Hi There,
I wish to set up access to individuals to see thier own data, but to admins to see all data. I attempted to do this with section access, with users having access to individual records, but the admin having null (eg. all data).
However, on loading the users saw the right data, but the admin only saw records where the data was blank. I tried replacing blank data with 'ANY', but the admin user could not log in (as they could then see no records). Using a * symbol gave the admin access to everything the users had, but not to anything outside of that.
I'm guessing the problem is down to leaving the value out on the inline load of section access is the same as empty string, not null?
Either way, I worked around it like this:
Section Access;
LOAD * INLINE [
ACCESS,USERID,PASSWORD,NTNAME,MAPNAMETO
ADMIN,admin-user,<removed>,*,*
ADMIN,*,*,DOMAINNAME\QVPublisher,*
USER,JohnD,,DOMAINNAME\JohnD,JOHN
USER,JaneD,,DOMAINNAME\JaneD,JANE
USER,FectchAll,adfjklajd,ajdfkl,ANY
];
[...]
SecurityNames:
LOAD * INLINE [
SecurityNames
JOHN
JANE
];
[...]
ExchangeLog:
LOAD
*,
if(exists(SecurityNames,upper(RecipientName)), upper(RecipientName), 'ANY') as MAPNAMETO,
[...];
SQL SELECT *
FROM dbo.tbl_ExchangeAgentLog;
[...]
DROP TABLE SecurityNames;
So basically I have a dummy user in the security, which maps to ANY, a temporary table with allowed names in, and anything that isn't an allowed name being mapped to ANY - that then means that the * on the admin account will map to any record.
This obviously isn't very robust though, as if an entry gets added to the SecurityNames table, without a corresponding Section Access entry those rows will not be shown to the administrator.
There has to be a neater way than my work around! Any suggestions gratefuly received.
Cheers,
Steve
