[转]Groups, roles, client capability

Posted on September 7, 2007 by johnnygee

Although these concepts may seem similar, they are very different and can significantly impact an application functionality.  Lets first start with definitions (as defined by EMC Documentum):

Group   -  A group is a set of users, groups, or a mixture of both.  It is normally used to assign permissions on an object.

Role – A role is a special kind of group; it too can contain a set of users, other groups, or both.  The difference is that a role is used by a client application to filter out certain operations.  WDK framework supports scoping of WDK components by role.  For example, the Administration node in Webtop is only visible if the user is an administrator.  Roles are NOT used to assign permissions on an object.

So what is client capability?

Client capability – Legacy setting that is defined for each user object.  The four values for client_capability attribute are consumer, contributor, coordinator, and (system) administrator.  The client capability setting is used as a “default role” for a user.   This setting was created long before the concept of roles was created.  WDK/Webtop uses the client capability role if the user is not assigned to any custom roles.   Once you start creating custom roles, you need to configure/remap the client_capability role to your custom roles, if you still want to use client_capability setting.  FYI – The list of actions available to a specific client capability role is listed in the WDK Development Guide.

To summarize:

1. groups – permissions
2. roles – filtering actions
3. client capability – default roles

Feel free to post comments if you need further clarification.