AD Group Security

Permanently deleted user

November 06, 2015 20:39

I have 2 AD groups we'll call them group A and group B

 

Group A has a select number of users.  Group B has all of the users including the ones in Group A.

 

I have a layer in an application that I only want group A users to access but I want all of Group B to access the application.  How do I set up the permissions to accomplish this?

 

Right now the permissions for Group B are set to allow access to the Site but denied on the specific layers.  Group A has access to the site and those layers.  I am in both groups, so I should see the restricted layers, but am unable to.

0

• 

  Ryan Kelley

  November 06, 2015 20:42

  Try something like the image below. I have to deal with this all the time.

   

  

  0
• 

  Ryan Kelley

  November 06, 2015 20:45

  Actually, this really pertains to workflows... maybe it'll get you on the right track though?? However, I feel like with permissions on layers specifically, I have had to make separate viewers to avoid the conflict you are referring to.

  0
• 

  Ryan Cooney

  November 07, 2015 00:34

  Here's how we apply permissions:

  • Deny permissions trump allow permissions at the same level.
  • Allow permissions trump deny permissions that are inherited.

  Your use case is possible when you are able to deny access to an ancestor object for group B and then allow access to a descendant object for group A.

   

  --Ryan

  0
• 

  Permanently deleted user

  November 09, 2015 15:35

  So the following should work?

   

  Image 1 is for Group B which is denying general users access to the well sticks layer

   

   

   

  Image 2 is for Group A, granting select users (who are all also users of group B) access to the well sticks

   

   

  

   

  Both groups are also granted Site access, it's not implied. 

  0
• 

  Permanently deleted user

  January 19, 2016 04:51

  Scott, if you're still having issues then I can give you an answer to help get almost any kind of permission combinations but if you have what you want then I'll leave it be as it's a handfull to type out.

  0
• 

  Permanently deleted user

  January 19, 2016 14:11

  We got it working Matthew.  It was just taking much longer thane expected for changes made in the AD groups to trickle through the system.  Thanks though.

  0

Please sign in to leave a comment.