Ok… my head is running in circles, so before I explode I figure I’ll post my scenario here and maybe someone can help figure out what I’m missing…
Scheduling an object
We have 3 levels of users today:
Basic - (View only rights)
Advanced - Includes ad-hoc creation
and Developer - All functions except some admin stuff.
Basic users nor Advanced Users cannot schedule at all. The rights have been ‘denied’ on the root folder level for this group.
However now we have a situation where we may need a few individuals in those Basic and Advanced group to have Scheduling rights.
I know I can create a 3rd group, say “Basic-WithSchedule” or something and move the people into that group, but it’s one more group to manage etc…
So what I’d rather do , is be able to create a new group called say “ScheduleRights”, which grants any user the ability to schedule a report if they are in that group.
My issue is the way I understand BOBJ, is that if a user belongs to say two groups with conflicting rights, the “DENY” wins over “Grant”.
Since the default security option for all users is to allow scheduling, how do I deny it for 99% of the users, and then re-open it up for the 1%? Am I forced to move people into a seperate group entirely rather than layer on a specific rights group?
I was under the impression that scheduling rights were defaulting to an allowable setting, and thus not-specified would still allow it.
I’m still trying to wrap my head around the interface and I hope XIR4 (whenever that comes out) will help streamline the security interface. It’s great that it’s so granualar, however it’s almost impossible to locate where a setting is unless you’re intimately familar with it in the first place.
Heh yes, I’ve seen it and Yes it was a great topic at the conference 2 years ago. Unfortunatly the powerpoint alone doesn’t have enough explaination. It was intended as a powerpoint should be, as a guide for the audience to follow the speaker.
I am not sure if the spreadsheet has been updated since 2008, I am glad you mentioned this, as I forgot to ask Duane.
(BOB member since 2006-07-06)