Syniti ADM Console Security

Answered

Deli Bajraktari

• January 31, 2023 08:14

Hi,

- Is it possible to restrict a user from creating Waves or Process Areas but allow him to create Objects ?

- How can we ensure a user only sees the waves that have been assigned to his security role? (it seems like even though the correct waves/process areas keys have been assigned at the Security Role Definitions (Console.Wave_ProcessArea), the user still can see the other waves

 

Thanks !

1

• 

  Ben Bauer

  • January 31, 2023 13:48

  Hi Dbajraktari,

  Thanks for reaching out!

  Regarding your first question, I can start by saying that nearly every security configuration is possible even if none of the delivered security groups and roles meet your needs. This is because the ADM/SST framework permits the creation of custom groups and roles.

  • Custom groups are created through the Add-Ons component (refer to Customize Security Using Add-Ons).
  • Custom roles are created through the Admin > Security > Security Management > Security Roles page (refer to Create Security Roles)

  Looking at our delivered Console security now, I see that only the PowerDesigner and PowerUser groups are permitted to create Waves, Process Areas, & Objects. So this does mean you would have to create a custom group that has permission to create Objects but not Waves or Process Areas.

  Regarding your second question, can you provide a set of steps that users are following that allows them to see other Waves? Keep in mind that some security roles include a Key named "DSPCommon.Administrator_Role" that gives access to all Waves.

  1
• 

  Deli Bajraktari

  • January 31, 2023 15:58
  • Edited

  Thanks a lot Ben, custom groups solve the first question :).

  About the second question here are the steps we took:

  - Creation of a security role & added which wave/process area the role is able to access using security definition keys within "Console.Wave_ProcessArea"

  - Assignment of a test user to that security role.

  - When the user logs in and navigates to "Advanced Data Migration > Console", he has the ability to see the waves for which he has not been assigned (even if he does not have the permission to see the details of the process areas). What we want is for him to only see the wave(s) that were assigned to his security role.

  0
• 

  Ben Bauer

  • January 31, 2023 18:54

  Hi Deli,

  Thank you for the clarification. The issue makes sense now.

  It is true that there are no security keys at the Wave-level. The highest level with keys is the Process Area-level just below Wave. It is unfortunately not permissible to modify the Console > Waves page to only show rows that match a custom Wave-level security key.

  I'm sorry for the inconvenience. I do encourage you to request an enhancement to the Console app here in our Syniti Ideas Portal.

  0
• 

  Deli Bajraktari

  • February 01, 2023 09:18

  Thanks for the clarification and I will request an enhancement on the Syniti Ideas Portal.

  In the same way we have "Console.Wave_ProcessArea" & "Console.Wave_ProcessArea_Object" security definitions, wouldn't it be possible to create a custom "Console.Wave" and define a security key at that level?

  1
• 

  Ben Bauer

  • February 01, 2023 12:16

  Hi Deli,

  Yes, it is certainly possible to create a custom Wave-level security key. However, each page in the ADM/SST framework has a list of keys that it considers, along with a list of columns it uses to bind to those keys. And it is not permissible to modify the design of a page that is "delivered" with the product, such as the Console > Waves page. This means you can't modify the list of keys that the Console > Waves page considers, so you can't include any custom security key you make. Only "custom" pages created by users can have their design modified. This control was put in place to prevent custom changes from breaking important functionality in the "delivered" pages.

  1

Please sign in to leave a comment.