Confirmation of the Indirect permission logic in Navision

engsiong75

Hi everyone

I am trying to create an indirect permission for my own program. This is what I found out. I have a new Report 50001 Create new Vendor. and a new Codeunit 50001 Vendor checking.

The report 50001 calls the the codeunit 50001 to create a new entry in the Vendor table. I give a user
Report 50001
Read: Yes
Insert: Yes
Modify: Yes
Delete : Yes
Codeunit 50001
Execute:Yes
Vendor Table
Read: Yes
Insert: Indirect
Modify:
Delete :

I found that my code could not undate the Vendor table. However, when I gave the permission to insert in the Codunit 50001 to the vendor table table, it gives the user the ability to Insert into the Vendor Table via the codeunit 50001. I also found that if the permission was changed to blank for the Vendor table in the permission table, the user could not update the vendor table from the codeunit 50001 even though the object has Permission to Insert to the Vendor Table.

Can anyone confirm my findings on the Indirect permission? I am going through all the Navision manuals for the Indirect permission and I do not find a clear point why the indirect works or does not work.

Thank you,

Tan Eng Siong

kine

1) The indirect permissions on object must be set on object which is doing the insert/modify/delete, not the object which was started as first...
2) To have effective permissions, you need to have:
a) enough permissions for the object in license
b) enough permissions as user
c) enough permissions on object
it means, when using indirect permissions, you need to have indirect or full permissions in license, as user and if indirect in one of them, than you need permissions assigned on the object.

engsiong75

Hi Kine

I am aware of the license limitation. However, on the Vendor Table, I am allowed
Table 23: (Vendor)
Read=Yes
Insert=Yes
Modify=Yes
Delete=Yes

But as describe in my case, the codeunit will execute when it has permission to the Vendor Table RIMD (Read, Insert, Modify, Delete) and the Vendor Table has a permission of Insert=Indirect. It does not update if the Codeunit has the permission to the Vendor Table alone or if the user just has a permission of Insert=Indirect for the Vendor Table.

kine

If the user have no permissions but the object have, it is not enough.
If the user have indirect and the object have no permissions, it is not enough.

You need to think about it that Indirect on user is one half of the permission, and the second half is the permission on the object. Only if you have both parts, you have access... ;-)

engsiong75

Microsoft's own words on Indirect

Sometimes the license file only gives you indirect permission to perform operations on certain tables. Security permissions can also be used to give users only indirect permission to certain tables. If you only have indirect permission to, for example, insert data into a particular table, you cannot insert data into this table from the standard user interface. You must use a database object that has been given extra permission to insert data into the table in question.