Some knowledge_admin users are able to see search results that they should not have access to based on the article role constraints - Support and Troubleshooting

Some knowledge_admin users are able to see search results that they should not have access to based on the article role constraints Description  Some knowledge users may be able to see search results that they should not, based on article role constraints.

Cause The behavior is by design in OOB Knowledge Management v2.

Resolution The customer updated regarding the implementation their team had in mind when the knowledge_admin role was given to roughly 900 users. The customer's use case was that they have 1600+ business applications, and each of them was to have 1-2 knowledge_admins to oversee articles in their respective business application.

Unfortunately, this has been causing some issues as the customer is using a knowledge V2/V3 "hybrid." The root cause is the knowledge_admin role: "The knowledge_admin role performs all the activities of the knowledge role; reviews and responds to ratings, flagged articles, and user search information; updates the knowledge portal with links to outside resources," etc. This high access role has been allowing users to see results they should otherwise be restricted from seeing.

Testing was done OOB (Out of Box) with a user who had the knowledge_admin role. A role restriction was set on an article, and then a search was done for the aforementioned article. The article was returned as a result from the search. Upon clicking on the article, the user was prohibited from viewing the article's contents. From the kb_knowledge table, however, we were able to see the article just fine in its entirety. The aforementioned behavior, then, is OOB and is expected.

To see if this behavior could be avoided (so that the search would only return results the user has the corresponding roles to view), further testing was done OOB with Knowledge V3.

In Knowledge V3, two Knowledge Bases were created: (1) Knowledge Base "Apple", and (2) Knowledge Base "Orange". User_A was set as the manager of Knowledge Base "Apple", and User_A alone was set inside of "Can Read" and "Can Contribute." The same thing was done for User_B with Knowledge Base "Orange," and only User_B was set inside of "Can Read" and "Can Contribute."

It was confirmed that neither manager could see the other manager's knowledge base at all - nor did any search return the opposite manager's articles (if User_A searched for articles in User_B's Knowledge Base, nothing came up - and vice versa).