How to manage read and write permissions?

tobia

Hi everybody, I'm a new NAV 2017 user.
I need to setup some permission rules on my ERP, I tried to understand with my consultat how to do, but I could not get a real answer and seems that my simply request is more difficult to achieve with standard NAV tools. I want to understand how other people face this problem.

Let's say that I need a "Operators" user group. Operators can do everything but add or edit items property. He can read but not add new items or edit them.

I tried to setup Operator's PermissionSet adding all TableData rows with all permissions except for Item table where I have set read only. This works, but when I post an order, the item ledger entry could change the direct unit cost of item and then it fails the item update. So maybe this limit is too strong.
Then I checked if I can use permission on Page of Items but here I cannot distinguish read ad write permissions.

I simplified my problem in only one case Operators/Items. In my real system I have to divide Commercial capabilities to Technical. Working on it I found many other strange things, for example the insertion of an Item in Transfer Order need BOM Components read permission where Transfer Order for me is a commercial document but a commercial user should not see BOM.

How would you solve this problem?
Thanks!

Slawek_Guzek

There is special Indirect permissions which allows the code to modify table on behalf of a user, but does not allow to modify the data directy.

How it works: The object which is trying to modify the Item table (codeunit 22 in this case) must have defined a permission to modify specific table. Codeunit 22 actually does have the permission to modify table 27 Item:



Then the user who needs to be allowed to post Item related stuff ( which updates an iem record in Item table), he/she needs to be granted an Indirect Modify permission to the table 27 through a role.

When such a user posts an item journal and the code hits codeunit 22 NAV will internally "combine" both users and object permission and allow the code inside codeunit 22 to do MODIFY on Item table.

jan_jansen

In the classic version i started the codecoverage and clientmonitor and recorded the steps that the user had to do. The codecoverage shows me then which objects the user uses and the clientmonitor reveals which permissions the user needed for the tables. With a little prograom you can then add these to a new or existing rule. For nav2017 you dont have the clientmonitor anymore, but maybe you can use this https://blogs.msdn.microsoft.com/nav/2015/10/01/coffee-break-monitoring-and-troubleshooting-nav-services-part-iii/ as an alternative.

Slawek_Guzek

There is special Indirect permissions which allows the code to modify table on behalf of a user, but does not allow to modify the data directy.

How it works: The object which is trying to modify the Item table (codeunit 22 in this case) must have defined a permission to modify specific table. Codeunit 22 actually does have the permission to modify table 27 Item:



Then the user who needs to be allowed to post Item related stuff ( which updates an iem record in Item table), he/she needs to be granted an Indirect Modify permission to the table 27 through a role.

When such a user posts an item journal and the code hits codeunit 22 NAV will internally "combine" both users and object permission and allow the code inside codeunit 22 to do MODIFY on Item table.

Juhl

I use the Record function.
Start recording, do whatever the user should be able to do, stop recording. Now you have your permissions.

tobia

Juhl wrote: »

I use the Record function.
Start recording, do whatever the user should be able to do, stop recording. Now you have your permissions.

What do you mean for Record function? Codecoverage or another tool?

Juhl

There is a function that records permissions. Its on Page 9803