Is it possible to AND two roles? I mean, is it possible to give access to a document, if, for example, user has roles [A] AND [B]? I know i can create a role [AB], but if i have many roles, the combinations are too long, so that is not what i want. Any ideas?
Subject: Roles: Possible To “AND” Them?
Use the security tab of form and/or view preperties as per your requirement and select the roles there for read/edit so that you can set access to only some.
Subject: RE: Roles: Possible To “AND” Them?
that is not what i asked.
I asked if it is possible to give access, for example, to a document, if user has role [A] but also role [B].
Subject: RE: Roles: Possible To “AND” Them?
Access to a document is always given using Author and Reader fields.
Create the fields (Check Allow Multiple Values option for the fields) and then include the roles you want in the fields like -
“[A]” : “[B]”
Another method is to write the code in Queryopen to check for the user roles of the currently logged in user and then alert the user if he doesn’t contain both roles A and B.
Look for NotesACL class for more info.
–Phani
Subject: RE: Roles: Possible To “AND” Them?
that would give access to users with either role [A] OR [B], not users with roles [A] AND [B].
Subject: RE: Roles: Possible To “AND” Them?
What do you mean by ‘access’? Read or edit or someother? Explain your scenario in detail?
Subject: RE: Roles: Possible To “AND” Them?
Reader Access to a document by using a roles filed.
For example, i want to give access to a user to a document, if he has the roles [manager] and [us], and give access to another document, for users with [manager] and [ar].
I don’t want to create [manager-us], [manager-ar] roles, as i have 50 countries, and the limit of roles would be passed.
Subject: RE: Roles: Possible To “AND” Them?
Then there is no way to solve your problem using roles. Of course, you can create as many groups as you like.
Subject: RE: Roles: Possible To “AND” Them?
Is the main issue one of access prevention or one of accessing the proper document?
Given the access restriction you specified, a user may be presented with a list of 50 documents, all but one of which they should not be able to access.
You can sort-of prevent access by modifying the QueryOpen method in the form or the QueryOpenDocument method in the view to check the user’s roles against the document’s using your ‘AND’ logic.
These however would be UI-level restrictions and not properly security which may be sufficient for your needs.
If redirection to the proper document is a preferred method, then you could do this via the QueryOpenDocument method or you could create, for example, an embedded view that shows only documents for a user’s country role.
Subject: RE: Roles: Possible To “AND” Them?
can you explain me how creating groups could solve this problem?
Subject: RE: Roles: Possible To “AND” Them?
Create your 50+ groups, and use them to populate the readers field…
Works like a charm =)
Subject: Roles: Possible To “AND” Them?
You will have to do this by hand I’m afraid.
In a QueryOpen event you could have a bit of logic which checks that the users has all the roles which are in the readers field.
eg In a readers field have [A] : [B]
In the QueryOpen you could evaluate @userroles and then check that the user has both [A] and [B] and quit if they don’t.
Of course, this will only stop them opening the document, it won’t stop them opening the Properties dialog and seeing the NotesItems - assuming they have either [A] or [B].
Frunobulax
Subject: RE: Roles: Possible To “AND” Them?
yes, but the problem is that any user that has either role, would be able to access the document from outside my code with an agent, for example, so that is not really safe.
Subject: RE: Roles: Possible To “AND” Them?
In that case you’ll have to do what Andre suggested and create a bunch of groups eg AccessAB, AccessBC etc etc and then put the groups in the Reader field.
How many roles are we talking about?
Frunobulax
Subject: RE: Roles: Possible To “AND” Them?
i still dont get how creating groups would solve the problem.
If i create GroupAB, i would have to either
-
assing [A] and [B] roles, the problem would be that users with role [A], would be able to see docs of GroupAC
-
assign role [AB], this is a no go, cause i have 100 combinations.
Subject: RE: Roles: Possible To “AND” Them?
Forget about using roles at all for this. Use the group names in your readers lists instead of role names.
Subject: RE: Roles: Possible To “AND” Them?
You are right. I moved from using groups on author/readers fields long ago, in favor of roles. I almost forgot about them. Anyway, i would have to add as many groups as convinations. Thanks.