Visual Perspectives Permissions

bkonia

I'm having a problem with Visual Perspectives. I created a new Access Level called "Standard" and a new Visual Perspective, also called Standard. I want to restrict Standard users to only being able to use the Standard VP. However, I want Administrative users to be able to switch back and forth between the Administrative VP and the Standard VP.

To accomplish the above, I added a new menu item called "Standard Perspective" on the Administrator menu. On the Standard menu, I added a new item called "Admin Functions". Since the Standard Access Level does not have permissions to use the Administrator VP, my expectation was that the "Admin Functions" menu item would not appear on the menu when a Standard user is logged in. However, not only does the item appear on the menu, but a user with Standard Access Level is able to click on the Admin Functions menu item and switch to the Administrator VP.

After the Standard user switches to the Administrator VP, his access is still restricted to the objects that are granted to Standard users, but I don't want him to be able to view the Administrator VP at all. Therefore, I can only conclude that something is wrong with the Access Level system, because Standard users should not be able to switch to the Administrator VP.

aware_support2

> ... However, I want Administrative users to be able to switch back and forth between the Administrative VP and the Standard VP.

Do you want to do this so the administrator can see what the non-administrator users see?

bkonia

aware_support2 wrote
Do you want to do this so the administrator can see what the non-administrator users see?

Yes, I want the administrator to be able to switch back and forth between the administrative view and the normal user view.

aware_support2

A safe way for the administrator to see what normal users see is to logout and login as a normal user. If the administrator does not need to switch between the perspectives frequently, this would be the preferred option.

There are configuration elements other than the visual perspective that may be different between administrator and normal users. For example, you may want to configure different object forms to be used for the Standard access level. Another example is where normal users are represented by a different object (like Customer) and there are operations in the Standard visual perspective that use attributes of the logged-in user expecting it to be Customer.

If you want to implement the approach with switching visual perspectives, you can take a copy of the Standard visual perspective (using copy/paste in the Configuration Tool tree panel on left) and add the Admin Functions menu to it to switch to the Administrator perspective. Mark this new perspective as not being used automatically by the system for any access level. This way the normal users will not be able to see the Administrator perspective, and the Administrator will be able to switch to the Standard perspective copy and back.

bkonia

aware_support2 wrote
If you want to implement the approach with switching visual perspectives, you can take a copy of the Standard visual perspective (using copy/paste in the Configuration Tool tree panel on left) and add the Admin Functions menu to it to switch to the Administrator perspective. Mark this new perspective as not being used automatically by the system for any access level. This way the normal users will not be able to see the Administrator perspective, and the Administrator will be able to switch to the Standard perspective copy and back.

Kind of a clumsy workaround. If I later make changes to the Standard perspective, I would have to manually copy those changes over to the new perspective you described.

I don't understand why your permission system would allow a user to access a perspective that he has explicitly been denied access to. Isn't this a bug? For example, if I deny a user access to a particular Business Object or Query, this object will not appear on the user's menu, even if it's available in the perspective he's using. Therefore, the Switch Perspectives action should work the same way. If a user does not have permissions to access a perspective, the button for this perspective should not even appear in his menu.

aware_support2

Currently visual perspectives are not part of the access level control like objects or queries, but maybe they should be. At the moment the system can be told that it should automatically use a given visual perspective for a given access level. An access level may have access to multiple visual perspectives and users cannot be explicitly denied access to a visual perspective.

Thanks for your thoughts, we will review this issue.