In its latest release, TITUS Metadata Security for SharePoint Version
3.2 has greatly increased the support for SharePoint Managed Metadata.
In particular, TITUS Metadata Security can work with managed metadata
terms in a more meaningful way as part of the conditions that it
evaluates when determining if a specific policy needs to be enforced on a
document or item. These conditions which can be part of any policy are
referred to as “Conditional Expressions”.
For many versions, TITUS Metadata Security has been able to use any
metadata column and any metadata field type as part of its conditional
expressions. When authoring a policy and specifying a conditional
expression, an administrator could choose any column that was currently
configured for the list or library. For example, a conditional
expression of [Classification] = “Secret” meant that for a particular
item in the list or library if the Classification column was set to a
value of “Secret” then TITUS Metadata Security would enforce that policy
on that item. And in this case, the “Classification” column could be a
managed metadata column type. However, in previous versions, the
comparison between the value of this column and the conditional
expression in the policy was simply a text comparison.
In version 3.2, this comparison can still be a simple text comparison,
however TITUS Metadata Security has now provided the additional option
of performing this comparison between the actual managed metadata “term”
specified for an item and the “term” specified in the policy,
regardless of the text value specified for that term. This has several
advantages:
- If the text value of a managed metadata term changes, then TITUS
Policies do not need to be updated to take into account the new value
(for example, if the term “confidential” within a classification term
set is renamed to “classified”)
- If multiple language variants are specified for a particular term,
for example “confidential” for English and “vertraulich” for German,
then TITUS Policies will evaluate correctly regardless of which language
the end user has used to specify the metadata term for an item
- If managed metadata terms are reused within a complex metadata
hierarchy, TITUS Policies will evaluate correctly for a particular term
regardless of where in the metadata hierarchy the term is defined
So, let’s see how we configure this:
- In order to create policies, you must first navigate to the TITUS
Metadata Security Administration screen, which can be accessed from the
Site Settings page on a subsite or site collection, or from the
Library/List Settings page. This depends on the rights you have of
course. Click the “TITUS Metadata Security Administration” link on the page.
- The Administration page shows you 2 different tables: Permission Policies and Dynamic Policies
- In either case, this view displays the currently “Published”
policies. These are the policies that are currently being enforced.
You may not have any policies yet. Click the “Edit Rules” link under either table.
- Clicking Edit Rules takes you to a page where you can add, modify or
remove policies. These are the current “Draft” policies – those which
are being edited, have been saved, but are not yet published (so not yet
enforced). Click the “Add New Rule” link.
- Now to specify a new rule, you must first give the rule a name,
decide if it will be enabled or not, and then add a security action.
Depending on if you have selected Permission Policies or Dynamic
Policies different security actions will be available.
- When configuring TITUS Metadata Security Policies, you can select
for policies to always apply (this is the default) or to apply only
under certain conditions. These conditions are the conditional
expressions mentioned above. In order to specify a conditional
expression, you must click the “Only if the following conditional expression is true” radio button.
- Then a conditional expression is made up of a Resource, an Operator and a Value.
Conditional Expression in TITUS Metadata Security
- First you must select a Resource to evaluate in your expression.
The options available here are “Metadata” or “Claim”. The “Claim”
option only appears if you have configured your web application for
claims based authentication. Since we’re exploring how to use Managed
Metadata Terms, select the “Metadata” option in the Resource dropdown.
- The second dropdown in the Resource column will now populate with
the metadata fields that are currently available. If you are
administering from the list or library level, this will display the
metadata columns available on this list or library. If you are
administering from the site level, then a limited set of columns are
displayed out of the box. For policies at the site or site collection
level, a site collection administrator must first navigate to the
“Configure Metadata Columns” page that is available with TITUS Metadata
Security (available from the Site Settings page to site collection
administrators only) and select which metadata columns can be used as
part of TITUS Policies. To work with managed metadata terms, you must select a metadata column from this second dropdown which is a managed metadata column.
- Once selected, you may select any operator available from the Operator dropdown. The default is equals.
- Once a managed metadata column is selected for the Resource, the
Value dropdown provides a number of options, including “Type in Value”,
“Claim” and “Managed Metadata”. The administrator can select “Type in
Value” if they wish a simple text comparison to occur when evaluating
the condition, or they can select “Managed Metadata” if they want the
actual term selected for the policy to be compared to the term selected
as part of an item’s metadata. Select Managed Metadata from the Value dropdown.
- The user interface for specifying a value now changes to allow the administrator to click a Get Term
button to select a term from the metadata column’s predefined term set
using the SharePoint’s common Managed Metadata Term selection window.
You would have specified the term set for a managed metadata column when
the column was defined.
Conditional Expression with Managed Metadata in TITUS Metadata Security
- Click the Get Term button and the following windows will appear allowing the administrator to select the appropriate term to compare within the policy.
SharePoint Managed Metadata Selection
SharePoint Managed Metadata Selection
- Once the managed metadata term is selected, click the Add Condition button,
and the conditional expression will be updated with this condition.
You’ll notice that the ID of the term is saved within the policy, so
that comparisons between the metadata term on an item or document
against the term specified in a policy can be much more meaningful than a
simple text comparison.
- You may then add additional conditions to the policy’s conditional expression, and when done you can click the Update Rule button to add the policy to the current set of saved (Draft) policies.
This enhanced support for managed metadata terms allows TITUS
Metadata Security to be used very effectively in environments where
managed metadata plays a critical role in organizing and protecting an
organization’s sensitive information.
-Antonio
