Permissions and Departments in Role Tailored Client

mgrammatico
mgrammatico Member Posts: 4
edited 2009-12-21 in NAV Three Tier
Hello Everyone,

I have a few general questions on permissions and departments in the Role Tailored Client.

1. Can departments be hidden based on the permissions set?
My experience with this is no, but maybe I'm doing something wrong. We have been limiting access to table data and that usually allows the user to click the link to any item in any department, but if they don't have access, it fails with a message telling then why they can't access it. We'd love for users to only see what they have access to. Is there any way to accomplish this in RTC?

2. If the answer to question 1 above is no, is there any value then in allowing access to table data, but preventing access only to the pages we do not want the user to see. The result seems to be a similar error message stating the page that can't be accessed instead of the table data and as far as I can tell this prevents users from unintended access to screens and processes that were restricted to by getting in different way and unintended restrictions to their assigned functions and tasks. Is this a good approach? What is the downside? Is there a better way?

Thanks in advance for your comments.
Regards,
Marc

Comments

  • alexpeck
    alexpeck Member, Microsoft Employee Posts: 37
    It's not possible to hide portions of the departments menu. Instead you should create a home menu (where you find the role centre) for the primary activities of the user. You can control exactly which items appear in this menu.

    In response to 2, generally I think you should deny access to both page and data. If you want to prevent a user from performing an action, the most secure approach is to deny access to both the page which exposes the action and the underlying table data. I would describe this as defense in depth. Your question is really about how to show the user the right thing rather than security, and in RTC there is no relation between permissions and what parts of the UI are displayed.

    If two pages manipulate the same table, but one performs stronger validation, it may be useful to prevent some users from accessing the page with weaker validation. In this case, there is value in the user having access to the table but not the (weaker) page. This situation, however, should be avoided in the first place.

    Alex

Categories