A structured allocation of permissions prevents that all users can access the entire existing data. It is possible to refuse certain users the access tocertain directories and files.

The allocation of permissions addressed here, refers particularly to the Tobit InfoCenter and the program sequences of the DvISE system. I.e., it is defined, which archives the respective users are able to see and work on in the Tobit InfoCenter and which actions they can execute in detail. For example if the users do not have access rights to certain directories, emails may not be received or sent, or some archives in the Tobit InfoCenter are not displayed to the users.

The general allocation of permissions for the DvISE system is done with the user »DVU-[server name]« and the group »DVG-[server name]«. The so-called DVU user (David Services User) starts the DvISE services and represents the permissions of the DvISE Service Layer. The user automatically becomes a member of the group »Administrators«so that the system works properly. This group acquires in the following »full access« to the entire directories of the DvISE system.

Whereas in the group »DVG-[server name]« (David Valid User Group) the DvISE users are summarised. All DvISE users need to be members of this group. This is usually done automatically, as soon as a user logs in at the system. It allows a comfortable allocation of permissions for all directories and for all users that belong to this group.

2. Basic Requirements

The hard disk partition where your DvISE system will be installed on, needs to be NTFS formatted. Only this format gives you the possibility of a user administration and its access rights in a way which will be needed for the operation of your DvISE system. If these requirements are not met you have to convert the partition to NTFS.

Notice, that the right assignment for the DvISE users is not made in the DvISE administrator, but that the right assignment for the DvISE users takes place on the operating system layer. Therefore you open the Windows Explorer and go to the »DAVID« directory, which can usually be found under »C:\DAVID«. The right assignment to the directory is done in the »Properties« of the directory. The tool DVPROP.EXE makes it much easier to access the corresponding directories on the file system layer. At the end of the text below "Tip" you will find detailed information about this tool.

3. General Right Assignment

In the following you will find an assembly of the minimum rights that must be given to the users to benefit effectively from the potentialities of the DvISE system.

• 3.1 Right Assignment under Windows NT 4

  Below »Properties -> Security -> Permissions« you can carry out the allocation of permissions.

  At first, you remove the user »Everyone« from the permission management of the »DAVID« folder. This user would cause that all users can access all the directories and its subdirectories. Every user could thus see e.g. inbox and outbox of the other users. Instead however, the group »Administrators« obtains full access to the directory »DAVID« and all subdirectories. Check whether the user "DVU-[server name]" belongs to the group "Administrators". That way, the permissions do not have to be assigned additionally for this user. He gains these permission automatically through the group membership. Furthermore, at this point the permission can be given to a group whose members are supposed to have full access to the »David« folder and its subdirectories as well.

  Additionally to the above mentioned full access for the group »Administrators« and the user »DVU-[server name]« you give the quoted permission to the following groups and users :

  directory »DAVID«: DVG-group gains the permission »read«

  directory »DAVID\APPS«: DVG-group gains the permission »read«

  directory »DAVID\APPS\FAXWARE«: DVG-group gains the permission »read«

  directory »DAVID\APPS\FAXWARE\OUT«: DVG-group gains the permission »read«

  directory »DAVID\APPS\FAXWARE\OUT\API«: DVG-group and Creator-Owner gain the permission »full access«

  directory »DAVID\CLIENTS« (incl. subdirectories): DVG-group gains the permission »read«

  directory »DAVID\ARCHIVE«: DVG-group gains the permission »limited directory access: execute«

  directory »DAVID\ARCHIVE\USER«: DVG-group gains the permission »limited directory access: execute«

  directory »DAVID\ARCHIVE\USER\[USER-ID]« (incl. subdirectories): instead of the group »DVG-[server name]« the according user receives »full access« on "his" Archive. You can find out the user-ID of the particular user in the DvISE Administrator underneath »Configuration -> User« .

  If the group »DVG-server name« would also have full access on the individual user archives, it would be possible for the users to access the personal archives of the other users.

  Furthermore you can assign the permissions freely to make a certain archive available to a user in the Tobit InfoCenter.

• 3.2 Allocation of Permissions under Windows 2000/2003 and Windows XP Professional

  Under »Features -> Security Adjustments« you can find the management of permissions for the directory concerned. Notice that you have to disable the "Simple File Sharing" when using Windows XP. The setting can be found below »Folder Options - View - Advanced Settings - Simple File Sharing (recommended)«. Remove the check to disable the option.

  Directory »DAVID«:
  a) index card "Share": here you indicate the person subgroup that is able to see the »DAVID«-directory in general. Default is »Everyone«. However you can also confine the person subgroup by indicating e.g. »Administrators« and »Domain user«.
  b) index card "Security Settings": remove the user »Everyone«. Deactivate the "Allow inheritable permissions from parent to propagate to this object" by removing the check mark in the corresponding casket. You confirm the following request with "Copy". Now you give full access to the group of »Administrators«. The group »DVG-[server name]« also needs to be added. Go to "Advanced..." and allow this group for "this folder, subfolder and files" the authorisations "list folders/read data" and "read attributes".

  Directory »DAVID\ARCHIVE«:
  The permission have automatically been assigned for the »DAVID« directory. But also deactivate "Allow inheritable permissions from parent to propagate to this object" by removing the check mark in the corresponding casket. The following request needs to be confirmed with "Copy". Below "Advanced..." you add the permission "read" for the group »DVG-[server name]« and remove the permission "list folders/read data" so that only those archives are indicated in the Tobit InfoCenter on which the particular user has permission. The permission for the subdirectories »ADDRESS«, »GROUP« and »RESOURCE« have to remain.

  Directory »DAVID\ARCHIVE\USER«:
  The assignments for this directory have also automatically been assumed and do not require any change. The personal directory of the user represents a special case (»DAVID\ARCHIVE\USER\[USER-ID]«). The group »DVG-[server name]« must not have access on this directory. Afterwards, deactivate "Allow inheritable permissions from parent to propagate to this object" again. Simply enter the particular user instead of the DVG-group. You can read out the user-ID of the corresponding user below »Configuration -> User« in the DvISE Administrator. The group »Administrators« keeps the access rights.

  Directory »DAVID\CLIENTS«:
  The group »Administrators« requires »full access« on this directory. The DVG-group and the user »Everyone« obtain the right "read/execute". There are no further adjustments necessary below "Advanced...".If you are working with a domain structure, it is advisable to enter the group »Domain User« instead of the user »Everyone« .If it should be possible for the particular user to install the Tobit InfoCenter on his own the user needs to be set up as a power user at his workstation.

  Directory »DAVID\APPS\FAXWARE\OUT\API«:
  The group of the »Administrators« keeps the right »full access« here as well. You grant all permissions except »full access« to the group »DVG-[server name]«. A fine adjustment underneath "Advanced..." is not necessary.

Advice:
A faulty allocation of permissions may result in system crashes!