Logon with two IDs...How does it know which to use?

system · February 6, 2005, 11:47pm

Not so much two IDs as one ID in two groups, but with different profiles.

Does it just take the most powerful?

Liam Gartside (BOB member since 2004-11-15)

system · February 7, 2005, 12:06am

Please, take a look at this entry in FAQ Supervisor.

Or this post from Dave Rathbun:

Dave Rathbun:

Configuration options are granted on a “most restricted” level, while resources (Universes) are granted on a “least restricted” level. That is currently the way the product works.

When you log in, you are not logging in to a particular group. You are logging in to every group that you are a member of at the same time. Universes that are granted to one group are automatically available because of the “least restricted”. In other words, if you have a universe anywhere you have it everywhere.

Command options, like Create Document, are granted on a “most restricted” level. In other words, unless you have the command everywhere, you will not have it at all.

There is currently no feature in the product to allow different command options on different universes. The work-around is to set up different user ID’s, one that logs into a single group with “Create Document” enabled, and another that logs into a different group where “Create Document” might be disabled.

Moved to Supervisor forum.

Andreas (BOB member since 2002-06-20)

system · February 7, 2005, 12:57am

Thanks. I’ll go and look at the other FAQ entries as well

Liam Gartside (BOB member since 2004-11-15)

system · February 7, 2005, 5:43pm

I have userids that are in 2 different groups pointing to one universe, but the connection is to 2 different databases in each group. Does anyone know which connection takes precedence? Seems like the group that comes first in the list does but I’m not sure.

Monica

mtrembla (BOB member since 2003-08-18)

system · February 7, 2005, 6:44pm

I don’t have the answer to your question, but this is generally not a good practice. I tested a similar situation once with “conflicting” table mapping overrides on one universe. The results … unpredictable, at best. My solution was a procedural edit to be sure one user could not be in two groups with privileges to the same universe.

Dwayne Hoffpauir (BOB member since 2002-09-19)

system · February 7, 2005, 7:44pm

Thanks, Dwayne. I’ve since removed these users from the one group. It did cause a lot of confusion when we were getting the wrong data on the reports. They were special userids we were testing from that I put into the Developer’s group in order to publish from without having to log back into our normal userids, if that makes any sense to you.

mtrembla (BOB member since 2003-08-18)

system · February 8, 2005, 5:48pm

Just a note: in XI (and the upcoming XI Rls2 for Full Client) this restriction for object and data security has been solved. There is a ‘priority order’ for the association of a ‘Restriction Set’ (override/overload) to a User or Group. User-specific overrides also automatically have a higher priority.

XI also supports sub-groups so the potential number of security overrides associated with a given user can be exponentially more complex. Flexible yes, but complex. =)

There is a facility to resolve and see what restrictions exactly will apply for a given user given the entire heirarchical inheritance system.

The ‘command’ security is still the same model - “most restricted”.

snagoski (BOB member since 2004-12-13)