Access control

Working with access control

When the access control mechanism is enabled in the Schema Editor, all users (including an admin) loose the access to all tables. It is the result of the default configuration, which disables access to all tables and all columns. The point of access control is the definition of rules, which overwrite this default setting.

Note: access rules are cumulative, so if one rule forbids edition of a column and the other one allows it then a user, for whom these rules apply, will be able to edit it. This is why generally it is a good idea to establish a rule forbiding access to everything for everyone and then enable some exceptions.

Access control rules

An access rule can be considered as a general rule for a given set of roles. But it also lets you to define some exceptions from the general rule. So usually the rule is more restrictive than the exceptions.

Every access rule has the same structure, which includes:

• Roles section specify for which user roles the access rule is applied. There are two major options: All and One of. If you select the latter one, you need to specify the set of roles. You may add here as many roles as you need, but it is often a good idea to select only one and create a separate rule for every single role.

• Column default means the default level of access to all columns in all tables. This section provides the following options:

  • Deny - user has no access to the columns in all tables.

  • View - user may only see the content of columns in all tables.

  • Edit - user may see and edit the content of columns in all tables.

• Add default describe the ability of a user to create new records in all kinds of tables. Two options are accessible here:

  • Deny - user cannot create new records.

  • Allow - user can create new records.

• Remove default parameter can regulates the possibility of removing records in all tables of the database.

  • Deny option block the removal.

  • Allow option makes it possible.

• Import default section determines if a user can use the import/export tool in all tables of the database. As the tool is very powerful, access to it is regulated separately. Two states are possible:

  • Deny disables import/export tool.

  • Allow enable it.

• Tables section defines access rules at the level of tables and columns. The above parameters specify the general rule for all tables and columns in the whole application. This section lets for defining exceptions. It is described in details in the chapter below.

Tables section of access control rules

The tables section lets to define a set of sub-rules, which can overwrite the general rule. As the higher level rule operate at the full set of tables in the database, here every defined sub-rule described the access to the single table.

It is possible to add multiple tables in this section. Every of them consists the following parameters:

• Name of the table, for which the rule is created.

• Column default describe the general rule for all columns in the table. The options are:

  • Deny - all table columns are hidden for a user.

  • View - all table columns are visible for a user.

  • Edit - all table columns are visible and editable for a user.

• Add describes the ability of a user to create new records in the table:

  • Deny block this ability.

  • Allow makes it possible.

• Remove defines if a user can remove records in the table.

  • Deny disable permission to remove.

  • Allow gives permission to remove.

• Import control the import/export mechanism for the table.

  • Deny turns off this tool for a user.

  • Allow turns it on.

• Columns section lets for defining individual permissions to every single column (exceptions from the general table rule). In this section you can add as many column as you need. Every of them needs to have access level assigned. The Deny, View and Edit levels are available.