Knowledge:Access manager

By default OpenKM 6 is configured this way:

 security.access.manager = simple
 security.search.evaluation = lucene

Which provides great performance by only evaluating a single node. But if you want to evaluate every parent you can change this behavior with these settings:

 security.access.manager = recursive
 security.search.evaluation = [ am_more | am_window | am_limited ]

This will reduce OpenKM performance (at least in search) but will match customer requirements.

Difference between "simple" and "recursive"

Give this repository structure:

• okm:root
  • level-1a
    • level-2a
      • level-3a
        • alpha.doc
        • beta.doc
        • gamma.doc
      • level-3b
  • level-1b
  • level-1c

When using simple if you revoke permission from level-2a folder and user is viewing level-3a folder, OpenKM still be showing the documents to this user. When user search, OpenKM will return these document as search results. User can't access the documents because when OpenKM try to access the document, it will open every path location and will fail to open level-2a because the user has no grants. You need to apply revoke recursively to prevent the user to access these document, so they won't be shown in the search results.

When using simple if you revoke permission from level-2a folder and user is viewing level-3a folder, OpenKM will five an error because Access Manager also evaluates the permission of the level-2a ancestor node. When user search, OpenKM won't show these documents in the search results.