(Record Level) Security Registry entry

Record Level Security provides control over who can do what to records on a per user and per group basis. At its simplest it is possible to set permissions to control who can:

1. View (Display) a record
2. Edit a record
3. Delete a record

However, by specifying additional criteria it is possible to refine these three standard security privileges. For example, it is possible to specify that:

• Records with a Record Status of Retired cannot be viewed by a certain group of users.

  Note: Any field in a module can be used to set conditions when applying Record Level Security.

• Only members of a department can edit and delete that department's records.

The Security Registry entry is used to refine the three standard Record Level Security permissions, Display, Edit, Delete, and to apply the special Insert permission.

It is worth stressing that a Security Registry refines the Display, Edit and Delete permissions that a user / group has to a record, it does not replace the necessity to add the user (or a group to which the user belongs) to the Security box on the Security tab for that record and to specify permissions in the Permissions box. In other words, a Security entry that gives a user / group the Edit permission to a record when Record Status is Active, is only effective if the user (or a relevant group to which the user belongs) has been added to the Security box on the Security tab for that record and the Edit checkbox is ticked.

Even if a Security Registry entry is added to allow members of group Managers to edit records in the Parties module when Record Status: (Access) = Active, members of group Managers will be unable to edit the following record:

It is necessary to add group Managers to the Security box and provide it with the Edit permission:

User	user	Table	table	Security	permission	value;value;...
User	user	Table	Default	Security	permission	value;value;...
Group	group	Table	table	Security	permission	value;value;...
Group	group	Table	Default	Security	permission	value;value;...
Group	Default	Table	table	Security	permission	value;value;...
Group	Default	Table	Default	Security	permission	value;value;...

An institution decides that all staff should be able to view every record in the Parties module, but only managers should be allowed to edit and delete staff records.

Suitable Registry entries are:

1.	Group Managers Table eparties Security Edit SecDepartment_tab=Personnel This entry specifies that members of group Managers are able to edit records in the Parties module when the Department field on the Security tab holds the value Personnel.
2.	Group Managers Table eparties Security Delete SecDepartment_tab=Personnel This entry specifies that members of group Managers are able to delete records in the Parties module when the Department field on the Security tab holds the value Personnel.
3.	Group Managers Table eparties Security Insert SecDepartment_tab=Personnel; SecCanDisplay=Group Default; SecCanDisplay=Group $group; SecCanEdit=Group $group; SecCanDelete=Group $group This entry specifies that when members of group Managers add a record to the Parties module, the Department field on the Security tab is populated with the value Personnel and permissions are set which allow everyone to view the record but only members of group Managers to edit and delete the record.

When these entries have been set in the Registry module, all that remains is to apply these settings to existing records in the Parties module:

1. In the Parties module, locate all staff records.
2. Add group Managers to the Security box on the Security tab and give the group Edit and Delete permissions.
3. Untick all but the Display permission for group Everyone.
4. Use the Set Record Security batch update tool to apply these settings to all staff records.
5. Use the Global Replace tool to insert the value Personnel in the Department field on the Security tab for all staff records.

   Now when Managers log in, they will have edit and delete permissions for these staff records; other users will be able to view them but not edit or delete them.

This Registry entry allows members of group Casual Staff to view records in the Parties module only when Record Status: (Access) = Active:

Key	Setting	Description
Key 1	Group
Key 2	Casual Staff
Key 3	Table
Key 4	eparties
Key 5	Security
Key 6	Display	Type of permission: Display, Edit, Delete, Insert.
Value	SecRecordStatus=Active	The condition that must be met for the permission to apply. In this case, if Record Status is set to Active, members of group Casual Staff will be able to view the record. If Record Status is anything other than Active, members of group Casual Staff will be unable to view the record. Note: Any field can be used to set a security permission. Multiple values (multiple conditions) can be set here.

In this example:

• Group Everyone can display and edit the following record in the Parties module.
• Record Status: (Access) is set to Active:

When a member of group Casual Staff logs in and searches for this record, the record is returned. The user has inherited the permissions of group Everyone (they can edit the record and are unable to delete it).

Note: It is not necessary to add group Casual Staff to the Security box as long as group Everyone is listed in the Security box: members of group Casual Staff inherit the permissions of any other group to which they belong, which by default includes group Everyone.

If Record Status: (Access) is changed from Active to Retired however and a member of group Casual Staff searches for this record, the record will not be located and they will receive the following message:

Even if group Casual Staff is added to the Security box for this record, members of the group will not be able to display the record while Record Status: (Access) is not set to Active:

Keep in mind that if we were to take away the Edit permission from group Everyone, group Casual Staff will also lose the ability to edit the record. In this case it would be necessary to add group Casual Staff to the Security box and assign them the Edit permission:

When members of group Managers add a new record to the Parties module, the Department field on the Security tab is automatically populated with the value Managers:

Key	Setting
Key 1	Group
Key 2	Managers
Key 3	Table
Key 4	eparties
Key 5	Security
Key 6	Insert
Value	SecDepartment_tab=Managers

The following entry not only inserts a value in the Department field when group Managers adds a record to the Parties module, it also specifies the security permissions for group Everyone and the current group (Managers) using the $group variable:

Key	Setting
Key 1	Group
Key 2	Managers
Key 3	Table
Key 4	eparties
Key 5	Security
Key 6	Insert
Value	SecDepartment_tab=Managers;SecCanDisplay=Group Default; SecCanDisplay=Group $group;SecCanEdit=Group $group;SecCanDelete=Group $group

When specifying an attachment field in a Security Registry entry, the value must be:

1. The field's Link Column name, not its column name.

   -AND-

2. A record's IRN.

For example, if referencing the Party: (Associated With) field in a Security Registry entry, we would use AssAssociationRef_tab and not AssAssociation_tab:

A suitable Security Registry entry referencing an attachment field would be:

Key	Setting
Key 1	Group
Key 2	Managers
Key 3	Table
Key 4	eparties
Key 5	Security
Key 6	Display
Value	AssAssociationRef_tab=6