Closed Security Model - Cannot Get To Report

[horatiog]

Hi,

Running CE 8.5

We want to set up a closed security model on our EPortfolio.

We follow the instructions as defined in CE help to allow a particular group access to a report in a particular sub-folder. However, when a user logs into the server they do not have access to the parent folder (nor, in fact any level of the folder hierarchy) to get to the report.

They can search for the report and gain access to it that way but, to this, they need to know the name of the report so it is not an ideal situation.

Obviously, we can work our way back up the folder tree, confering rights for the relevant group to "View" each of the folders, but this will be an unacceptable overhead due to the number of groups and the complexity of the folder hierarchy.

Is this just a "feature" of CE or are we missing something?

Any help would be very welcome.

Regards
Harry Haines
Reports Analyst
Miller Group.

 

[MJRBIM]

In a CLOSED folder structure the USER needs VIEW access to the higher-level folders, in order to be able to access the sub-folders.

EXAMPLE

CANADA
|---> ONTARIO
|---> TORONTO
|----> MANAGER
|
|----> SALES LEAD

In order to schedule RPTs in the SALES LEAD folder the User would need to belong to a Group that also had View access to the Folder Objects at the CANADA, ONTARIO and TORONTO levels - but have no access to the ReportObjects above it or to the MANAGER folder in TORONTO.

I manage about 4,100 Users in 150 Groups using this model. It's always best to plan it out on paper a couple of times before you implement.

 

[horatiog]

Thanks Mjrbim,

However, to continue your example, if you set a group to view the SALES LEAD folder, and therefore also the CANADA, ONTARIO and TORONTO folders, would you not also have to then go and explicitly stop this group's access to, for example:

USA, UK, FRANCE, etc, etc.

ALBERTA, BRITISH COLUMBIA, QUEBEC, etc, etc

OTTOWA, NIAGARA, ALGONQUIN, etc, etc (Had to look at a map for that ;-))

MANAGER, ANALYSTS, COFFEE BOYS, etc, etc

We maybe do not have so many groups as yourself, but have a 5 level hierarchy and with quite a broad spread of items at each category. What we are really looking for is a way to automatically stop a group's access to these "side-branches". Is there any?

Again, many thanks for your help.

Harry.

 

[Turkbear]

Hi, The thing to remember in a heirarchical ( spelling check please) structure, is that the FIRST block stops the descent..So, if you prevent access to
ONTARIO, then access to anything BELOW that is aslo blocked, regardless of the permissions set at those levels.
You could go 'horizontal' -
CANADA|
PROVENCES
|--> ONTARIO --> MANITOBA -->ETC
|
TORONTO --> OTTAWA
That way you can grant view access to the Provences level( which will (or can) have no reports and then restrict which provences ( and therefore which cities) )
can be accesed.