Complex rule for access to a group folder: forbid on 1st level, and selective access on the 2nd level

[knedlyk]

Hi! I have a task to organise collaborative access of staff members who belong to one department, but several sub-departments:
Dep A:
|—> Sub-dep A1
|—> Sub-dep A2
|—> Sub-dep A3

The logis is following:

1. all DepA members have to have RO access to the group folder, called DepA, but:
   1.1. all Sub-dep A1 members have to have RO and RW access to the sub-folder Sub-depA1, but do not have access to the sub-folders Sub-depA2, Sub-depA3;
   1.2. the same applies to members of Sub-depA2 and Sub-depA3;
   1.3. all DepA members have to have access to other sub-folders in the folder DepA.

My logic is following:

1. Create a group DepA, assign users to it;
2. Create groups Sub-depA1, Sub-depA2, Sub-depA3, assign users;
3. Create group folder DepA, assign group DepA to it with selective access rights;
4. Create sub-folders Sub-depA1, Sub-depA2, Sub-depa3 in the folder DepA;

And here I have 2 questions:

A. should the ‘first forbidden’ logic be applied, so I am allowing to have access to the group Sub-depA1 to the sub-folder Sub-depA1 only? And by default the other sub-folders will NOT be accessible? If yes, how?
B. should the ‘first allowed’ logic be applied, so I am forbidding to have access to the to the group Sub-depA1 to the sub-folder Sub-depA1 only? And by default the other sub-folders will be accessible? If yes, how?

Thanks!

[ernolf]

@knedlyk

If yes, how?

Here I described how to realize such setups with the “Advanced Permissions” (ACL feature) of the groupfolders App:

Group Folders not sharing properly

And here is one more: Create 3 groups: Groupfolderadmins Employees Customers Go to https://YOURCLOUD.TLD/settings/admin/groupfolders and create one groupfolder e.g. “Name-of-Company”: /Name-of-Company Assign this group folder to the following groups: Group Write Share Delete Groupfolderadmins [X] [X] [X] X Employees [X] [X] [X] X Customers [ ] [ ] [ ] X And “Advanced permissions” you assign to the “Groupfolderadmins”: [image] Creat…

[knedlyk]

Thanks for well described process! Please, explain, how to forbid users to change the advanced permissions, but only admins can do it? So, they may occasionally unsubscribe themselves from shared folder?

[ernolf]

@knedlyk

So, they may occasionally unsubscribe themselves from shared folder?

Yes, even that is possible.

That is why you should have one admin at least, that has complete access and is not “excluded”.

It follows that any ACL you set should be thoroughly tested with test users who are in the appropriate groups.

@knedlyk

how to forbid users to change the advanced permissions,

As an admin, you can determine who can edit the “Advanced Permissions”. No one can change that except those who are destined to do so here:

Much luck!