2.1 Understanding Access Control

Access control is how you specify which users have the right to perform which tasks in which places. Because your OpenText Vibe site is a hierarchy of workspaces and folders and because access control settings can be inherited (or not), access control settings affect a variety of Vibe features

OpenText Vibe uses role-based access control. By default, there are seven roles, and each role contains specific rights. If you want a particular user to have certain rights, you can assign that user to the appropriate role.

For example, a user who has been assigned to the Participant role in a workspace or folder can add comments or replies, create entries, delete his or her own entries, modify his or her own entries, and read entries in that folder or workspace.

The following sections help you better understand how access control works in Vibe.

2.1.1 Inheritance

Workspaces can inherit the access control settings of their parent workspaces. You should understand the following facts about access control inheritance:

If you create a new workspace under an existing workspace that is inheriting its access control settings from its parent, the new workspace continues the inheritance chain. If you change any access control settings above the new workspace at a later time, the access control settings for the new workspace also change. Global workspaces inherit access control settings from the parent workspace by default.
If you create a new workspace under an existing workspace that is not inheriting its access control settings, the new workspace retains the non-inherited settings of the parent workspace.
If you move a workspace that is inheriting its access control settings from its original parent workspace, it inherits the access control settings of the new parent workspace into which it is moved. If the new parent workspace has different settings than the original parent workspace, the access control settings for the moved workspace change accordingly.
Team membership is inherited separately from access control settings. If access control settings are being inherited, this does not necessarily mean that team membership is also being inherited. To edit team membership or to change the team membership inheritance settings for a team workspace, click the Configure icon next to the workspace title, then click Edit Team.

2.1.2 Navigation

As a best practice, you should not grant users access to sub-workspaces and sub-folders while restricting access for the same users to the higher-level (parent) folders. Ignoring this best practice can be problematic for the following reasons:

Users cannot navigate to the sub-workspace or sub-folder using the Workspace tree navigation, even though they have appropriate rights to the sub-workspace or sub-folder.

If you understand this limitation and still have a need to restrict access to a parent workspace or folder while granting access to a sub-workspace or sub-folder, users can still access the hidden sub-workspace or sub-folder by using the Search feature or by accessing the location through WebDAV.
Users can see the name of a higher-level workspace, even though they do not have appropriate rights.

Users who use the Search feature or WebDAV to locate the sub-workspace or sub-folder that they have been granted access to are able to see the name of the parent workspace, which they would otherwise not be able to see. However, they can see only the workspace name, not the contents of the workspace.

2.1.3 Default Access Control Behavior in Workspaces

By default, most places inherit the access control settings of their parent. When you establish settings for a primary space, all sub-places automatically apply the same settings, saving administration time. However, unlike other types of workspaces, Team workspaces do not retain the access control settings of the parent workspace by default. This is because the desired access control settings for Team workspaces can vary greatly depending on the objectives of the team.

Also, team membership is inherited separately from access control settings. If access control settings are being inherited, this does not necessarily mean that team membership is also being inherited. To edit team membership or to change the team membership inheritance settings for a team workspace, click Workspace > Edit Team.

2.1.4 Default User Rights

By default, all Vibe users have rights to perform the following actions:

Participate in any team workspaces in which they are a member (create folders and entries, make comments, and so forth)
Create team workspaces (by default, only members of a team can view and participate in team workspaces)
Visit all personal workspaces (read entries and comment on them)
Participate in all global workspaces and folders

2.1.5 Default Roles

Vibe includes default roles that you can assign to users and groups. The following sections describe the function of each default role, but does not describe all of the rights associated with each role. For a complete list of rights, click the name of the role in the table on the Configure Access Control page. (Click the Configure icon next to the workspace or folder title, then click Access Control.)

For information on how the administrator can assign users to various roles for the Vibe site, see Controlling User Access throughout the Vibe Site. For a detailed description of each right that can be associated with a given role, see Understanding the Various Rights for Roles.

Vibe enables site administrators to create their own custom roles, as described in Defining a New Role.

Understanding Default Roles for Workspaces and Folders

Role	Description
Allow Sharing With Internal Users	Can share workspaces and folders with internal users.
Allow Sharing With External Users	Can share workspaces and folders with external users.
Allow Forwarding of Sharing Rights	When sharing, can allow users to re-share workspaces and folders.
Allow Sharing With The Public	Can share workspaces and folders with the Public.
Allow Sharing File Links	Can share File Links.
Visitor	Has read-only and comment-only access.
Participant	Can create entries and modify those entries, can download folder content as a CSV file, plus perform tasks associated with the Visitor role.
Guest Participant	Can read entries, create entries, and add comments.
Team Member	Has all the rights of a Participant. In addition, can generate reports and manage global tags.
Workspace and Folder Administrator	Can create, modify, or delete workspaces or folders; moderate participation (modify or delete the entries of others); design entries and workflows; set entry-level access controls on entries of others; and perform tasks associated with the Participant and Team Member role.
Workspace Creator	Can create sub-workspaces. In Team Workspace Root workspaces, this role lets users create their own team workspaces.

Understanding Default Roles for Entries

Role	Description
Owner Create Entry ACLs	The owner of the entry can create entry-level access controls.
Read	Can read the entry.
Read and Reply	Can read the entry and add comments or replies to the entry.
Write	Can read the entry, add comments or replies, and modify the entry.
Delete	Can read the entry, add comments or replies, modify, and delete the entry.
Change Access Controls	Can read the entry, add comments or replies, modify, and delete the entry. Can also modify the access control settings of the entry.

Understanding Default Administrative Roles

Role	Description
Allow Adding Guest Access	Can make Vibe workspaces and folders available to Guest users in Vibe. By default, Guest users can access only the Guest user personal workspace, as well as any workspace or folder that the Vibe administrator has granted them rights to access. For more information, see Enabling Individual Users to Grant Guest Access throughout the Vibe Site.
Can Only See Members Of Groups I Am In	Removes a user’s ability to view other Vibe users who are not members of a group that he or she belongs to.
Override “Can Only See Members Of Groups I Am In”	Overrides the Can Only See Members Of Groups I Am In role. This can simplify the administration of the Can Only See Members Of Groups I Am In role. For example, you might assign the Can Only See Members Of Groups I Am In role to a group, but at the same time you want to allow certain members of the group to retain their ability to see users that belong to groups outside of their own. In this circumstance, you can assign the Override “Can Only See Members Of Groups I Am In” role to the members who you want to retain their ability to see users outside of their own groups.
Token Requester	Can make web service calls on behalf of another Vibe user. This functionality can enable administrators to perform proxy functions for individual Vibe users without logging in as the Vibe user. This means that the web services application does not cache individual users’ credentials in order to perform operations. This role should not be assigned to a Vibe user, but rather to a system-level (agent) account that you want to be responsible for executing web service operations on behalf of one or more regular Vibe users. For more information about the web services operations that support the Token Requester role, see admin_getApplicationScopedToken and admin_destroyApplicationScopedToken in the OpenText Vibe 4.0.8 Developer Guide.
Zone Administration	Has all rights associated with access control.

2.1.6 Default Users and Groups

You can assign default or custom access control roles to users and groups for the Vibe site if you are the Vibe administrator, or in your workspaces if you are a workspace owner. In addition to the users and groups that the Vibe administrator creates, Vibe includes four default users and groups to which you can assign roles.

Default User and Group	Description
Owner of a Workspace or Folder	The person who created the workspace, or the person assigned to be the owner of the workspace.
Team Members	The individuals who are designated as team members in a given place. For information about how to add team members, see Adding Additional Team Members to Your Workspace in the OpenText Vibe 4.0.8 User Guide.
All Users	Every person registered within the Vibe site.
Site Administrator	The person who has rights to perform any task in any workspace or folder. Available only to Vibe administrators.