How does `This group will be available for setting permissions in the following Publications` work?

Question

I've explained SDL Tridion authorization and basic practices but I'm not sure how the Group "available for setting permissions" setting completely works.

I understand the publications a user sees in the Content Manager Explorer is an intersection (subset) of all the "member of" scope settings from the groups the user belongs to per the User Groups documentation (requires login)

Publications

For example, I have the following publications:

• Content
• Design
• Website

Scenario A: Typical Scope Setup

• User belongs to Marketing Authors group with "member of" scope set to All.
• Marketing Authors belongs to Authors with membership scope set to publications Content and Website.
• All groups and users have "available for setting permissions" set to All.
• Each publication has the Authors group with Component Management rights.

User sees two publications, Content and Website, since membership scope is an intersection of each member of scope setting.

Scenario B: "Available For" Setup

• User belongs to Marketing Authors group with "member of" scope set to All.
• Marketing Authors belongs to Authors with membership scope set to All (rather than just Content and Website).
• Marketing Authors also has "available for setting permissions" set to Content and Website only.
• Each publication has the Authors group with Component Management rights.

However, with this setup, users can see the Design publication.

It looks like because a user belongs to a group that belongs to another group that has (any) rights in a publication, the user sees that publication.

How does the "available for setting permissions" setting work? Is it different from membership scope?

Answer 1

It sort of seems like you have answered your own question here, but anyway...

I would use Authors for controlling Rights, and then Marketing Authors (which is a member of Authors) for managing which Publications a User has Author Rights in.

Even if a User is a member of Marketing Authors for ALL Publications, it will only see the Publications that Marketing Authors explicitly have Rights in (by setting the Rights in the security tab of the Publication properties window), or Publications which it inherits Rights in from being a member of Authors (Group Membership Scope).

If the Group has "available for setting permissions" selected for a Publication, it will be available as an option when setting Permissions on an Organizational Item in that Publication.

Answer 2

To "have" a permission or right, you must either have that permission or right "in your own right"(!) by having the permission or right assigned to your User, or you can get it via your group memberships.

Group memberships are transitive, in that if you are a member of A, and A is a member of B which is a member of C, you get C's permissions. It all needs to join up, or you don't get any permissions.

When scope is used, any restrictions that are added can prevent you having membership. In my example, if in the publication you are in, B is not a member of C or A is not a member of B, or you are not a member of A, you lose.

It's as simple as that. It all has to join up, or you lose. If you can't traverse the membership relationships to get to the permission you need, you don't get it.

The vast majority of Tridion users don't need this level of subtlety. (Historically, this need for a highly generic system came about because R5 needed to be able to emulate the R4 security model, which was radically different.) Of course, there are advanced cases where having this flexibility is useful, but for most people, the advice is "don't turn all the dials at once". In other words, if you are not certain that you need to scope to individual publications, you probably don't.