Understanding security inheritance

Inheritable depth (Apply to)

Each ACE has an inheritable depth setting that is invoked if the ACE is configured to be inherited by a child object. The following settings are available:

This object only

This ACE would not be inherited even if it were configured for inheritance.

This object and immediate children

This ACE applies to the object and would be inherited by the parent object's children, but not by the child object's children. After inheritance takes place, the child ACE will have an inheritable depth of This object only.

This object and all children

This ACE applies to the object and would be inherited by every generation of the parent object's child objects. After inheritance takes place, the child object's ACE will have an inheritable depth of This object and all children.

All children, but not this object

This ACE would be inherited by every generation of the parent object's child objects, but does not affect the parent object itself.

Immediate children, but not this object

This ACE would be inherited only by the parent object's immediate children, but not by further generations, and does not affect the parent object itself.

The Administration Console for Content Platform Engine security editor lets you set inheritable depth. For more information, see Configure inheritable depth.

Inheritance relationships

An inheritance relationship between a child object and a parent object is created by giving a value to a specific object-valued property of the child. This value references the parent. The object-valued property of the child object must include a SecurityProxyType value of Inherited in its property definition metadata. Several object-valued properties are built-in properties for the predefined classes and others can be added as custom properties.

Tip: To view the object-valued properties, from the Administration Console for Content Platform Engine, select the object and then click the Properties tab and scroll down the list of properties.

SecurityFolder

The SecurityFolder property is a built-in property of the Document and CustomObject classes. The security folder specifies a folder from which an object inherits security. There is no requirement that its security children be filed in the folder.

AnnotatedObject

The AnnotatedObject property is a built-in property of the Annotation class. The annotated object specifies an IndependentObject object of type Document, Folder, or CustomObject to which this annotation has been applied.

SuperclassDefinition

The SuperclassDefinition property is a built-in property of the ClassDefinition class. The superclass definition specifies the ClassDefinition object that defines the immediate superclass of the class that is defined by this class definition.

Restriction: This property controls inheritance of permissions only, not the default instance permissions.

Coordinator

The Coordinator property is a built-in property of the Task class. The coordinator is a reference to the containable object that is acting as the coordinator for this and other related tasks.

Custom properties

Content Platform Engine provides extensible security parent relationships with the SecurityProxyType property placed on the metadata of custom object-valued properties. This type of property is known as a proxy-defining property. This property is added to the class definition of the intended security child, and then a value is set for that property on an instance of the class to establish the security parent of that child. You can add proxy-defining properties to any class of objects as required by your security design, including, but not limited to, folders. An object can have many such proxy-defining properties, that is, many security parents from which ACEs are inherited. The inherited ACEs from each are merged together and contribute with equal priority to the access check that produces the final security mask.

Tip: To view this property, from the Administration Console for Content Platform Engine, select the object, then click the Properties tab and scroll down the list of properties.

Important: If a security proxy object is marked for deletion (which places it in the Recovery Bin), the server continues to allow for the security proxy's permissions to be inherited by the child object. For example, if DocA is a security proxy for DocB and DocA is marked for deletion, then DocB continues to inherit its security from DocA, even though DocA cannot be queried or retrieved by users with typical access rights. Only users with the VIEW_RECOVERABLE_OBJECTS permission on the object store can access DocA. Although objects marked for deletion are not viewable by most users, the objects exist in the object store database, and they are potentially recoverable. Therefore, the server maintains the inherited security from security proxy objects that are recoverable. This behavior can result in an inheriting object granting more permissions than would be expected from inspection by someone without VIEW_RECOVERABLE_OBJECTS permission, potentially causing confusion, or, in unusual circumstances, being counter to the intention of marking the proxy object for deletion. To avoid these potential issues, it is recommended that objects whose primary purpose is to act as a security proxy not be marked for deletion. If the intent is to terminate the proxy relationship, a delete should be used instead.

Configuring inheritance

For configuring inheritance on documents and custom objects, see Configure a document's security parent and Configure a folder to be a security parent.

Folders have an Inherit parent permissions property on the General tab of their property sheets in Administration Console for Content Platform Engine. This check box governs inheritance between folders. When you select it, the folder will inherit permissions from its parent folder if the parent folder has inheritable permissions. Changing the property from True to False removes any ACEs that were formerly inherited from the parent folder.

Subclassed permissions are copied, not inherited

When you make a new subclass from a class definition, some permissions are passed from the parent class definition to the new child class definition in a manner that is not inheritance. When you make a new subclass, those permissions of the originating class definition that have a Source type of Default or Direct and are of inheritable depth This object only are exactly copied to the new subclass with a source of Default and no change in inheritable depth.

During subclassing, the child class receives the ACEs of its parent as described in the following table. Notice that Default permissions with inheritable depth of This object only are not inherited by the child. Instead, they are copied without change and are therefore modifiable on the child object.

Summary of security sources

The following table summarizes how objects receive initial security. Security inheritance takes place only if the source class or object has inheritable permissions: