Migration and Security

Note: ATG requires that certain roles be assigned to users in order to perform work on solutions. The eServer migration process does not assign these roles by default, because ATG cannot determine the mapping between Named ACLs and ATG roles. After migration is complete, you must explicitly add roles to your migrated users before they will be able to work with solutions and workflows.

The migration process converts the eServer Named ACLs into The ATG model for solution property, and statement security. User segments are created for each Named ACL and associated with the relevant solution attribute.

Migration looks at the Named ACLs, matches their references with ATG users/organizations, and creates user segments according to the following rule:

Include users whose login is one of <comma separated login names>
OR whose parentOrganization.id is one of <comma separated organization ids>
OR whose secondaryOrganization.id is one of <comma separated organization ids>.

Security on Solutions

ATG solutions have three attributes that determine view access: owningGroup, internalAudience and externalAudience.

Note: In Knowledge Manager, rights for solution authoring are based on the solution’s owning group. See Migrating Solution Owning Groups for information on specifying owning groups for solution classes.

This eServer setting…

…becomes this ATG entity…

…stored in this solution attribute

owningGroup attribute specified in eserver_migration_config.xml

matching organization

owningGroup

n/a

Everyone-Internal user segment

internalAudience

n/a

Everyone-External user segment

externalAudience

Security on Solution Statements

ATG solution statements have three attributes that determine view and modify access: internalAudience, internalModify, and externalAudience.

If a solution statement has security set on it, its Named ACLs are migrated according to the following table:

This Named ACL for a secured statement…

…becomes this ATG User Segment…

…stored in this solution statement attribute

VIEW and MODIFY ACE combined

“ACL name Viewers”

internalAudience

n/a

Everyone-Internal

internalModify

n/a

empty

externalAudience

If a solution statement has no security, it is migrated according to the following table:

This ATG User Segment…

…is stored in this solution statement attribute

Everyone-Internal

internalAudience

Everyone-External

externalAudience

Security on Solution Properties and Lists, including Intrinsic Fields

ATG solution properties and lists have three attributes that determine view and modify access: internalAudience, internalModify, and externalAudience. See Mapping ATG Intrinsic Fields to eServer Properties for information on specifying properties that should be used as ATG intrinsic fields.

If a solution property or list has security set on it, its Named ACLs are migrated according to the following table:

This Named ACL for a secured property or list…

…becomes this ATG User Segment…

…stored in this solution property attribute

VIEW ACE

“ACL name Viewers”

internalAudience

MODIFY ACE

“ACL name Modifiers”

internalModify

n/a

Everyone-External

externalAudience

If a solution property or list has no security, it is migrated according to the following table:

This ATG User Segment…

…is stored in this solution property attribute

Everyone-Internal

internalAudience

Everyone-External

externalAudience

Specifying a Default Internal Audience for a migrated solution

You can specify two different types of defaults:

To set the global default:

  1. Set the property defaultSolutionInternalAudienceOrganizationIds in the nucleus component /atg/svc/migration/EserverMigrationService. This is an array of strings. (String[])

  2. Enter the organizational IDs, separated by a comma. The default value for this property is NULL, which indicates that there is no global default.

    For example, defaultSolutionInternalAudienceOrganizationIds=org1_id,org2_id

To set the default per solution class:

If this attribute is: