Customer 1, because they can't access the parent folder in the first place.
This can complicate things when you have a lot of customers under one main folder. In our case, we have a general permission group that is inherited by all (around 80) customer folders, but when we also want to give a specific user access to only one particular customer, we can't (without much rework) because the view permission is set on customer and inherited by all customers. Due to that, just creating one new group for that specific customer doesn't help either, because as soon you give view permission on the main customer folder, it is inherited by all other customers.
It would be nice if RDM could handle this automatically.
My preferred solution would be that, when you grant a user/group access to a subfolder or entry, RDM automatically gives them the required access to the parent folders above it.
So, for example, if I give someone access to:
Customers → Customer 1 → Servers
RDM would automatically give them enough access to Customers and Customer 1 to allow them to navigate to Servers, without giving them access to the other customers or subfolders/entries in a specific customer.
Alternatively, there could be an option/checkbox when assigning the permission group, something like:
[x] Grant access to parent folders
I think automatically granting the required access to the parent folders makes the most sense, though. If I've explicitly given a user access to a subfolder or entry, but they can't actually see it because they don't have access to the folders above it, the permission doesn't really do anything.
Maybe there is already a recommended way of handling this scenario in RDM and if so, i would love to hear it.
BR
Mauricio
All Comments (3)
Hello,
I believe your request sounds similar to we've had requested here for a "traverse" permission: https://forum.devolutions.net/topics/31742/permission-to-traverse-folders
In short, what has been requested is if you grant a user this permission on let's say your "Customer 1" folder, they would be able to see the whole folder structure to reach this folder, without having to set their permission on every folder above.
It's not something that would be easy to achieve with the way our code currently works, but it's a feature that a handful of users have asked for over the years, and we see the benefit.
As for what you've directly asked for, I'm not sure whether it's a good idea to automatically set permissions on a whole folder structure, as it would be difficult to manage after the fact in case you want to remove these permissions. We'll have to give more thought for an alternative that works with our current permission system.
If I missed the mark with my answer, please let me know, as I may not fully understand your scenario.
Regards,
Hubert Mireault
Thank you very much fot the quick response. I understand how my proposal could be complicated to manage internally and I just wanted to throw in an idea with a concept.
I just want to avoid that when we switch to a more controlled environment, we don't need to adjust over 1700 folders permissions, removing the inheritance, to achieve it and have to adjust 5 to 10 folders every time we want to add a new restricted zone.
(Customers Folder is just one part of a whole bigger RDM Structure)
Sorry about the delayed response, I was out of the office last week.
Maybe just one question comes to mind because of what you said here:
we don't need to adjust over 1700 folders permissions, removing the inheritance
I don't think it will solve your issues fully, but did you try out the "Custom + inherited" permission mode? This mode allows you to both have the "inherited" value as a default, while allowing you to grant the permission to a certain user or user group. It might help simplify some configurations for you, though I don't think the larger issue will be solved here.
Regardless, we're keeping this in mind as a pain point for users, especially for ones with larger infrastructures.
Regards,
Hubert Mireault