1

I have a Group named: 010_Global_Building_Blocks-Editor whose "General" and "Member of" settings are as shown below: General Tab:: enter image description here

Member of tab:: enter image description here

Confusion arises here only in MemberOf tab settings. In case the Option: "All Publications" is NOT selected, and only few (say first 2 publications [ 000 and 010 ]) are selected here, does this means the Group: "010_Global_Building_Blocks-Editor" will show up only in these 2 publications under their Security Settings as below ?? enter image description here

More concisely here are the concerns/Questions:

1.) the Group: 010_Global_Building_Blocks-Editor is made available for permission settings for ALL PUBLICATIONS in General tab.

2.) in the Member Of tab, the Membership scope is limited to only 2 publications

So, will the group as in point 1 above show up in only the 2 publications(as in point 2 above) OR will it show up for ALL Publications ?

What does the MemberShip Scope setting is meant for actually ? What kind of limit is it placing on anyway?

1

The General tab shows the membership scope of your group - 010_Global_Building_Blocks-Editor and this will come as ALL Publications

The Member of tab will shows all groups of which this group is a member and their specific membership scope (2 Publications for Editor Group). The Membership scope will be the Union of these groups - 010_Global_Building_Blocks-Editor and Editor. So the membership scope in your scenario should be All publications

  • Thanks Pankaj. One similar clarification again: Suppose there is a 060 Publication and the " 010_Global_Building_Blocks-Editor " has only " publish to content distributor" rights and the Editor has " Folder Management " rights on this 060 Publication, so this means that the OVERALL rights the " 010_Global_Building_Blocks-Editor " have is publish as well as Folder Management ? – R.C Apr 7 '15 at 14:46
  • Yes, that's how it should be – Pankaj Gaur Apr 8 '15 at 7:10
  • 1
    The General tab is not actually membership. As Rick explains this controls in which Publications the groups show up to set permissions. This is useful to make it easier to choose the right groups when setting permissions. In practice though, it's easier to manage permissions higher in the BluePrint, so "All Publications" is a good choice (so you could restrict permissions to a "System" folder where it's created, rather than localizing it lower in the BluePrint). – Alvin Reyes Apr 8 '15 at 18:36
  • Also, the membership scope is an intersection (what's in common) between all the membership scopes that a user belong to, up a given "chain" of membership scopes. See the Venn diagrams in the documentation for a nice example. The Publication scope for a user that belongs to 010_Global_Building_Blocks-Editor will be the two Publications plus any other scope granted from other groups. – Alvin Reyes Apr 8 '15 at 18:46
3

The Group scope (defined on the General tab in the CME) determines in which Publications the Group is available/visible.

The membership scope (defined per Group membership in the Member Of tab in the CME) only defines the scope of a particular Group membership.

Groups are often used as Roles (e.g. Author, Editor, etc.) in which case the Group scope is typically set to All Publication (the Role applies everywhere), but membership scopes are use to restrict who is in a specific Role in a particular Publication.

1

Let me add background on how I typically design authorization setups.

"Does this means the Group: 010_Global_Building_Blocks-Editor will show up only in these 2 publications under their Security Settings as below ?"

No, this means users that belong to this group will only see those two Publications. As Pankaj mentions it is related to the membership scopes of the user and groups (though it's an intersection rather than a union).

In older training and possibly previous Tridion versions, I think the General tab may have been different and related to scope (see my own confusion in this question How does `This group will be available for setting permissions in the following Publications` work?). I notice you have screenshots from Tridion 2011 and maybe 2009 or R5.3.

"1.) the Group: 010_Global_Building_Blocks-Editor is made available for permission settings for ALL PUBLICATIONS in General tab."

Correct, with the All Publications setting in the General tab, you will see this group in all Publications when setting Permissions (on organizational items like folders, Categories, and Structure Groups). This is useful for setting permissions higher in the BluePrint, otherwise you won't be able to set these permissions in lower Publications without localizing organizational items.

"2.) in the Member Of tab, the Membership scope is limited to only 2 publications

So, will the group as in point 1 above show up in only the 2 publications(as in point 2 above) OR will it show up for ALL Publications ?"

The Group will show up in all Publications for permissions.

"What does the MemberShip Scope setting is meant for actually ? What kind of limit is it placing on anyway?"

Scope specifically limits the Publications a user sees. Typically you might hide Schemas and Design Publications from editorial users, while still giving them permissions to the folders containing Schemas and Templates (so the editors can select them). Each Group gets a different set of Membership Of Publications.

As Rick mentioned, we often use groups as "Roles" like Author. You might have groups such:

  • Intranet Author
  • WWW Author

Both would belong to Group (role) Author, but with the Schemas and Template Publications unselected and appropriate Content and Page Publications selected.

One similar clarification again: Suppose there is a 060 Publication and the " 010_Global_Building_Blocks-Editor " has only " publish to content distributor" rights and the Editor has " Folder Management " rights on this 060 Publication, so this means that the OVERALL rights the " 010_Global_Building_Blocks-Editor " have is publish as well as Folder Management ?

Rights and permissions are additive, so within a Publication a user would get both of those rights.

In practice, I recommend keeping Rights consistent so in your case, the 010_Global_Building_Blocks-Editor would have the same rights across all Publications. You might skip setting this in certain Publications, but it gets harder to troubleshoot and maintain when the same group has different rights across Publications.

The Membership of setting is particularly useful when you have lots of CMS users. For a few users it doesn't matter if you set Membership Scope to hide Publications for each user, but for dozens or hundreds of users, it's much easier to set the Scope in the Groups. You assign members to a given group and manage all the Publications they see in one setting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.