Open topic with navigation

# Access Control Lists

An Access Control List (ACL) is a string of text that specifies who is allowed to view a document. Connectors can add an ACL to a document field, usually `AUTONOMYMETADATA`, for every document that is ingested.

NOTE:

This section describes an “NT Style” ACL, which is used in conjunction with the IDOL security type `AUTONOMY_SECURITY_V4_NT_MAPPED`. This type of ACL is appropriate much of the time. Different ACL formats are used with different IDOL security types.

A typical ACL might look like this:

The ACL begins with a 0 or a 1 (the Everyone flag) and is followed by four sections:

U | Allowed users
G | Allowed groups
NU | Disallowed users
NG | Disallowed groups

These sections each hold comma separated lists of encrypted strings. Each string holds a username or the name of a group.

When the ACL is interpreted by IDOL, the disallowed users and groups are always given priority. A user is not allowed to view a document if they are in the list of disallowed users (NU) or if they belong to a group in the list of disallowed groups (NG).

If the user has not been explicitly denied access, the rest of the ACL determines whether they are granted access to a document. If the Everyone flag is 0 they are granted access only if their user name appears in the list of allowed users (U), or if they are in a group that appears in the list of allowed groups (G). If the Everyone flag is 1 the user is granted access, regardless of whether they appear in those lists (U or G).

This process is summarized in the following diagram:

## Sample Code

To build an ACL you must extract from the repository the users and groups that are allowed, and are not allowed, to view the document. How you do this depends on the repository. After you have a collection of users and groups that are allowed access to a document (“users” and “groups”), and a collection of users and groups that are disallowed access (“negativeUsers” and “negativeGroups”) you can create an ACL and add it to a document (“docInfo”) as shown in the following example.

First, read the configuration parameter `EncryptAclEntries` to determine whether you need to encrypt the content of the ACL:

           bool encryptAclEntries = task.taskConfig().get("EncryptAclEntries", true);

If `EncryptAclEntries=true`, each user or group must be encrypted. Users of your connector can set this configuration parameter to `false` for debugging purposes. To encrypt an individual user or group name:

           std::string encryptedUser = task.encryptString(unencryptedUser);

Users and groups in a forward-iterable container can be encrypted to a comma-separated list like this:

           std::string encryptedCsv = task.encryptCsv(container.begin(), container.end());

Construct the ACL string by concatenating the separate parts of the ACL:

           std::stringstream ss;
           ss << "0:U:" << task.encryptCsv(users.begin(), users.end())
              << ":G:" << task.encryptCsv(groups.begin(), groups.end())
              << ":NU:" << task.encryptCsv(negativeUsers.begin(), negativeUsers.end())
              << ":NG:" << task.encryptCsv(negativeGroups.begin(), negativeGroups.end());
           std::string acl = ss.str();

Finally, add the ACL to the document field `AUTONOMYMETADATA`:

           docInfo.doc().metadata().addFieldValue("AUTONOMYMETADATA", acl);

## Custom ACL Formats

Access Control Lists are parsed by IDOL security libraries. If you use a custom ACL format, you can use the generic security library or write a custom security library. For more information about ACLs and mapped security, refer to the IDOL Document Security Administration Guide.

© 2018 Micro Focus or one of its affiliates | Send documentation feedback to Micro Focus Close Send documentation feedback To open the configured email client on this computer, open an email window. Otherwise, copy the information below to a web mail client, and send this email to swpdl.idoldocsfeedback@microfocus.com. We appreciate your feedback! Product: Topic Title: Help Topic: Feedback:

_FT_HTML5_bannerTitle.htm