1 of 1 people found this helpful
Well, I guess it's an honor to stump others but it also shows how nefarious permissioning is
Given our observations it appears that, for #1, it's true that a Deny in the All Users Group will trump any Allow in subsequent Groups. I do not know if the same is true for individuals.
You may have seen this before...I always look for this diagram but can never find it, so here it is. I find it so helpful:
So in your case, the answers should be:
1. Yes, a Deny will always trump an Allow (if both are set at the group level).
2. They are Denied in that instance, because they are granted no access to the Project in question. The Default project really only exists to have a Project to put content in for a new Server install (when you haven't created any Projects yourself yet). It doesn't work as a permissions inheritance mechanism, it's just another separate and distinct bucket for content, like any other Project.
Thanks Matt. I think I over-think sometimes when I think. I think.