Versions Compared

Old Version 22

changes.mady.by.user Denise McGettigan

Saved on

compared with

New Version 23

changes.mady.by.user Denise McGettigan

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents
maxLevel2
minLevel2

Info
titleRelated articles

Restrict what a user can view in a database

To limit what users can see in an active database, choose the restrictions iconImage Removednext to the defined period (if a restriction is active, the icon will be black) to open a restrictions form. 

You can control whether or not users have access to a database, then use restrictions to limit what users can see in the database. For example, you might want all users to be able to access the Sales database but only allow some users to see a subset of the data, such as a specific dimension or customer.

In the image below, the first two

databases in the example are accessible, but have restrictions. The third one is accessible and the fourth is not accessible (and is

users can access the Sales database but some restrictions have been applied. The third user can access the Sales database and no restrictions have been applied. The fourth user cannot access the database (outlined in red).

Image Modified
Default restrictions 

Access the database restriction settings

Click the Phocas menu button > Administration > Databases, then click the database name (blue link) to open the database settings screen for that database.

You can then either manage access to the database for individual users or add default restrictions to the database.

Give or remove access a database

  1. On the database settings screen, click the Users tab.

  2. Give access to the database: Select the required default period from the dropdown list.

    Image Added

  3. Remove access to the database: Select the blank option from the dropdown list.

    Image Added


    The database will appear with a blank box and red outline to indicate there is no access. 

    Image Added

  4. Click Save.

Restrict what a user can view in a database

  1. Click the Restrictions button (lock icon) next to the defined period. A grey button indicates no restrictions have been applied yet and a black button indicates one or more restrictions have been applied.

  2. In the Restriction for… window, configure the restrictions (see examples below as the process is similar) and click Save.

Add default restrictions 

Normally, restrictions are applied on a user-by-user basis,

i.e.

so if a user doesn't have a restriction, it implies

that

they have access to all data in a database.

 Database

 Default database restrictions allow that logic to be reversed, so

that

any user without a specific restriction will get the default

one

restriction from the database. Instead of applying a user restriction to limit access, it is used to increase access. This allows a 'secure by default' way of setting up the database.

  

  

Expand
titleExample
:
- Create a default restriction on streams
. In

In the example below, a default restriction has been created to allow access only to the principle stream, which is

'

Sales

'

. All users without a specific restriction

would

will only be able to access the

'

Sales

'

stream. To grant a user access to the

'

Budget

'

stream, you would add a user restriction. 

Image Modified

Expand
titleExample - Create a default restriction on measures

You could set a default restriction on measures to allow access only to the

'

Value

'

and

'

Quantity

'

measures. This would mean that all users would be prevented from seeing

profit

Profit and

margin

Margin figures, unless specifically granted that access. For example, you would grant access to the

profit/cost of sales

Profit and Cost of Sales measures for managers and directors

only (see User restrictions).Default

by adding a user restriction.

Expand
titleExample - Create a default restrictions based on user settings
 

A further refinement to the regular way of applying database restrictions is to base a dimension restriction on a user's settings, instead of an absolute, fixed value

. The example above discusses why having an entity restriction such as 'Rep Code = XXXX' wouldn't generally be useful

. By replacing

the

a fixed value with one of the two user variables {{user:group}} or {{user:territory}}, the appropriate setting value from the user will be applied when they login. This allows the restriction to be created at a database level, but applied per user. In the screens below, a default restriction has been set on the database using the territory value from the user. In the second screen, the users have multiple territory (or State) codes assigned to them, which are used when they access the database. Note: Semi-colon separated values are used when specifying multiple allowed values. 

Image Removed Image Removed
Image Added

Significantly for this type of restriction, a mistake or a missing territory or group value value on the user will result in no data being exposed. This mechanism provides a 'secure by default' way of setting up the system.

Expand
titleExample - Use sub-
databases to
databases to restrict data view

If sub-databases have been created for the site, you will see a

'

Sub-databases

'

option

appear

when setting restrictions on a database, as shown below. As the name suggests, these

contain only

contain only a sub-set of data. Creation of these sub-databases, or so-called 'splits',

are an

are an advanced form of user security which needs to be implemented by a Phocas consultant.  

Image Removed 
Image Added

Sub-database

names 

names

The Sub-database names will always begin with the master database name that they relate to, followed by an underscore, followed by another other name to make them unique. For example, a master database of Phocas_Sales could have sub-databases called Phocas_Sales_Depot001, Phocas_Sales_Depot002, etc. 

Impact

Sub-database impact on sharing 

Because these sub-databases are available to different groups of users as subsets of the same application database (and in fact appear as the actual application databases), favorites and dashboards can be shared across databases and between users

.

Remove a user's access to a database

Clear the user/database cell to deny the user access to a database. The database will appear with a blank field and red outline to indicate no access

.

 

Insert excerpt
User restrictions
User restrictions
nopaneltrue

 

On this page

Table of Contents
maxLevel2
minLevel2

Related page

User restrictions