Restricting Access to Data Columns

1. Open the DiveTab connection in Workbench.

2. Click Tools > Server Settings.

   The General tab displays.

   

3. Click Properties.

   The Properties tab displays.

   

4. Above the Property Name list, click the Add Property icon to add a new property.

   New Property appears in the list.

   

5. Double-click the New Property in the list to rename it.

   TIP: Name the property something logical, for example can_see_column_netsales.

6. Define the values. For more information, see Managing Properties.

   Here is an example of a property and its values.

   

1. In Server Settings, click the Users tab.

   

   The user list displays.

2. Locate and select the appropriate user. In the upper right, click the Edit User icon .

   The user's Profile opens.

   

3. Click the Properties tab.

4. Locate the appropriate property line (for example, can_see_column_GP$) and click the content under the Assigned Values column. For example, <none>.

   

   A pull-down menu opens.

5. In the pull-down menu, select the appropriate value(s), then click the blue check icon to save changes. For example:

   

   For this example, the no is selected to not grant user CGilbert access.

6. Click the Projects tab for Server Settings.

   

7. Locate and double-click the DiveTab project in the list.

   

   The list of users to access the DiveTab project opens.

8. Locate the appropriate user. Make sure that the Access Level is set to User.

   

9. Save the Server Settings.

1. Right-click the project folder in the Explorer panel and select Edit Access Control.

   

   The Access for / tab opens.

   

2. Verify that the File-Access is properly set:

   1. On the Access for / tab, click the File Access tab.

      

   2. Check that there is a Read or Write permission in the lists. If not, click the Add icon (+), located on the upper right of the Read Permissions box, to add a placeholder.

      NOTE: The default permission allows all users access.

   Normally access control is inherited from the parent folder. To see whether this is true, look on the Directory Overview tab at the Status of the Subdirectories.

   

   TIP: To remove this attribute, right-click the subdirectory and select Edit Access Control. On the tab that opens, clear the Inherit from ancestor (/) check box.

   

3. On the Access for / tab, click the cBase Access tab.

   

4. Next to Restrict Columns (0), click the Add Columns button.

   

   The Restrict Columns Editor dialog opens.

5. There are two methods to add columns:

   • Click the Add icon (+) and type the column name in the new row. Repeat for as many columns as needed.

   • Select a cbase file from the Search Results, and then select the check boxes for the columns in the adjacent list where you want to restrict access.

     

   NOTE: To remove these areas, select one or more areas under the Restricted Areas section and select the Remove icon (-). A confirmation popup appears: select Yes to delete the rows or No to cancel.

   

6. Click the Add selected columns to the restricted columns list button.

7. Click the Keep changes and close editor button.

   The Restrict Columns Editor closes.

8. Click the Add (+) icon, located to the upper right of the Allow Columns box.

   

   A new row appears.

9. Under the Condition column, select Property from the pull-down menu.

   NOTE: If the Condition Details column does not change to reflect the chosen condition, refresh the page by selecting another tab and then returning to cBase Access.

10. Under the Condition Details column, use the pull-down menu to select the property (can_see_column_netsales) and the text box to enter the values. For this example, users with this property and assigned value yes can see the selected column; users with assigned value no cannot see the selected column.

    NOTE: Select the ... button directly to the right of the values text box to view the values available for that property.

    Under the Columns column, use the text box to enter the name of the column (Net Sales).

    

11. Save the Access for / tab.

In this example, CGilbert cannot view the Net Sales column. Other users can see the Net Sales columns or any other columns based on it.

Here is an example of CGilbert's view of the page.

Here is an example of the view of the page for a user with access.

1. Right-click the project folder in the Explorer panel and select Edit Access Control.

   

   The Access for / tab opens.

   

2. On the Access for / tab, click the Script tab.

   

   The code opens.

3. Verify that the file-access is properly set. That is, this file has default content that you can comment or uncomment as a starting point. For example:

   

4. Add a tag and block for cbase-access within the access block.

5. Add a restrict-columns tag and the column name from the cPlan. For example:

     restrict-columns"Net Sales"

6. Add an allow-columns block and tag for the property. For example:

     restrict-columns "Net Sales" 
     allow-columns "Net Sales" { 
       if-property "can_see_column_netsales" "yes" 
     } 

   Here is the full code block for the access file.

     access { 
       file-access { 
         allow-read 
       } 
       cbase-access { 
         restrict-columns "Net Sales" 
         allow-columns "Net Sales" { 
           if-property "can_see_column_netsales" "yes" 
         } 
       } 
     } 

   NOTE: Normally, access control is inherited from the parent folder. To see access control for this folder, remove inherit-from-parent-folder. To allow read access to all users, add the code allow-read to the file-access block.

7. Save the Access for / tab.

In this example, CGilbert cannot view the Net Sales column. Other users can see the Net Sales columns or any other columns based on it.

Here is an example of CGilbert's view of the page.

Here is an example of the view of the page for a user with access.

NOTES:

• This property appears to be a Boolean condition. However, <All Values> is always a selection option for a property.
• Use of <All Values> is equivalent to selecting both yes and no. Since the properties values are applied with OR logic, All Values is equivalent to yes.
• With this access configuration, Net Sales is only visible to a user if the can_see_column_netsales property is in use and set to yes or all values.