3.2

Guidelines for User Management
143
Guidelines for User Management
This topic provides information and suggestions that can help you manage users and access. For
more information about managing user roles, with specific examples, see “Setting Up a Folder
Structure and a User Database” in Interplay Best Practices.
• The fundamental rule of user management is that explicit rights override inherited rights,
and database rights (set in the Database Management view) override CCS rights (set in the
User Management view and stored in the CCS). The exception to this rule is the user who is
a global Administrator set through the User Management view. This Administrator always
has Administrative rights on all folders, even if rights are set otherwise in the Manage
Database Roles view.
• By default, the root group Users is assigned the NoAccess role. That means that all user
subgroups (Everyone, Imported Users, Migrated Users and any other groups you add)
except for the Administrators and UNITY (under the Imported Users) have the role
NoAccess through inheritance. NoAccess means that a user cannot even log in to the server.
(The Administrators group is assigned the Administrator role and the UNITY group is
assigned the Read role.)
To override the NoAccess role, create another user group with a different role and copy the
user into that group.
c
Changing the role for the Users group or the Everyone group (from No Access to Read, for
example) makes it impossible to take away this role from individual users. Avid
recommends that you do not change the role of the Users group or the Everyone group.
• You can assign a user to more than one user group (see “Setting or Changing a General Role
Assignment” on page 137
) and each group can have a different role. As a result, the user
inherits different roles, which can be useful if a user contributes to different projects in
different ways.
• In the User Management view, you can set only group roles. You can set roles for individual
users in the Manage Database Roles view. See
“Managing Database Roles” on page 133.
How the Interplay Engine Determines Access
The following steps describe how the Interplay Engine server determines access to an object
(usually a folder). This process can help you understand how to assign roles and access:
1. The server checks on the object in question to see if explicit rights are set. If a user is
assigned a role on the object, the evaluation stops and the server grants the user only the role
allowed and the accompanying rights, if any.
2. If no explicit permissions were found on the object, the server checks the inherited rights on
the object in question.