IBM WCM 6 Security Model

Well, I’ve been working with IBM’s content management product for a while now and I figured it was time to write up something useful for others. IBM Workplace Web Content Management (IBM WCM) comes bundled with IBM WebSphere Portal V6 and can be used to manage web content in and out of a Portal. One of the primary features that persuade organizations to use IBM WCM is its security model, so I decided to write up a quick, high-level explanation of how the security model works.

WCM security is controlled at the following levels, from the least to most granular:

Library
Library Item Type
Item-level
1. workflow or user (depending on whether workflow is enabled for content items)
2. system
3. effective (combined view of a-c)

Library Security

The Library-level security controls user access to all items within a Web Content Library. A Portal Administrator changes this security by going to: (Portal Administration > Portal Content > Web Content Libraries > Set Permissions).

IBM recommends an additive security method (see reference 1), where the Library-level security settings are used to grant only read access to the library (with the exception of Administrative acces). So, this basically means that the ‘All Authenticated Portal Users’ group is added to the ‘Users’ role for the library, and then more granular security settings are set per item type in the Library Item Type security settings.

Library Item Type Security

The Library Item Type-level security controls access to individual item types within a Web Content Library; this includes content, templates, components, etc. These settings are also changed by a Portal Administrator by going to: (Portal Administration > Portal Content > Web Content Libraries > Library Resources).

Following the additive security model recommended by IBM, an Administrator grants specific user groups access to specific item types in the Library Resources view. For example, an Administrator could add an ‘authors’ group to the ‘Editor’ role for content in a given library, but not grant them any additional permissions. So, in this case, ‘authors’ can add and edit content, but only Administrators could add additional sites, site areas, or components.

Item Level Security

Item Level security controls access to individual WCM objects, like pieces of content or sites and site areas. In most cases, workflow security should be used to control access to individual items. There are four types of Item Level Security: Workflow Security, User Security, System Security and Effective Security.

Using Workflow Security is the recommended approach to securing individual items. Workflow is enabled out-of-the-box, only for content items, so using Workflow Security for other item types requires enabling it for that type (see Infocenter - Web content authoring options for steps to enable workflow). IBM recommends that you enable workflow for all items (except workflow-related objects themselves). When workflow is enabled for a given item, the security settings set on the workflow stages control the access to a given item – this is called workflow item-level security.

So, for example, imagine that a News entry is in a ‘Review’ workflow stage. The ‘Review’ workflow stage has a set of ‘Workflow Security’ options that allow an Administrator to determine which users/groups have access (read, edit, delete, or approve) to content items in that workflow stage. The Administrator may add the ‘news-approvers’ group to the Approve role in the ‘Workflow Security’ settings for the ‘Review’ workflow stage. Thus, the original author of the article can’t delete or edit the document while it’s in the ‘Review’ stage.

WCM also has a User Security feature that is used only when workflow is not enabled for the given item type. This function allows authors to selectively modify access to a given item when creating it. So, for example, if workflow were not enabled for content items, an author could create a News entry and grant read access only to the ‘managers’ group.

System security can be considered an Administrator override function. This option is always available to Administrators (whether workflow or user security is being used) and can be used to add additional security to a given WCM object.

Effective security is simply a view of the combined security of the workflow OR user security settings, in combination with the system security settings. The effective security view cannot be modified directly; it changes when the workflow, user, or system settings change.