Restrict universe export to particular folder?

[Former Member]

Edge 3.1 on Linux

Is it possible to deny export rights to a specific folder?

Here is the requirement. The users are all 'power-users', able to create reports but they also need to create universes. There is a \Prod folder for production universes and a \Dev folder for developing universes. Only the Administrator group should be able to export to the \Prod folder.

The Power Users need to use universes from the \Prod folder to create reports; they should be able to import from the \Prod folder to look at production universes, but only be able to export to the \Dev folder.

I've tried 'Add objects to folders that the user owns' and even denying 'Add objects to the folder', but they still can export to \Prod.

Is it possible to achieve this requirement? If so, any ideas?

[former_member793810]

You can customize security on a universe...

To restrict #Universe# or #Universe Folder# to a user or to the user group,follow the following steps

Login into Central Management Console (CMC) as administrator and select #Universes#

Select the universe or the folder in which universe is saved

Right click and select #Manage# -> #Security#-> #User Security#

Make sure the user group or the user to whom you would like to restrict the access is available

Select the user or the user group and click on #Assign Security#

Clear the options for #Inheritance# (Inherit form parent folder, inherit from parent group)

Select #Access levels# tab and Click on #Remove Access# button then click #Apply# and #OK#

Or

Click on #Advanced# tab and click on the link #Add/Remove Rights#.

Expand #General# and click on #General# to find general rights assigned, now explicitly deny #View objects# privilege then click #Apply# and #OK#.

Once this is done login to Universe Designer as restricted user or user form restricted group and try to import the restricted universe or a universe from restricted universe folder. You will not find the #Universe# restricted or the #Universe folder# restricted.

Regards,

Bashir Awan

[Former Member]

Bashir,

That put me on the right track - thanks for your help. To meet the requirement, I had to do the following on the /Prod folder:

For the group in question, uncheck 'Inherit from Parent Group', leave 'Inherit from Parent Folder' checked.

Add/Remove Rights:

Content/Folder - Deny 'Add objects to the folder'

General/General - Deny 'Add objects to the folder'

General/General - Deny 'Delete objects'

General/General - Deny Edit objects'