Override Priveleges

[Nat_Mara]

I have a user which is in multiple groups, but even though I have least restrictive set up in global client settings, I am having a conflict. the first group he is a part of just allows retrieval, print, external mail, view KW.  I had to set override privileges so that he is unable to delete documents.  He is part of an OnBase scanners group, which allows him to create documents. but it also has the delete privileges, thus the need for override privileges.  My issue is now he gets a message that he is not authorized to create a document when attempting to scan or import a document.  He should have that right because he is a part of the OnBase scanners group.  I can rectify by adding Create to his overriding privileges but why should I have to if he already has that in other group??

Confused ...

[Nat_Mara]

I think it is our setup then.  I have overrides setup for both groups.  I have included 3 images.  The first shows override permissions for Commission on Judicial Conduct (CJC).  The Second show override permissions for OnBase_scanners group.  The last one shows combined override permissions If I go to Document types>User groups>Override Permissions>Select BOTH groups>Settings..  Looks like it is just looking to default group based on DEFAULT GROUP choices that are checked.

 

[John_Anderson4]

When you do overrides, the "User Settings" column is all that matters. The "Group Default" column is informational only - it lets you know what their group setting is, but when you use overrides, it only uses the User Settings column. So I think you need to check the Delete options in the User Settings column of the Scanners group.

I don't think it does anything when you highlight multiple user groups and hit override. It doesn't give some kind of "preview" of what the rights would be for a user in both groups. I'd say it's a bug and that button should be disabled when multiple groups are selected.

[Mike_Walkuski]

Hi Nat,

It appears that you believe selecting both groups will give you the combined configuration of the Document Type overrides, however this is not the case. When you select multiple groups in the Document Type User Group configuration, the Group Default that you see on the left will be the default Privileges that are applied to the first group in the list, not necessarily a combination of all groups. 

We do not check any of the boxes by default so that you can specifically choose the override privileges you want applied to both groups and one group's prior override settings do not affect the other.

See my screenshots below.

[Nat_Mara]

Thanks Mike and John for all your help.  Guess I was assuming cumulative permissions, but wither overrides it apparently works different than I assumed.  Anyhow, I just set it at the document type level, and selected both groups in Document Type User Group configuration and selected all the privileges.  I initially tried this, but thought it was redundant but apparently that is how it needs to be set up.  Since it is only an override for those specific document types it will not affect that user groups normal privileges for all other user groups I assume.  Much appreciated..

[Thomas_Reu]

Nat, fyi - it may also save you a little long term grief if you set the standard privileges like you want, and then just enable overrides.  It will take everything already chosen as a default and you're good.  Note: you can add overrides manually, that didn't default.  However, to see these you have to dig all the way down to the overrides window.  It's a lot quicker to just open privileges and know that everything you've chosen is good as long as you know that you enabled overrides.

Also, some items aren't in overrides and least restrictive means the client can use these in all doc types.  For example: the Client Based Products and Client Features on the right side of the privileges window.  Document Properties being a good example.