ACL to restrict browsing through Archives

[mkiessling]

Many projects store confidential files in Integrity Source.

Therefore access to these files has to be restricted.

Reading the file content can be restricted with the ACL permission FetchRevision.

For most projects this is not enough. Most projects want that only permitted users are allowed to navigate to confidential files.

Opening the project can be restricted with the ACL Permission OpenProject.

Unfortunately this does not work for archive.

Even one cannot access a project because he does not have the OpenProject permission, he can use "Add From Archive" to navigate through the whole Integrity archive.

An additional ACL permission, similar to OpenProject, but for Archives, would be very helpful.

[skamaraj]

Hello Markus Kiessling‌,

I think you are not aware of the permission configuration for archives. It shall be possible to restrict the user/groups from "sharing the archive".

Just open the Admin Client ==> Navigate to "Configuration Management" ==> Permissions ==> Archives

Now just right click and "Create" and select the sub project under which the confidential members are available.

Now just deny the access as you require,

This should work.

I hope this idea is already implemented and in use now

Regards,

Sathish

[mkiessling]

Hi Sathish,

thank you for your reply.

We already use Archive-ACLs. But unfortunately these permissions do not fit to our needs.

We want to prohibit navigating though the archive.

Navigating through the archive shall not be disabled for the whole repository, but on a user defined project level.

Regards

Markus

[skamaraj]

Hi Markus Kiessling‌,

Ya yes I agree your point. There is no way in preventing from navigating the archives.

But I confused why its actually needed , because even-though they could browse, its not possible to read its content (by adding the archives) / duplicate the archives. Anyway its not hidden, but somehow its protected. Its just I thought.

Regards,

Sathish

[mkiessling]

Hi Sathish Kumar Kamaraj‌,

our projects request this feature, because the archive names (and project structure) provide already information, which shall not be available to everyone.

E.g.

Contract_SupplierA.pdf

Application_JohnDoe.pdf

Regards

Markus

[skamaraj]

Hi Markus Kiessling‌,

That's fine. This clarified my doubt.

Regards,

Sathish

[khoppe]

Hello Markus,

the setting you are searching for is afaik part of the server's property file  "si.properties"

which controls on server level whether it is allowed to surf through archive directory.

I think you will find the following entry:

          # Is client allowed to surf the repository?

          si.repositoryBrowsingEnabled=true

Choosing false should prevent this for ALL.

DisadvantageSurfing isn't allowed for anyone.

MAy PTC Support knows how to better use this option ?!?

[mkiessling]

Hi Klaus Hoppe‌,

thank your for your hint regarding the entry in the si.properties file.

We had (before creating this idea) already contact with the PTC support.

They gave us the same hint.

Setting si.repositoryBrowsingEnabled=true would solve the use case "prevent users from browsing through the archive of other projects".

Unfortunately this option would also cause other problems.

For example reading dropped files within one project would become quite difficult, which is a significant impact to daily work.

For this reason PTC support gave us the advice "open an idea"

Regards

Markus

[Siddharth]

Markus Kiessling‌ Thanks for submitting this idea. We're currently working on introducing new web UI for Integrity Lifecycle Manager - wherein Requirements Management enhancements is first priority, with Source improvements being next. Your idea will be considered for that project !

[khoppe]

I would like to vote for this idea which is not possible with state "For Future Consideration".

Can you add my vote instead?

[Siddharth]

There's no way for me to mark your vote either. However, your last comment will be retained as it is - which shows you're also interested in this idea.