RecordPoint: Security Settings

Transcription

1 RecordPoint: Security Settings

2 1 Overview The purpose of this guide is to provide information on the Security Settings for RecordPoint. 2 RecordPoint User Personas 2.1 Record Administrator Access to all functions in RecordPoint and full control of stored record data, via Full Record Access. 2.2 Record Coordinator Limited access to functions in RecordPoint relating to the updating of non-electronic records to the system, preparation of records for retention purposes and general viewing. 2.3 Record Manager Access to all functions in RecordPoint relating to the management of record keeping processes excluding permissions to a modify Classifications or apply Disposal Actions to records 2.4 Record Visitor Limited access to view record metadata, audit data, record binary, version history and contents of a record aggregation. 3 RecordPoint Permissions All Users in those groups will be synched down to the Storage Site. Depending on the Full Record Access setting chosen they will be added to either View Only rights (False) or Full Record Access when the setting is (True). Example: Record Administrator Group has the following users: Record Admin and Active Site Administrator

3 Now we have a separate Role for each of the Other Groups: Clicking the Update Permissions button, adds the Users or AD Groups added to the RecordPoint groups to the corresponding storage layer SPGroups Record Administrator for Groups which are flagged with Full Record Access and Record Visitor for all other RecordPoint Groups

4 4 Permissions derived Record Access from Active Site Permissions from the Active Site will flow through the item in the Storage Layer in on-prem

5 5 Custom Physical To create new Non Electronic Records/Files/Boxes, please review the corresponding articles: Non-electronic content types can be locked down to certain users/ad groups/or SharePoint groups, the permissions for the item in the Physical Type lists will flow through to the Storage Layer item. 5.1 Physical Records Security Management When breaking the inheritance of the Physical Type it is recommended to include a corresponding SharePoint group for the created Custom Content Type. This is so that future changes to the permissions of the Custom Content Type will flow through for new and existing Physical items. Consider this: 2 Custom Record Content Types: Generic Record item is locked down to a SPGroup: Legacy Generic Record is locked down to:

6 When items are created the following permissions will be pushed down to the items in the Storage layer similarly to what would happen on an Active Site submission If we navigate to the corresponding item in the Storage layer: For Generic Records: For Legacy Generic Records:

7 Record Administrator Groups are added to the items by default (the users in this group are controlled by the Full Record Access setting). Note for Legacy Generic Records User and Domain Group has been added whereas for Generic Records a corresponding SharePoint Group has been added to the item. When we update the permissions to add another user say ABC Generic Records AD Group to the items let s see what happens: New permissions for Legacy Generic Records: And we add the newly created Legacy Generic Records AD Group simply to the SharePoint group ABC Generic Record SPGroup and this will flow through for new and existing records versus the Legacy Generic Records which will only update the permissions for newly created or updated items: SPGroup updated once new item created:

8 ABC Generic Records AD group will now have access to new and existing Generic Records. However, ABC Generic Records AD Group will only have access to newly created items for Legacy Generic Records: Legacy Generic Record 1 permission: Legacy Generic Record 3 permission: Only once you ve made an update to the existing Legacy Generic Records will they have the new permissions. Legacy Generic Record 1 permission, after update: As such it is recommended to use SharePoint groups if you want to retrospectively add users to existing content types to your PhysicalFileTypes. It is also recommended to use an AD Group within the SPGroup to minimize the number of security updates when the incremental crawl is running as an update to the Generic Record Group will cause a security update for all Generic Record content, whereas all the users will just be managed within the AD groups and no security updates are required. NOTE: The above considerations can be applied to your Active Site permissions for Active Site Members Active Site Visitors and Active Site Owners groups.

9 SharePoint groups the updates will move upward i.e. security for that content type will retrospectively update for existing items with that content type. This means that if the security changes for that SharePoint group this will be updated for all records for that content type. Active Directory groups the updates will only be applied to the new items created after any change, so the security will not update to the older items part of this content type. There is no delay in sync since the Active Directory group updates will be on the server itself. The recommended setup for Security Management 1. Create an AD group within SharePoint group SharePoint group AD group 2. Assign a separate SharePoint group to each of the content types Steps 1. Create a custom content type. Eg, created Record with SPGroup site content type. 2. Management -> Settings -> Non Electronic Content types 3. Click on the PhysicalRecordTypes/ PhysicalFileTypes/ PhysicalBoxTypes based on the custom content type created. 4. On the top, click on List -> List settings -> Add from existing site content types -> Select the custom content type. In the eg, added Custom Record with SPGroup into the Physical Record Types list.

10 5. Go back, on the top select Items -> Create new item -> Select the newly created content type and create a new item for it. 6. Now click on the newly created item (Custom Record with SPGroup in the example). Click on Shared With -> Advanced -> Stop Inheriting permissions. 7. Grant permissions and select the SharePoint group created for this content type. Click on Share. NOTE The new group created has to be out of the box and not in-built RecordPoint groups like Record Coordinator, Records Manager. This is because the in-built group permissions do not flow down to the item in the Storage Layer. This is no longer the case in RecordPoint 4.04 or later.