Which is having higher precedence ACL or Closed Group.

[akshaybhujbale]

Lets say I have MyFolder in Assets.

I have set 10 users ACL as jcr:read.

out of 10 only for 4 users I have set as a closed users/group.

Then in effect how many users will able to access the Myfolder.

[Ravi_Pampana]

Hi,

I think all 10 users should have access to the folder as all of them are given read access. 

[ankushb]

Please check the ACL resolution for specific groups. That will give you an idea about the permission being set on on the specific resources.

Go to Tools -> Security->Permissions and select the user for which you want to check the permissions

[s1101v]

Hello - All 10 users should have read access to the "Assets" folder.

[akshaybhujbale]

Hi @s1101v 

If this is so then what is the usecase of CUG

[Sachin_Arora_]

Only 4 users should have access as CUG will allow jcr:read access to only those users/group which are added at folder level. For other 6 users, even if you give read access it will be non-effective and that folder wont be accessible to them.

Refer this screenshot from : 

https://experienceleague.adobe.com/docs/experience-manager-learn/assets/advanced/closed-user-groups....

I have validated similar use case using 2 groups(A and B) while only group A was added in CUG. Both groups had full access of content in terms of permission but for only group A folder is accessible. 

[akshaybhujbale]

hi @Sachin_Arora_  Thank you 

I have validated similar use case using 2 groups(A and B) while only group A was added in CUG. Both groups had full access of content in terms of permission but for only group A folder is accessible. 

How you check this 

using json responce?

[Sachin_Arora_ · Accepted solution]

I validated directly on publisher after login from 2 different users. User A from Group A and User B from Group B. I tested on we-retail assets folder and for only User A it was visible in CRXDE.

[akshaybhujbale]

@Sachin_Arora_  

Also let say if we have given 10 user jcr:read ACL of that folder.

and none of us is added in CUG then 

in effect will that 10 users able to read the folder?

[Sachin_Arora_]

If CUG is not having anything then yes 10 users will be able to see. If CUG has some group/user other that 10 users then No.

[akshaybhujbale]

ok

@Sachin_Arora_ Thank you 

It will help

[akshaybhujbale]

Sorry @Sachin_Arora_ 

but one last scinario.

I have gave MyFolder as deny jcr:read to user1.

and same user1 is present in CUG then will it able to get Myfolder?

[akshaybhujbale]

Hi @Sachin_Arora_ 

just last scenario please

I will help

[Sachin_Arora_]

I dont think user will be able to see folder in this case.I would suggest to setup your local instance and validate once.