BusinessObjects Enterprise Administrator's Guide

Customizing a 'top-down' inheritance model

With the flexibility offered by object rights, inheritance, and advanced rights, you can customize your object-level security environment in many ways. However, as the complexity of any security system increases, so too can that system become more difficult and time-consuming to maintain. This section recommends two general ways of setting up object security such that you achieve the desired security levels without complicating future administrative tasks. To this purpose, this section provides two tutorials that shows how to set up object security from the top-level folder (the root folder) down:

• Setting up an open system of decreasing rights

  This detailed tutorial creates an open security model. By default, all users and groups are first granted rights to all objects on the system. As you add folders and subfolders to the system, you decrease the rights of users and groups, as required, in order to secure particular BusinessObjects Enterprise content.

• Setting up a closed system of increasing rights

  This shorter tutorial creates the basis for closed security model. By default, users and groups cannot access any objects on the system. As you add folders and subfolders to the system, you increase the rights of users and groups, as required, in order to grant access to particular BusinessObjects Enterprise content.

You can use your own Enterprise, NT, or LDAP groups when following along with these tutorials, or you can create new groups that correspond to those used in the tutorial. For details on setting up these groups and subgroups, see Creating groups for the tutorials.

In each tutorial, you will specify the object rights that particular groups have to certain folders on the system. By making all of your security settings at the group and folder levels, you reduce the administrative efforts now and later. After finishing each tutorial, you may decide to add users to each group and to publish objects to each folder. If you do so, each user will inherit the appropriate rights for every folder and object on the system.

Click the appropriate link to jump to that section:

• Creating groups for the tutorials
• Setting up an open system of decreasing rights
• Setting up a closed system of increasing rights