Data Groups#
Administration.Security
Data Groups are used when Object Level security levels are switched on, providing another layer of extra security to grant or revoke access to an object. If a Data Group is assigned to an object, depending on the permissions that the user roles have on the Data Group, the user may have three types of access as described in the table below:
| Access Type | Open and see the object details | Find the object using Queries or Search | Modify the object via Edit or Transaction |
|---|---|---|---|
| No-Access | No | No | No |
| Read-Access | Yes | Yes | No |
| Write-Access | Yes | Yes | Yes |
Table: Object Level security access types
Info
If Object Level security is enabled, if an object instance has no Data Group defined, then everyone is able to access the object.
If a user belongs to one Role with Read-Access and to another Role with Write-Access, the user has Write-Access permissions on the Data Group.
When Object Level security is enabled, Data Groups also control the rows that Data Platform returns. When you query a Data Set through the Data Manager, Data Platform returns only the rows that your roles grant access to. The rule for objects also applies here: every user can read a row that has no Data Group. For more information, see Data Set Data Access Security.
Info
A change to the roles of a user, or to the Data Groups of a role, applies to the next Data Platform query. The user does not need to sign out and sign in again.
The list of Data Groups is available by selecting the Data Groups label on the landing page of the Security page.
The Data Groups page displays general information on the specific Data Group. In addition it enables the user to perform all the operations that can be performed on a specific Data Group.
When you select a Data Group, the Details tab provides a collapsible Details View panel on the left side of the page. Depending on configuration and the optional licensed modules, the panel displays some or all of the following sub-sections:
- Details - displays general information on the Data Group.
- Roles - displays information on the Roles to which the Data Group belongs.
Creating a Data Group#
DataGroup.Create
To create a Data Group, open the Data Groups page, select Create on the ribbon, and follow these steps:
- Provide the name for the Data Group.
- Optionally provide a description.
- Select Create to complete the transaction.
Editing a Data Group#
DataGroup.Edit
To edit a Data Group, follow these steps:
- Open the Data Group page.
- Open the wizard by selecting Edit on the top ribbon.
- Make the necessary changes.
- Commit the data to the database by selecting Update.
Deleting a Data Group#
DataGroup.Delete
To delete a Data Group, follow these steps:
- Open the Data Group details.
- Select Delete.
Assigning Roles to a Data Group#
Role.Edit
To assign one or more Roles to a Data Group, follow these steps:
- Open the Data Group details tab and select the Roles sub-section in the Details View panel, or select the Data Groups in the Data Group list page.
- Select Assign.
- Select the desired Roles for the Data Group - note that only the Roles that the Data Group does not belong to are shown.
- Select Next.
- Select the Access Mode for each Role and select Assign to complete the operation.
Unassigning Roles from a Data Group#
Role.Edit
To unassign one or more Roles from a Data Group, follow these steps:
- Open the Data Group details and select the Roles sub-section in the Details View panel, or select the Data Groups in the Data Group list page.
- Select the Roles that you want to unassign from the Data Group, and then select Unassign.
- Select Unassign to complete the Wizard.
