Default Permissions
Definition
The portal comes with a minimal set of permissions assigned to its initial content. These default permissions are designed to provide maximum security for a freshly installed portal.
The default permissions settings are sufficient to enable users assigned to the super administrator role to work and gain access to all initial content. They also enable the remaining standard administration roles (content, system, and user) to access tools specific to these roles, but not to initial content objects. For example, a content administrator has access to the Portal Content Studio, but is not able to gain access to any content objects, such as iViews, pages, and roles-the Portal Catalog in the Portal Content Studio is empty.
This topic describes the default permissions assigned to the initial content of the portal.
1. Permissions for Super Administration Role
The standard super administer role (see Understanding Preconfigured Portal Roles ) is assigned maximum access to the entire set of portal initial content.
The user store and data source of the User Management Engine used in your organization determines which standard administrator users are members of the standard Administrators user group after the portal is installed. The Super Administrator role is assigned by default to the Administrators group. Therefore, initially all standard administrator users have super administrator permissions in the portal. For additional information, see Standard Users and Standard User Groups .
The following table specifies which default permissions settings of the super administrator role are assigned to the default root folders in the Portal Catalog:
|
Portal Catalog Folder (ID) |
Permission Setting |
|---|---|
|
Business Objects ( pcd:Business_Objects ) |
|
|
Portal Content ( pcd:portal_content ) |
|
|
Security Zones ( pcd:com.sap.portal.system/security ) |
|
|
Remote FPN Producers** ( pcd:fpn_information/connections ) |
|
|
WSRP Content** ( gwsrp: ) |
|
|
Portal Applications*** ( gpar: ) |
|
|
Web Dynpro Java Applications*** ( gwd: ) |
|
|
VC Generated Content Repository*** ( gvc: ) |
|
|
Portlet Applications*** ( portlet: ) |
|
* Role assigner and end user permission settings are only relevant to specific Portal Catalog folders and object types. For more information, see Permission Levels .
** Folders supporting a federated portal network. For more information, see Assigning Administrator Permissions to FPN Connections .
*** Read permission is necessary for the super administrator to view all portal components in the GPAL repositories. See Working with GPAL Repositories .
To prevent a complete lockout situation in the portal, the default permissions of the super administrator role cannot be deleted or modified. For information on assigning other super administrator-like roles with owner permissions to all portal objects, see UME Actions in the Portal .
2. Permissions in Security Zones
In addition to the super administrator permissions described above, the following permissions also exist for the standard safety levels in the Security Zone folder (for more information, see Security Zones ):
|
Safety Level |
Portal Catalog Folder |
Permission Setting |
|---|---|---|
|
No safety |
|
Everyone group:
For more information about this group, see Standard User Groups . |
|
Low safety |
|
Authenticated Users group:
For more information about this group, see Standard User Groups . |
|
Medium and high safety |
|
Content Admin and System Admin roles:
For more information about these roles, see Understanding Preconfigured Portal Roles . |
|
|
User Admin and Delegated User Admin roles:
For more information about these roles, see Understanding Preconfigured Portal Roles . |
3. Permissions in 'Portal Content' Subfolders
In addition to the super administrator permissions described above, the following permissions are also assigned to certain subfolders in the Portal Catalog:
|
Portal Catalog Folder (ID) |
Permission Setting |
|---|---|
|
(pcd:portal_content/com.sap.pct/ administrator/content_admin) |
Content Admin role:
|
|
(pcd:portal_content/com.sap.pct/ administrator/system_admin) |
System Admin role:
|
|
(pcd:portal_content/com.sap.pct/ admin.templates/iviews) |
Content Admin and System Admin roles:
|
|
(pcd:portal_content/every_user) |
Everyone group:
|