Configuring Folder Types
Overview
The FolderTemplate parameter in Activate stores templates for the various folder types that users can create via Activate. It comes with 5 default types detailed below and can be extended or modified to suit customer requirements. This parameter can be found at //Resources/Folders in Activate Studio.
Configuring Folder Access Rights in Templates
The <rights> element in the folder configuration XML defines how permissions are applied to folders and which groups receive them. This section explains the syntax used in the rights string and how it is interpreted by the system.
Rights String Syntax
The rights string is a compact format that encodes:
- Access type (list, read, write, full, etc.)
- Inheritance behavior
- Allow or deny
- Target group SID
Each entry in the <rights> string is separated by a semicolon (;) and follows this pattern:
Modifiers and Their Effects
Modifier | Description |
|---|---|
- (prefix) | Sets AceFlags = NONE — disables inheritance entirely. |
-folders | Sets AceFlags = CONTAINER_INHERIT_ACE — applies to folders only. |
-files | Sets AceFlags = CONTAINER_INHERIT_ACE (same as -folders). |
-deny | Sets bAllow = false — creates a deny ACE instead of allow. |
Access Characters
Character | Grants Access To… |
|---|---|
l | List access (FILE_LIST_DIRECTORY or similar) |
r | Read (FILE_GENERIC_READ + FILE_EXECUTE) |
w | Write (FILE_GENERIC_WRITE + FILE_EXECUTE) |
c | Change (read + write + execute + delete) |
f | Full control (FILE_ALL_ACCESS) |
d | Delete only (DELETE) |
0x... | Hexadecimal access mask (overrides character-based access). This is an advanced method for more complex permissions. |
Special Case: Disabling Inheritance with -
If the rights string starts with a hyphen (-), it explicitly disables all inheritance by setting AceFlags = NONE. This is useful when you want the ACE to apply only to the current folder, not to any subfolders or files.
Example
This means:
- No inheritance: The ACE applies only to the current folder.
- Read access: Granted to the group identified by the SID.
- Allow ACE: Because -deny is not present.
Example Breakdown
- -folders → Apply to folders only
- r → Read access
- SID → Target group
Result: Read-only access to folders (not files)
Folder Types Explained
Each <folder> element defines a template for creating a folder with specific access control settings. These templates include:
- Display Info: Title, description, and icon for UI representation.
- Template Logic:
- <rights>: Defines access control entries (ACEs) using SIDs (Security Identifiers).
- <listAccess>: Controls visibility of the folder in listings.
- <groups>: Specifies AD groups to be created and linked to the folder.
Folder Types
Folder Name | Description | Groups Created | Rights Summary |
|---|---|---|---|
NoSecurity | Inherits access from parent folder. | None | Inherit only |
PrivateAndPublished | Creates read and write groups. Read-only and full control access split. | 2 (read, write) | Read + Change |
Private | Only users in the new group have access. Others are denied. | 1 (write) | Change only |
Published | Users in the group get read-only access. Inherits parent access. | 1 (read) | Read only |
Common | Users in the group get full access. Inherits parent access. | 1 (write) | Change |