Portal

Hi -

We are looking to enforce row-level security in our model.

Just to give more details:

We have users that belong to a certain ERP. We want to give permissions to users so that they can edit only rows/records that belong to their ERP System Code.

As you can see, the parent entity - Entity A , which is at product-ERP System Code level , has an ERP System Code. We intend to leverage that to ensure that a user is able to edit only records for the ERP System Code for which the user is assigned to.

We intend to create a role for each ERP System and assign users to these roles. Our plan is to use the 'Model Variables' to get the role assigned to a user and use that to know the ERP System Code that a user is allowed to make edits ( a table in schema which maps a role to ERP System code).

Our question:

a) Can we use the relationship between parent and child to enforce similar row-level security that even in Child Entity B & in Entity C, the user is restricted to modify only the child records of rows , which belong to ERP System code he is entitled to modify ?

Or do we need to add a field 'ERP System Code' in each of the Child entity too if we are looking to leverage ERP System Code value to enforce row level security ?

b) Will this approach  ( of model variables ) work even if a user is potentially assigned to multiple roles and hence has multiple ERP Codes whose rows he can modify ? 

To rephrase, can the model variable store more than one value and apply behind the scene , the conditions in that  Sqls as an IN statement rather.

Thanks for the help.  

Hi Bharat -

Thanks for the response . Very helpful indeed and we will look into it.

I have another question. 

While defining SemQL condition in filter of entity privileges - Is it possible to refer to a field of other entity ?

For example : 

Can I write something along below line - where I am restricting fields of a child based on IDs of parent ? The IDs of parent are restricted based on a condition. 

Thanks for your time again

Hi Bharat 

I think the answer is Yes.

I see that parent fields are available to expand and use