We need security on a User Field that will allow Update by several Roles and Display Only by all oth

tkastle

I've been searching the Community for a while and can't find exactly what I'm looking for.

We can restrict at the Form level, but I know a Personalization can override this restriction, so it needs to be a Security Class.

For my example:

• We have a User Field on the Employee Business Class called "MyPetsName"
• We need to allow the Resource (Employee) and anyone with the Admin_ST Role to be able to update the value from any Form that field is on
• We need to not allow update, but still show the field value on those same forms to those who have several other Roles (like BenefitAdministrator_ST and HRGeneralist_ST)

If someone could point me to a Community question/answer that explains this OR provide some feedback that would help a lot.

Thanks!

maphillips

Hi Todd, Here are a few suggestions and please note that appropriate testing should be done. There are multiple approaches you can take based on additional information. Feel free to contact me if you need help.

You can customize these roles and copy and configure a delivered security class that provides or restricts access to the field based on conditions. Remember that generally the least restrictive rule wins when a combination of security rules applies to the same object. Some variation of these rules may be needed based on requirements and testing.

For the custom Employee role, either create a new security class or copy and configure GHREmployeeSelfAccess_ST. Assuming the Employee should only update their own record, the rule on the field can be:

Employee.MyPetsName Field

            is accessible

                for update, all inquiries

                when (IsEmployee)

You can also use the Employee_ST role and add a new security class to it based off of GHREmployeeSelfAccess with the additional rule above.

Admin_ST should already be able to update this field unconditionally without any adjustments to security. The LTMUnconditionalAccess_ST security class provides that with a rule on all business class "types".

For the other roles, i.e. HRGeneralist_ST, and assuming there may users that do not have the Employee_ST role, you can customize the role and add a configured security class and rule to explicitly deny update access. Look at GHRGenEmployeeAccess_ST for reference. Note that rule changes may be needed based on combinations of roles assigned to the actor. The Securable Object Access Details report and / or security debugging are helpful for determining rule application. Usually, field restriction rules apply when the record is saved even though it looks like the field is updateable in the form. Upon save, a dialog box is presented informing the user of security violation. Something like :

Employee.MyPetsName Field

            is accessible

                for all inquiries

                unconditionally

            is not accessible 

                for all updates

                when (IsNotEmployee) - or unconditionally