Permissions – introduction
The concept of permissions
Permissions Screen
The permissions shown above are the window used by administrators to manage roles. There are module and data access roles:
1. access roles to modules (MDL) are used to control general access to modules, i.e.:
- visibility and permissions of key modules and system functionalities
2. access to data (DS) roles are used to control access to specific records, i.e.:
- visibility and permissions of data records depending on the settings: my data/my employees/all
The created roles are used when creating/editing specific users in the administration panel in the window -> USERS.
User Edit
One or more roles of each type may be assigned to a user and they have a joint nature (authorities are added up).
To sum up, roles allow for flexible control of access to modules, functionalities and data for a given user.
Administrators can check how assigned roles work together by using the Effective permissions panel in user administration. The panel shows actual access resulting from the combination of MDL roles, DS roles and additional security rules.
More information about user management can be found here: Users
Permission for effective access analysis
Access to the Effective permissions panel is controlled by a separate permission in the user administration area. It should be granted only to administrators who are expected to analyze the actual access of other users.
After the permission is granted, the administrator can:
- run the analysis from the user menu or user edit form,
- view a summary of module and record access,
- check the sources of specific actions, such as an MDL role or DS role,
- review warnings about broad or unusual access scopes.
Running the analysis and fetching records may be recorded in system logs/audit, so this permission should be treated as administrative and granted according to the least-access principle.
Module functionalities
⚠️Note: Self-Create/Edit options are ONLY available for eFOB Enterprise e-Folders packages.
Functionalities of the permissions management screen
1. Adding – adding a new role
2. Actions allow you to edit, duplicate or deactivate roles.
a) Editing a record – allows you to adjust the permissions of a given role, as well as its name. It is done using drop-down lists in which we select and deselect the records we are interested in. To accept the changes, finally use the green SAVE button at the very bottom of the screen.
b) Duplicate – creation/duplication of a new role based on the selected record
c) Deactivate – hide the record. The record can be redisplayed using the filter from point 3, and then be edited, duplicated, or activated
3. Status filter – display active or inactive roles