Named access control list administration (IRPCNamedACLsAdmin)

View as Markdown

Adds, reads, modifies and removes the named access control lists (permission templates) of a vault.

Use this interface to add, modify and delete named ACLs in a vault.

Overview

A named ACL is a reusable set of permissions with a name, such as "Visible to company management only". Users pick one when they set the permissions of an object; value list items and classes can apply one automatically. See Permissions. M-Files Admin uses this service for the Named access control lists node of a vault.

• Session and rights. Requires a vault session. Reading needs the vault right read_all_metadata_structure (VaultAccess); adding, modifying and removing need change_metadata_structure and license_allows_modifications.
• Two ACLs per named ACL (NamedACLAdmin): named_acl.acl_for_objects is the permission set that objects get; acl controls who can see and select the named ACL.
• Types. NACLTYPE_NORMAL named ACLs are offered to users. NACLTYPE_INTERNAL named ACLs hold automatic permissions defined on value list items and classes, and are not offered to users.
• Built-in named ACLs have negative IDs, for example -1 "Full control for all internal users" and -20 "Only for me".
• Objects that use a named ACL stay linked to it: modifying the named ACL can update their permissions in the background, see ModifyNamedACL.

Users who are not administrators read the named ACLs they can select with GetNamedACLs.

Methods