13

When a user is deleted from the CM it is actually marked as deleted, but still known in the system. The schemas, components, templates and pages will remain untouched and the deleted user is still visible in the history of the item. For workflow it could be a bit different. I don't know what happens to a workflow activity if the assigned user is deleted. ...


10

You are correct that Content Porter permissions are based on the access permissions in the CMS. So I think you assume correctly that there is no easy/supported way to limit this. If I were to try and change this, I would consider playing with security settings in IIS on the ImportExportService application under the CME website. You may be able to add some ...


9

Yes - it is possible to do what you want, but not in the way you describe. Assuming that the groups are created/configured by a Tridion system administrator, you can manage all of those things in an external directory using Tridion's LDAP integration functionality. Taking your requirements in turn: Adding new users Ensure that Group synchronisation is ...


9

There is no way to do this in the standard GUI, however, please see my blog article on the subject, where I show how to do this from a relatively straightforward Powershell script. With some boilerplate code in place, the script to set permissions on a category ends up looking like this: $catPermsTest = $core.Read("/webdav/01%20Definitions/PermsTest", $...


8

As noted, once they have Content Porter available to them, what they can do with it is primarily controlled by their permissions and rights in Tridion. I'd look at controlling who can install Content Porter. Even though it is available as a click-once install via the GUI, you could probably prevent some users from installing it via a group policy. (Or ...


8

AFAIK, there is no straight forward way to do so in GUI, you may need to write a Core Service code for it.


8

Access to see the ECL mount point (and also write permissions to Tridion metadata) is controlled with the permissions for the stub folder. Unfortunately the stub folder is hidden for non-admins, so only admins can modify the permissions in the current release of ECL (yes, we know :) ). Notice you can control both read and write access here (who can update ...


7

When you delete a user in Tridion, the user information is kept but the account is flagged as deleted, so all the history around items which they created/modified is kept and still visible


7

Tridion will make sure the person is authenticated from the AD, but that's it. Tridion as an organization has a best-of-breed approach and tries not to do things that others have done well, including authorization solutions. They sit on top and integrate with other well defined and correct solutions. I would suggest to place a page on your extranet login ...


7

It seems like I missed this step in the manual: <ExcludedPaths> <Path>/access_token.svc/</Path> </ExcludedPaths> In the ADF config file


7

There's no other way out-of-the-box, but you could create your own solution (e.g. a Custom Page) which exposes this functionality to the right people. Behind the scenes it then needs to impersonate an administrator user to do the actions.


7

There is a hotfix that updates all microservices to use Tomcat version 8.5.13. - see http://csei.sdl.com/hotfixes/#/hotfixes/c, and search for hotfix CD_8.5.0.4115 I'm not sure if the CM uses some Tomcat version internally. I know it uses Solr for Search, but i don't think that uses Tomcat.


6

Audience Manager is a subscription management tool which will allow visitors to manage their email subscriptions with your organization. I've seen many clients abuse this to double as an identity management solution but it is not intended as one so I would not advise this as a stable, production grade solution. You can use .Net built-in authentication and ...


5

You should not give these user groups Workflow Management Rights. Also, make sure that these groups are independent (they all may be members of Authors group, for example).


5

There will be two step process: Create javascript file which can detect idle time. Refer following link for this implementation: Detect idle time in javascript Load this javascript in tridion. Refer following link for this implementation: Load javascript file without any GUI references When idle time goes beyond the limit that you specified, ...


4

Two things spring to mind (I'm sure there are more!): You need to be careful that by disabling users that you do not 'block' items that are going through Workflow. This may be a problem if, for example, you disable all of the users in a particular group that are needed to approve content. You may also need to keep in mind that although you have disabled a ...


4

You can make a basic GUI Extension for your components (there are some guides to do this) Then in the js of your extension the code that you need could be something like that: if (Tridion.UI.UserSettings.getJsonUserSettings(true).User.Data.GroupMemberships.Group) { if (Tridion.UI.UserSettings.getJsonUserSettings(true).User.Data....


4

I have to confirm Jan's findings, when setting up an ECL provider, you specify a PrivilegedUserName for each mountpoint. If that user is a SDL Tridion Administrator, then your mountpoint should work for all SDL Tridion users. For my mountpoints I always use the SDL Tridion Admin user for that, which also is a Administrator on server level. Depending on your ...


4

It is non-exportable properties, see: docs


4

Yes, this permission granularity is something that Tridion provides out of the box. For example, the screenshot below shows the permissions for the 800 Author group on a specific folder: You can set this for individual users as well as groups. However, best practice is to set permissions such as this on a group level and then add users to groups. As well ...


3

You can use the MTSuser, that will work. Some considerations The privileged user will create Tridion items: the ECL schema, stub folders and stub compontents. Maybe you don't want te MTSuser to create any items. ECL does not need MTSuser access, so why grant it this special superadmin rights? The MTUser has a lot of access, do you trust your ECL provider ...


3

Apart from @Nuno answer, I want to add one more suggestion. Create a Core Services Page for Production Support Department which should allow Adding new users Assigning users to existing groups Enabling/disabling users Restrict this page with a specific user group access, so that no other user can misuse this page.


3

Unfortunately this is not possible OOTB. You may need to create a separate UI for user/group management - good candidate for a power tool IMHO.


3

One solution that I can suggest (if possible depending on your client) is having different Authentication mode for CME and Content Porter (ImportExportService). For example: If your CME is using the Windows Authentication, you may install & configure local LDAP on your server and create a replica of these users (to whom you want to give access to the ...


2

All users should be able to see the mount point. I did a quick test for your and my provider is visible for non-admins too. Maybe a provider (IContentLibrary) could do some user specific stuff in public IContentLibraryContext CreateContext(IEclSession tridionUser) but I don't think you can hide the mount point here. Are you shure this is not a GUI caching ...


2

Depending on the locks being accidental or intentional you might try programmatically unlocking on a fixed schedule (like 04:00). If people lock items for a purposes you would not want them unlocked (even by an admin). Note that "unlocking" comes in two flavors: checkin or cancel checkout. Accidental locks should normally be cancelled but incidental ones ...


2

The answer you probably don't want to hear is, "Port those structure groups and pages to a separate publication!" ;)


2

This was pretty easy to achieve with a GUI Extension Data Extender, which filtered the lists of regions and promotions sent from the CMS to the SmartTarget GUI. I used normal Tridion Group membership with specially named groups to manage the set of region prefixes that a given user was allowed to work with. Full details of the implementation are found in ...


2

I have implemented the same type of feature in my project. Here are the steps that I have followed - First read the all the tasks from that workflow process. Then read the group involved in that tasks. After that from Group read the list of users. Hope this will help you.


1

I would have used Publication Metadata to configure which items should go where. You can enable "key-value" pairs via metadata schema to specify which target should pick up which SG or items from an organizational item like folder. Something like: Target A tcm123;tcm345 After adding this metadata to publication, you can either use event system to validate ...


Only top voted, non community-wiki answers of a minimum length are eligible