Windchill Folder permissions

[JohnMattson]

(I'm running WC 9.1 M050 and Elements/Pro 5.0)
I'd like to make 1st level folders within a Product to be read-only to users, so that they cannot check objects in at the top level and so that they cannot create additional folders at the main level (admins will do that). Once first level folders are created by the admin, I'd them to have permissions that allow users (e.g. the Designer role) to have full control of those subfolders. Is this doable? I'm assuming it would be done with Access Control rules at the different folder levels?

Thanks, John

[MikeLockwood]

During folder creation there is an Access Control panel. If already created, use Manage Security as the action on the Folder.
In the Policy Administrator, remove permissions on "SubFolder" such that all permissions are only granted on the folders thru the Folders themselves.

[MikeLockwood]

Also - Set up all your OIR's with a Folder specified after /Default - this enforces all objects being created at other than the root in each context.

From: Lockwood,Mike,IRVINE,R&D

[MikeFoster]

Hi John,

I achieved this functionality using these ACL's.

Cabinet Guest Read
Cabinet Product Manager Read,Modify
Cabinet Team Members Read
SubFolder Designer Read,Modify,Modify Identity,Create,Delete
SubFolder Guest Read
SubFolder Team Members Read

The only downside is an apparent bug that prevents users from moving more than one object at a time out of a top-level folder - For some Windchill reason the little move icon disappears in the top-level folder with these settings even though "Move" is still available in the actions pulldown for an object.

Mike Foster
ATK

[raghavendra.dat]

Hi John, Usually we achieve this by creating new domains for each folder/subfolder as required and provide access on subfolder or cabinet to required group/role through ACLs.

1. Under /Default domain create a new domain. For easy understanding, give folder/subfolder name on which you want to control access.

2. Goto Product -> Utilities -> Preference Manager

3. Search for "Display Folder Domains" under "Security" preference. Set it to "Yes".

4. Go to Product -> Folders tab, edit folder/subfolders and set domain from /Default to newly created ones accordingly. Domains can be set while creating new folders/subfolders as well.

5. Update access policy for /Default/<folder specific=" domain="> access in policy administrator andgrant/deny access for "subfolder" or "cabinet" as per your requirement.

I hope it will be useful for you.

Regards,

Raghavendra

[ejhlti]

On a related note, is there any way to prevent users from checking in new objects (or moving objects)to a product root, i.e. they have to set a folder under the product ?

[raghavendra.dat]

Hi Ed,

The root folder will be mapped by default to "/Default" domain. There you can deny or removecreate/move permissions on it as per your requirement.

And, for sub folders create a new domain, map it with the subfolderand provide required permissions for that subfolder.

I hope it answers your question.

[ejhlti]

regarding disabling the ability to create objects at a product root, Mike Foster gave me the tip below. Works perfect for preventing check-in at the root level of a product, however by disabling the modify permissions in the cabinet, users can no longer create a change request (most likely other change objects also). Can anyone think of a workaround for this ?

Remove modify permission from the Cabinet type to do that.

Modify permission on Cabinet required to add, move, or remove any object from the Cabinet (top folder of a Product)

• Not required for movement among subfolders


• Required for creating a SubFolder in the cabinet but not sub-SubFolders


• Not required for renaming a SubFolder or object in the Cabinet


• Not required for deleting a SubFolder

[ddemay]

OIR on change objects could be tweaked?, soft type the subfolder object and create soft typed folders with different ACL's.



Sent from my Verizon Wireless BlackBerry

[patrick.chin1]

I would do a combination of OIR default folder location for creation of objects and ACL to prevent objects from changing domains. After creation into a designated sub folder like, /Default/EPMDocuments/..., /Default/WTPart/..., /Default/WTDocuments/..., etc, based on OIRs of the objects, you can add additional ACL to prevent moving/modifying objects from domain to domain.

That's OOTB suggestion,

Patrick