Skip to content

Library Managers

A library manager is not a role group: there is no group id and no enum_IR.AdmistrativeRoles value. A user is a manager of one particular library, recorded as a row in DOMAINMANAGERS, and may manage several. A manager is appointed with AddManagerToDomain and removed with RemoveManagerFromDomain; both need IrAdminAction.AddRemoveLibraryManagers, which administrators and User Managers hold and library managers do not (IRSecurity.cs, IsAllowed). The user appointed must already be a member of the library (DomainExtensions.cs, SetDomainManagerAsync), and a non-administrator cannot appoint themselves (4030, "Access denied. Only administrators can make themselves a library manager."). The user who creates a library becomes its member and its first manager (DomainOperations.cs, CreateAsync). Losing the membership loses the role: removing a user or a group from the library's members, or removing a user from a member group, deletes the manager rows of whoever is no longer a member (DomainsStore.DeleteLibraryManagersWhoAreNotLibraryMemberAsync).

How the role is checked

Three different checks decide, and they do not agree with each other on what else counts.

  1. The administrative matrix (IRSecurity.cs, IsAllowed). Each IrAdminAction sets allowLibManagers, and the call site passes a localDomainId. Order: administrators pass first; then the "an administrator's account is changed by administrators only" guard; then self-service (USER object and objectId is the caller); then membership of a required role group; then, only when allowLibManagers is true and localDomainId > 0, SecurityFunctions.CheckDomainManagementAsync, which is a lookup of the (library, caller) row in DOMAINMANAGERS (UserOperations.IsDomainManagerAsync). A global user or group has DomainId 0 and every application-wide action passes 0, so this step passes only for users and groups local to a managed library and for actions on the library itself. Refusal: errorCode="4030", message "Access denied. This action is restricted to the following roles: The system administrator, Library manager(s), User managers" (the "Library manager(s)" part appears only when the step was reachable, so a refusal on a global user does not name library managers at all).
  2. SecurityFunctions.CheckDomainManagementAsync (ModuleSecurityFunctions.cs) called on its own, for the library operations outside the matrix: administrators pass, then the manager row of the library. Refusal 4030 "Access denied. Only library managers can perform this operation." (or "Only the system administrator can perform this operation" when no library is involved).
  3. The library's policies (IRSecurity.cs, AccessAllowedAsync, and DomainPolicies). Each of the 46 library policies has a "library manager" flag (RightDomainManager); 45 default to true, DocumentCheckIn has no such flag. For a document or folder action with the flag on, a manager of the item's library gets the action without any access-list right. This applies only when the manager is a member of the library (a non-member gets 4030 "Insufficient rights. This action can only be performed by library members with appropriate rights.") and is an Author-type user; a Reader-type manager gets it only for actions whose required right is List or Read.

Administrators pass all three. Note that ThreadVariables.IsAdministrator() is the sysadmin account (id 4) or membership of [Administrators] (104).

What the role can do

Administrators may do everything below; the tables name who else may.

Users and groups local to the managed library

Each row is a matrix action with allowLibManagers; localDomainId is the DomainId of the user or group acted on, so the row holds only for users and groups whose home library the caller manages. User Managers hold every row for every user and group. An administrator's account (sysadmin or any member of [Administrators]) cannot be changed by a library manager even when local (4030, "Access denied. Only administrators can change an administrator's account."); local users cannot join global groups, so this case does not arise in practice.

Action Web service calls Who else may do it Conditions
Create a local user in the library, send the welcome mail CreateUser with DomainName = the managed library, SendWelcomeEmailForUser User Managers CreateUser; CreateUser passes the new user's library (InfoRouter.cs, CreateUser), SendWelcomeEmailForUser the user's DomainId
List the users of the library GetAllUsers1, GetAllUsers2, GetAllUsers3, GetAllUsersWithoutDetails with a library filter naming the managed library (~L<id> works too) User Managers ListUsers; with no library filter localDomainId is 0 and the manager is refused (InfoRouter.cs, GetAllUsers)
Look up a local user GetUser, GetUserStatistics, GetDomainMembershipsOfUser, GetManagedDomainsByUser, GetUserTaskRedirectionTo, and every call that names a user self, User Managers, co-workers (members of a library the caller is also a member of) ListUsers with the user's DomainId (UserOperations.cs, GetUserObjectAsync); these five make no further check
Change a local user's profile, status, type UpdateUserProfile, ChangeUserStatus, ChangeUserType User Managers; not self UpdateUserProfile
Change a local user's preferences, contact details, e-mail UpdateUserPreferences, UpdateUserContactInfo, UpdateUserEmail self, User Managers UpdateUserPreferences
Set a local user's password ChangeUserPassword User Managers; self only through ChangeUserPassword1 with the current password SetUserPassword
Delete a local user DeleteUser, DeleteUser1 User Managers DeleteUser (UserOperations.cs, DeleteUserAsync)
Read a local user's activity lists GetUserViewLog, GetUserViewLog1, GetUserViewLogLite, GetAuthoredDocuments, GetCheckedoutDocumentsByUser, GetDocumentsOwnedByUser, GetFavoriteDocumentsOfUser, GetISOReviewAssignmentsOfUser, GetSubscribedDocumentsByUser, GetFavoriteFoldersOfUser, GetFoldersOwnedByUser, GetSubscribedFoldersByUser, Search with SUBSCRIPTIONSOF, FAVORITESOF, DOWNLOADQUEOF or VIEWCRITERIA + USERNAME self, User Managers ListingAuditLogOfUser (UserExtensions.cs; SearchServices.cs)
Read a local user's group memberships GetGroupMembershipsOfUser self, User Managers ListingGroupMembershipOfUser
Read a local user's workflow roles GetUsersWorkflowRoles self, User Managers ListingUserOwnerships
Manage a local user's task redirections SetUserTaskRedirection, RemoveUserTaskRedirection, RerouteUserTaskRedirection, GetUserTaskRedirectionsFrom self, User Managers; for rerouting also the user the redirection points to SetUserTaskRedirections / RerouteUserTaskRedirection (UserExtensions.cs)
Property set rows on a local user AddPropertySetRowForUser, UpdatePropertySetRowForUser, DeletePropertySetRowForUser User Managers; not self ApplyRemoveCustomMetaData (PropertySetOperations.cs)
Transfer one local user's work to another local user all Transfer calls: TransferUserTasks, TransferUserDocumentOwnerships, TransferUserFolderOwnerships, TransferUserGroupMemberships, TransferUserDomainMemberships, TransferUserDomainManagerRoles, TransferUserSecurityPermissions, TransferUserCheckedOutDocuments, TransferUserDocumentSubscriptions, TransferUserFolderSubscriptions, TransferUserWorkflowDefinitions, TransferUserExpirationNotices, TransferUserISOTasks User Managers TransferUserOwnershipsAndTasks is checked on both users with each one's DomainId (UserTakeOverOperations.cs, RunAsync); the from-user must not be an administrator; role groups never move for a non-administrator
Remove every subscription of a local user RemoveAllSubscriptions self; not User Managers CheckDomainManagementAsync on the user's DomainId, outside the matrix (UserExtensions.cs, UnSubscribeAllAsync)
Create a group in the library CreateUserGroup, CreateUserGroup1 with DomainName = the managed library User Managers CreateUserGroup with the library (IRGeneral.cs)
Rename or delete a local group UpdateUserGroupName, UpdateUserGroupName1, DeleteUsergroup User Managers UpdateUserGroupProperties / DeleteUserGroup with the group's DomainId (UsergroupOperations.cs)
Add or remove members of a local group AddUsergroupMember, RemoveUsergroupMember User Managers UpdateGroupMembers with the group's DomainId; the member must be a member of the library
See the members of a local group that hides them GetUserGroupMembers, GetUserGroupMembers1 User Managers; anyone for a group that shows its members ListGroups with the group's DomainId (UsergroupExtensions.cs, GetMembersForPublic)

The library itself

Action Web service calls Who else may do it Conditions
Add or remove library members AddUserAsDomainMember, RemoveUserFromDomainMembership, AddUserGroupAsDomainMember, RemoveUserGroupFromDomainMembership User Managers AddRemoveLibraryMembers with the library's id (DomainExtensions.cs, DomainOperations.cs); only global users and global groups can be added; the last member cannot be removed
Reach the library by name every call with a DomainName, e.g. GetDomain, GetManagers, GetDomainMembers, GetDomainMembers1, GetDomainUsers, GetDomainUsers1, GetDomainGroups, GetLocalUsers, GetDomainStatistics members of the library, anyone where it allows anonymous access, User Managers and Policy Managers for every library DomainOperations.GetLibraryByNameAsync and GetLibraryByIdAsync share MayReachAsync: membership, or ListLibrariesForAdministration with the library's id, which a manager passes. An unreachable library is 4041 "Library not found". These listing calls make no further check: any signed-in user who reaches the library gets them
List the libraries to administer GetLibrariesForAdministration User Managers and Policy Managers, who get every library A manager gets the libraries they manage (UserOperations.cs, GetLibraryListForAdministrationAsync, localDomainId 0 so the role step fails and the managed list is read instead); anyone else gets an empty list
See which members cannot open the library GetMembersWithoutAccess nobody else: User and Policy Managers are refused With no domainName, every managed library; with one, it must be managed (4030 "Access denied. Only library managers can perform this operation.") (LibraryServices.cs, GetMembersWithoutAccessAsync)
Read the library's policies GetDomainPolicies Policy Managers Domain.AccessAllowedToReadPoliciesAsync: UpdateLibraryPolices, or CheckDomainManagementAsync
Change the library's policies SetDomainPolicies Policy Managers UpdateLibraryPolices; allowLibManagers is set only when the system behaviour setting AllowLibraryManagersToEditPolicy is on (IRSecurity.cs, IsAllowed; stored as LIBMANAGERS_EDITPOLICY)

Audit logs of the library

ViewAuditLogs has allowLibManagers; what is passed as localDomainId is the library the log is read for.

Action Web service calls Who else may do it Conditions
Read the library's operation logs GetCheckoutLog, GetCheckInLog, GetVersionCreateLog, GetVersionDeleteLog, GetNewDocumentsAndFoldersLog, GetDeleteLog, GetDispositionLog, GetOwnershipChangeLog Audit Managers The path filter's first part is the library (LogOperations.cs, IsLogAccessAllowed); with no path filter the library is 0 and only Audit Managers pass
Read the security change log GetSecurityChangeLog Audit Managers; anyone with ReadSecurityAccessList on the document or folder The right on the item first (FolderServices.cs, GetSecurityChangeLogAsync); otherwise ViewAuditLogs with the item's library, the library root included (LogOperations.cs, GetAccessListHistoryAsync)
Read SOX, ISO and classification logs GetSoxLogs, GetISOLogs, GetClassificationLogs Audit Managers; anyone the library policy gives the read right The policy on the item first (DocumentReadSoxLog, DocumentReadIsoLog, DocumentReadClassificationLog; all three default the library-manager flag to true, so a member manager passes there already); otherwise ViewAuditLogs with the item's library
Read an item's access list history GetAccessListHistory Audit Managers; anyone with ReadSecurityAccessList on the item The right first, otherwise ViewAuditLogs with the item's library; the current list is read with the same fallback (DocumentExtensions.cs, FolderExtensions.cs)

Workflow in the library

These are outside the matrix.

Action Web service calls Who else may do it Conditions
Create a workflow definition CreateFlowDef, CreateFlowDef1, CreateFlowDef2, CreateFlowDef3 nobody else CheckDomainManagementAsync on the library (WorkflowOperations.cs, CreateWorkflowAsync); the licence must allow workflows; the active folder must be in the library
Delete a workflow definition DeleteWorkflow nobody else CheckDomainManagementAsync (DomainExtensions.cs, DeleteWorkflowAsync); the definition must be inactive
Change a definition: activate, deactivate, update, steps, task definitions ActivateFlowDef, DeactivateFlowDef, UpdateWorkflowDefinition, AddFlowStepDef, AddFlowStepDef1, DeleteFlowStepDef, UpdateWorkflowStepDef, AddFlowTaskDef, DeleteFlowTaskDef, UpdateWorkflowTaskDef members of the definition's supervisor list SecurityFunctions.CheckWorkflowManagementAsync: administrator, manager of the definition's library, or supervisor; refusal 4030 "Access denied. Only administrators, library managers, or workflow supervisors can perform this operation."
See every task in the library getTasks, GetTasks1 nobody else: User and Policy Managers see only their own With no document or workflow filter and no own-user filter, the caller's own tasks plus every task of the managed libraries (WorkflowOperations.cs, GetTasksAsync)
Supervise a running task in the library ReassignTask, ChangeTaskDueDate, UpdateTaskFinishDate, SetTaskPriority, CreateRelatedTask the task's supervisor, the user who assigned it; the assignee for some of them WorkflowExecutingTaskExtensions.CheckAllowSupervisionAsync: a DOMAINMANAGERS row for the task's library, read directly, membership not asked; refusal 4030 "Access denied."
Edit a later step of a running workflow UpdateRunningWorkflowTaskDef the step's supervisor; an assignee of an earlier step with the edit-next-step or edit-all-steps permission WorkflowExecutingTaskDefExtensions.CheckAllowEditStepAsync: a DOMAINMANAGERS row for the document's library

Documents and folders in the library

Action Web service calls Who else may do it Conditions
Any document or folder action whose library policy has the library-manager flag on every document and folder call whoever the access list or the other policy flags admit Default on for 45 of 46 policies (delete, check out, move, security change, ownership change, read logs, read unpublished versions, and the rest; not DocumentCheckIn). Needs library membership and an Author-type account; a Reader-type manager only for List/Read-level actions (IRSecurity.cs, AccessAllowedAsync). Changed per library with SetDomainPolicies
Read an unpublished document, or a version other than the published one document reads the owner, an author of any version, an assignee with an active task A manager is in the exception list (ModuleSecurityFunctions.cs, IsUserInExceptionListForReadAsync); otherwise the AccessToDocumentVersions policy decides
Publish, unpublish, set the publishing rule without having authored a version PublishDocument, UnpublishDocument, SetDocumentPublishingRule the owner The SetPublishingRules policy first; then the "author of at least one version" requirement is waived for the owner and the library's managers (SetPublishingRulesOperation.cs)

What the role cannot do

Action Web service calls Who can Error returned
Appoint or remove a library manager, even for their own library AddManagerToDomain, RemoveManagerFromDomain Administrators, User Managers (not on themselves) 4030 "Access denied. This action is restricted to the following roles: The system administrator, User managers"
Create or change a global user; change a local user of another library CreateUser with an empty DomainName, and every user call above on such a user Administrators, User Managers 4030, the same message without "Library manager(s)" (the step is unreachable at localDomainId 0)
List all users GetAllUsers, the other overloads without a library filter Administrators, User Managers 4030 as above
Create a global group, change its name or members CreateUserGroup with an empty DomainName, UpdateUserGroupName, DeleteUsergroup, AddUsergroupMember, RemoveUsergroupMember on a global group Administrators, User Managers 4030 as above
Change the members of a role group (ids up to 1000) AddUsergroupMember, RemoveUsergroupMember on [Administrators], [User Managers] and the rest Administrators only 4030 "... restricted to the following roles: The system administrator"
Transfer work from or to a user outside their libraries, or from an administrator the Transfer calls Administrators; User Managers for any two non-administrator users 4030 (both users are checked); "Access denied. Only administrators can change an administrator's account."
Create, rename, delete, archive the library CreateDomain, UpdateDomain, DeleteDomain, ArchiveDomain, UnarchiveDomain Administrators only (IsAdministrator()) 4030 "Only the system administrator can perform this operation"
Change the library's policies while the setting is off SetDomainPolicies Administrators, Policy Managers 4030 "... restricted to the following roles: The system administrator, Policy managers"
Read or change application settings, the setting that would let them edit policies included GetSystemBehaviorSettings, SetSystemBehaviorSettings and the other settings calls Administrators, Policy Managers (UpdateApplicationSettingsAndPolicies, localDomainId 0) 4030 "... The system administrator, Policy managers"
Read audit logs across all libraries the log calls above with no path filter Administrators, Audit Managers 4030 "... The system administrator, Audit managers"
See the licence, server, warehouse and server logs GetLicenseInfo, GetSystemStatistics, GetWarehouseStatus, GetLogs Administrators, Audit Managers 4030
Define retention schedules, dispose of documents CreateRandDSchedule, DisposeItem and the other R&D calls Administrators, R&D Managers 4030
Flush the cache FlushApplicationCache Administrators only 4030
See a library they do not manage and do not belong to any call with that DomainName members, Administrators, User Managers, Policy Managers 4041 "Library not found"
See the members without access of a library they do not manage GetMembersWithoutAccess Administrators 4030 "Access denied. Only library managers can perform this operation."

Finding out whether the signed-in user has this role

  • GetManagedDomainsByUser with the caller's own name, or an empty name: the libraries the caller manages (UserServices.cs, GetManagedDomainsByUserAsync; the list is DOMAINMANAGERS rows). An empty list means the caller manages nothing.
  • GetLibrariesForAdministration: for a pure library manager, the managed libraries; but a User Manager or Policy Manager gets every library from the same call, so use GetManagedDomainsByUser to tell the two apart, or GetGroupMembershipsOfUser with the caller's own name for the role groups (GroupID 100 to 105).
  • GetManagers with a library name answers any signed-in user who reaches the library; GetDomains1 can return the managers of every library the caller belongs to in one call.
  • GetUserStatistics carries a count of managed libraries (UserStatistics.DomainManagerRoles; the attribute name in the answer was not verified here).

Notes

  • Library reachability by name changed in commit 61e1fb36 (dated 2026-10-21 in git): GetLibraryByNameAsync and GetLibraryByIdAsync share MayReachAsync, which is membership, or anonymous access, or ListLibrariesForAdministration with the library's id. Administrators, User Managers and Policy Managers reach every library; a library's manager reaches it whether or not they are still a member. Audit Managers reach by name only what they belong to (their date-range log filters are the exception).
  • Can a manager be a non-member? Appointment requires membership, and DeleteLibraryManagersWhoAreNotLibraryMemberAsync runs on every path that takes a membership away (user removed, group removed, user removed from a member group), so by the code read here a manager is always a member. If a non-member manager row exists from older data, the matrix and the workflow checks still pass for it (they read DOMAINMANAGERS only), but every document and folder action fails with "library members only".
  • Workflow: creating and deleting definitions is managers and administrators only; everything in between (activate, steps, task definitions) is also open to the definition's supervisors. Supervising a running task is open to the task's supervisor and assigner as well. GetWorkflowDefinitions with no library lists the caller's member libraries; with a library name any reachable library.
  • TransferUserDomainMemberships between two local users moves nothing: memberships are transferred only when the to-user is global (UserTakeOverOperations.cs, RunAsync), and a local user holds only their home membership anyway. The call still answers success.
  • TransferUserGroupMemberships by a library manager leaves the role groups (ids up to 1000) with the from-user and says so in warnings.
  • The matrix message lists "Library manager(s)" only when the library step was reachable. A manager refused on a global user sees a message that does not mention library managers; that is the message, not a sign that the role never applies.
  • GetMembersWithoutAccess is the one library-management call that admits library managers and administrators but refuses User Managers and Policy Managers, who otherwise administer every library; the refusal says "Only library managers can perform this operation".
  • UserOperations.IsDomainManagerAsync is a plain row lookup with no caching; manager changes take effect on the next call.