Default Security Rights for New Publications

Question

When you create a new publication, Tridion applies some sensible default rights for the built in groups like Editor and Chief Editor. We built our security model on top of these default groups, so when we create new publications, the only configuration we have to do with regards to authorization is to alter the group scope to include the new publications.

The exception to this seems to be rights for optional modules like Translation Manager. It seems like we always have to manually add this right to the required groups for each new publication, which is is bit of a pain.

Looking at the docs, this does not seem possible, but I thought I would check anyway: Is there some way to also define defaults for these additional rights which come from optional modules so we don't have to keep doing this? We are using SDL Web Cloud (8.6)

Answer 1

Is there some way to also define defaults for these additional rights which come from optional modules so we don't have to keep doing this?

Not that I know of.

It seems like we always have to manually add this right to the required groups for each new publication, which is is bit of a pain.

You could utilize the Event System system to set these right. The way to do it is through the Repository.AccessControlList property.

Answer 2

In the past, (where the client had a tool to create new publications with specific blueprint setups depending on selected options) we added a simple extension to select 'default' permissions (that would ideally have been inherited) and then options to override them (if you were a member of a specific user group) - all interacting through the Core Service obviously.

You'll not be far wrong looking at the Powershell modules as a starter.