OSUser with Active Directory Groups

[sergio0592]

Hi all,

I use the OSUser for hide or show charts/ tabs in my apps. I use only with 'DOMAIN\User_name'.

Do you know if it's possible to use with Active Directory Groups, because it could be faster instead write OSUser() = 'DOMAIN\UserA'  or OSUser() = 'DOMAIN\UserB'  or OSUser() = 'DOMAIN\UserC'  .....

Thanks

[Peter_Cammaert]

No that won't work. AD Users are never uniquely identified by a group name, only by a user name. So OSUser() will always return the unique accountname of the user that is currently logged in. Not the maybe 15 groups he/she may be member of.

Moreover, groups are only used to distribute permissions across groups of users instead of every user individually. For example, if I need access to a QlikView document and permissions to this document are managed using a group name, then I become member of that group and at the same time earn all permissions that are assigned t othat group. But I will still be known everywhere in AD as my accountname.

Best,

Peter

[marcus_sommer]

Your query for the osuser could be simplyfied with:

match(osuser(), 'DOMAIN\UserA', 'DOMAIN\UserB', ...)

or you could extend it for a lookup-logic like:

pick(match(osuser(),

     '$(=concat(NTNAME, chr(39) & ',' & chr(39), RecNo))',

     '$(=concat(GROUPNAME, chr(39) & ',' & chr(39), RecNo))')

whereby you need a table of your users-usergroup matching. With them and if the data are really confidental and/or you want to implement a very strikt usability it's recommended to use section access to control the access on data, objects and sheets (and within section access you could also use user-groups for the autorization).

Section Access

- Marcus

[Peter_Cammaert]

Sorry, Marcus' post made me realise that I partially misread your question. Of course you can use AD Groups to better manage access to documents and data, only not with OSUser(). Section Access does support AD Groups.

Peter

[sergio0592]

Thanks Markus, i'll read carefully your post about Section Access.