Question regarding new G/L account (restrictions to users)

jackies

Hi experts

We are in the process of redesigning our security roles and we found the best way to restrict something to users is to restrict access to the forms (write, delete, etc)

However, there is a problem with the creation of new G/L accounts. It creates them with direct posting set by default which is fine for 90-95% of the accounts. But, if this is a control account we don't need to have direct posting.

Is there a way I can make Navision to look for the value of Direct Posting of surrounding accounts (above & under) have and use the same....?

Far fetch ah :roll:

matttrax

Why wouldn't the user just uncheck the field when they create the account? Don't write code for things that can be solved with simple training.

jackies

We want to restrict standard users from adjusting Direct Posting field.

This is not something someone may not understand but want to "fix" with a potential error

jannestig

Why would the Average user in your installation be creating accounts for anyway :shock:

If you are creating new Roles give the GL account table modify access only to your top financial people.

jackies

jannestig wrote:

Why would the Average user in your installation be creating accounts for anyway :shock:

If you are creating new Roles give the GL account table modify access only to your top financial people.

Because creating new G/L accounts is something done every day by accountants. We don't want to restrict them from creating these accounts and asking their manager's (higher access level) to create/adjust these accounts.

Our goal is to modify standard access beased on frequency. This is something done often so we don't want to restrict it. However, we don't want these users to be able to change Direct posting whenever they want...Hope this makes it clearer.

jackies

How do I give access to the form but the user won't be able to edit the information?

What I did was to give read access to tabledata and, in the form read and indirect on execute.

I can see the section (i.e. Company Information) but when I click it it says I don't have access. I want the users to be able to access to see this information but not be able to edit/add anything.

Thanks

Malajlo

Start debugger and you'll see, which table/object is without permission.
Of course, user must have permission to run debugger.

rdebath

jackies wrote:

Because creating new G/L accounts is something done every day by accountants. We don't want to restrict them from creating these accounts and asking their manager's (higher access level) to create/adjust these accounts.

What!? I'm pretty sure our customers change them once a year at most, at least that's what they tell us. Now dimensions OTOH do get changed often, some places have job numbers as a dimension. That's the point of course, with Navision you don't need to change the base accounting every time you get a new light bulb, just add another dimension value.

jackies

rdebath wrote:

jackies wrote:

Because creating new G/L accounts is something done every day by accountants. We don't want to restrict them from creating these accounts and asking their manager's (higher access level) to create/adjust these accounts.

What!? I'm pretty sure our customers change them once a year at most, at least that's what they tell us. Now dimensions OTOH do get changed often, some places have job numbers as a dimension. That's the point of course, with Navision you don't need to change the base accounting every time you get a new light bulb, just add another dimension value.

We are not a partner but a big client

Our users work on multiple companies and they need to have access to add new accounts often.

jackies

Another issue now...

I need all users to have access to Data Migration in order to import Teplate data to the new company. I have a problem when I apply the data imported and get migration errors in most of the tables, because I have restricted access to most of them.

I then had a look on the role's permission and added indirect on Insert, Modify & Delete permissions. However, nothing happened...I had to add full permission (Yes to all three above) to make it work that defeats the purpose of all this...
:?

rdebath

To use indirect permissions you need to add the permission to the object that's doing the database access as well as the indirect perms to the user.

It's the "Permissions" property on the dataport (codeunit etc) property list.

jackies

So if I take Journal Templates table as an example what would I have to do? I'm a bit confused...

vaprog

I wanted to give you an answer to your initial question.
(this thread now gets a little messy because you asked two distinct questions in the same thread. Always start a new thread for a new question.)

jackies wrote:

Is there a way I can make Navision to look for the value of Direct Posting of surrounding accounts (above & under) have and use the same....?

Yes there is. Use the OnNewRecord trigger of the form.
You can find an example for this on the Sales Order Subform regarding the Type field. If you need to have more environment then you have to explore it yourself using a record variable.

Another approach was to disallow a user to create an account from scratch and instead force him to copy a similar account and modify if (much like the Copy Sales Document report).

rdebath

jackies wrote:

So if I take Journal Templates table as an example what would I have to do? I'm a bit confused...

The journal templates table probably won't be doing the database access.
The object that you're running, eg the form on your screen is the one that's doing the database access so it needs the table added to it's "Permissions" property before it will take notice of any indirect permissions given to the user.

For posting it'll be one of the codeunits (12, 22, etc) for most anything it's the object that the debugger shows when you get the permission error.

jackies

Thanks vaprog! I will check that

rdebath, I have form 0 access to yes on all permissions so ideally this shouldn't be a problem...correct? :?

rdebath

jackies wrote:

Thanks vaprog! I will check that

rdebath, I have form 0 access to yes on all permissions so ideally this shouldn't be a problem...correct? :?

Arrgh, YES I Know all the security related stuff should be in one place but it's not because the licensing is all wrapped up with it.

This is a property in the form itself called Permissions.