We are implementing webi document reporting under 6.5 (repository is on MS SQL Server) and during development our security settings worked just fine.
Erring on the side of caution, options were locked down pretty tightly at the root level so regular users were constrained to opening, refreshing and exporting to Excel, and we had a 'power users' group ready to go if we decided to open up the functionality a bit after a settling in period. Developers and admin staff of course were in groups where the settings were opened up again to allow them to create and delete Corporate Documents.
Then we turned LDAP authentication on and discovered some downsides to that approach, with some functions going missing for users that previously had them.
Figuring the group based permissions weren't being resolved in exactly the same manner under LDAP, we turned the model upside down and started with everything enabled at the group level and locked it down only for the parent group containing our end users.
But we still can't get the "Delete other Users' Corporate Documents' setting to work at all now. No matter what we set it to (even if 'Hidden' across the entire security domain with no overrides anywhere), all users can delete any document, yet it was fine before we turned LDAP on.
I've raised a case with BO Support, but I wonder if this rang bells with anyone here, or you had any suggestions?
Erring on the side of caution, options were locked down pretty tightly at the root level so regular users were constrained to opening, refreshing and exporting to Excel, and we had a 'power users' group ready to go if we decided to open up the functionality a bit after a settling in period. Developers and admin staff of course were in groups where the settings were opened up again to allow them to create and delete Corporate Documents.
Then we turned LDAP authentication on and discovered some downsides to that approach, with some functions going missing for users that previously had them.
Figuring the group based permissions weren't being resolved in exactly the same manner under LDAP, we turned the model upside down and started with everything enabled at the group level and locked it down only for the parent group containing our end users.
But we still can't get the "Delete other Users' Corporate Documents' setting to work at all now. No matter what we set it to (even if 'Hidden' across the entire security domain with no overrides anywhere), all users can delete any document, yet it was fine before we turned LDAP on.
I've raised a case with BO Support, but I wonder if this rang bells with anyone here, or you had any suggestions?