Has anyone accomplished this? Row-level is no problem, but permission to fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to "Assignee Group"
3) Open an existing record from the form, and populate the A-field with a single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this should be possible?

Thanks,
Kenny Young
Remedy IT Support
******************************************************************************************
The information contained in this message, including attachments, may contain
privileged or confidential information that is intended to be delivered only to the
person identified above. If you are not the intended recipient, or the person
responsible for delivering this message to the intended recipient, ALLTEL requests
that you immediately notify the sender and asks that you do not read the message or its
attachments, and that you delete them without copying or sending them to anyone else.

Have You checked permisson for field 1? User must not belong to any group
with access to field 1, but give assignee group access, hope I understand
correctly.

L ars Pettersson
Vattenfall Data AB
ARS Systems Engineer
S-461 88 Trollhattan
Sweden

Phone +46 520 888 35 Mobil +46 70 608 99 95
e-mail: lars.j.pettersson@vattenfall.com
www.vattenfall.se



-----Ursprungligt meddelande-----
Fran: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Skickat: den 23 mars 2004 18:31
Till: ARSLIST@ARSLIST.ORG
Amne: "Assignee Group" permission to control field (not row) access


Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
****************************************************************************
**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com

If user is not permitted to field 1 in any way, then he will not be able to access the record at all, correct? I need him to see the record, just not field "B" (in my example) for that record.

Thanks,
kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of
lars.j.pettersson@VATTENFALL.COM
Sent: Tuesday, March 23, 2004 11:55 AM
To: ARSLIST@ARSLIST.ORG
Subject: SV: "Assignee Group" permission to control field (not row)
access


Have You checked permisson for field 1? User must not belong to any group
with access to field 1, but give assignee group access, hope I understand
correctly.

L ars Pettersson
Vattenfall Data AB
ARS Systems Engineer
S-461 88 Trollhattan
Sweden

Phone +46 520 888 35 Mobil +46 70 608 99 95
e-mail: lars.j.pettersson@vattenfall.com
www.vattenfall.se



-----Ursprungligt meddelande-----
Fran: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Skickat: den 23 mars 2004 18:31
Till: ARSLIST@ARSLIST.ORG
Amne: "Assignee Group" permission to control field (not row) access


Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
****************************************************************************
**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com



******************************************************************************************
The information contained in this message, including attachments, may contain
privileged or confidential information that is intended to be delivered only to the
person identified above. If you are not the intended recipient, or the person
responsible for delivering this message to the intended recipient, ALLTEL requests
that you immediately notify the sender and asks that you do not read the message or its
attachments, and that you delete them without copying or sending them to anyone else.

Kenny,
I am not sure why I think this... but give it a shot.... Add
"Assignee Group" to field 1.
For some reason I have this nagging feeling that if the group is not
on field 1 then ARS just ignores the permission group all together on the
rest of the fields. (I might be very wrong about this... Like I said.. it
is just a nagging feeling.)


Other than that...
Make sure that the user does not gain access to Field B through any
other group. (Like Public, or some other static group.)
ARS Permission's are cumulative. If any group grants access, then the
rest do not matter. The user will be granted access. So the only way that a
user does not get access to the field is if ALL groups they are a member of
do not have access to the field.

HTH.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"
LTEL.COM> cc:
Sent by: "Action Subject: Re: "Assignee Group" permission to control field (not row) access
Request System
discussion
list(ARSList)"
ORG>


03/23/2004 12:13
PM
Please respond to
arslist






If user is not permitted to field 1 in any way, then he will not be able to
access the record at all, correct? I need him to see the record, just not
field "B" (in my example) for that record.

Thanks,
kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of
lars.j.pettersson@VATTENFALL.COM
Sent: Tuesday, March 23, 2004 11:55 AM
To: ARSLIST@ARSLIST.ORG
Subject: SV: "Assignee Group" permission to control field (not row)
access


Have You checked permisson for field 1? User must not belong to any group
with access to field 1, but give assignee group access, hope I understand
correctly.

L ars Pettersson
Vattenfall Data AB
ARS Systems Engineer
S-461 88 Trollhattan
Sweden

Phone +46 520 888 35 Mobil +46 70 608 99 95
e-mail: lars.j.pettersson@vattenfall.com
www.vattenfall.se

-----Ursprungligt meddelande-----
Fran: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Skickat: den 23 mars 2004 18:31
Till: ARSLIST@ARSLIST.ORG
Amne: "Assignee Group" permission to control field (not row) access


Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
****************************************************************************

**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.




UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
******************************************************************************************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com

Personally I haven't tried it. Whenever I use reserved field 112 its in
conjuction with reserved field 240000006. If you haven't yet completed the
experiment..try adding the Assigned to Group+ field (240000006) and seeing
if having both creates the desired effect. I'm curious now if there is a
dependecy on 240000006.




Kenny Young
LTEL.COM> To
Sent by: "Action ARSLIST@ARSLIST.ORG
Request System cc
discussion
list(ARSList)" Subject
ORG> control field (not row) access


03/23/2004 12:30
PM


Please respond to
arslist@ARSLIST.O
RG






Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
******************************************************************************************

The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com

Thanks for the several responses on this inquiry so far. Here is what I have discovered:

A. As Carey suggested, Field ID 1 does have to have Assignee Group permissions.
B. This special permission does not prevent visibility of the field, only absence of the data associated with that field (thanks Lars!)

I have two conflicting thoughts regarding B. One is that it is logical, as you don't want to hide the field, because the very next record could be something that the user does have access to the field data for. The second is that the situation is restrictive because it means I can never use the Assignee Group permission on a field if there are any other users who simply should not see the field at all...I am arguing that this second part may be a bug with Remedy currently.

Thanks,
Kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of Carey Matthew Black
Sent: Tuesday, March 23, 2004 12:49 PM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Kenny,
I am not sure why I think this... but give it a shot.... Add
"Assignee Group" to field 1.
For some reason I have this nagging feeling that if the group is not
on field 1 then ARS just ignores the permission group all together on the
rest of the fields. (I might be very wrong about this... Like I said.. it
is just a nagging feeling.)


Other than that...
Make sure that the user does not gain access to Field B through any
other group. (Like Public, or some other static group.)
ARS Permission's are cumulative. If any group grants access, then the
rest do not matter. The user will be granted access. So the only way that a
user does not get access to the field is if ALL groups they are a member of
do not have access to the field.

HTH.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"
LTEL.COM> cc:
Sent by: "Action Subject: Re: "Assignee Group" permission to control field (not row) access
Request System
discussion
list(ARSList)"
ORG>


03/23/2004 12:13
PM
Please respond to
arslist






If user is not permitted to field 1 in any way, then he will not be able to
access the record at all, correct? I need him to see the record, just not
field "B" (in my example) for that record.

Thanks,
kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of
lars.j.pettersson@VATTENFALL.COM
Sent: Tuesday, March 23, 2004 11:55 AM
To: ARSLIST@ARSLIST.ORG
Subject: SV: "Assignee Group" permission to control field (not row)
access


Have You checked permisson for field 1? User must not belong to any group
with access to field 1, but give assignee group access, hope I understand
correctly.

L ars Pettersson
Vattenfall Data AB
ARS Systems Engineer
S-461 88 Trollhattan
Sweden

Phone +46 520 888 35 Mobil +46 70 608 99 95
e-mail: lars.j.pettersson@vattenfall.com
www.vattenfall.se

-----Ursprungligt meddelande-----
Fran: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Skickat: den 23 mars 2004 18:31
Till: ARSLIST@ARSLIST.ORG
Amne: "Assignee Group" permission to control field (not row) access


Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
****************************************************************************

**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.




UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
******************************************************************************************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com






******************************************************************************************
The information contained in this message, including attachments, may contain
privileged or confidential information that is intended to be delivered only to the
person identified above. If you are not the intended recipient, or the person
responsible for delivering this message to the intended recipient, ALLTEL requests
that you immediately notify the sender and asks that you do not read the message or its
attachments, and that you delete them without copying or sending them to anyone else.

Hi Kenny

>I have two conflicting thoughts regarding B. One is that it is logical,
as you don't want to hide the field, because the very next record could be
something that the user does have access to the field data for. The second
is that the situation is restrictive because it means I can never use the
Assignee Group permission on a field if there are any other users who
simply should not see the field at all...I am arguing that this second part
may be a bug with Remedy currently.

That is no bug I think. The indirect permissions via Submitter, Assignee
and Assignee Group will only protect data not fields at all.

If you have no (direct) Permisson to a field your Client (AR User or any
API Client) will not know about this field at all. It is not in your cache
files and it is not accessable for reporting at all.

But with indirect permission you have general access to this field, because
it depands on the value in the field 112. The check to the access to the
data is done on the server, that is why indirect permissions means security.
To hide a field or change to read only are only display properties!

I think indirect permissions are designed to give row level access to
requests or write access to some fields (with more general direct read
permissions). So the combination of direct and indirect permissions will
give you any permissions you want.

But Indirect read/write permissions without any direct permissions are
usefull for personal fields like password. You need access to this field,
but only to your own data.

Best Regards
Christoph

Dear Kenney


IF I understood well, You need to give a visibility for a field to particuler group (id say nnnn).

You cav achive this by using 2 AL

AL1
set field
ztmp1 := $PROCESS$ @@:Application-Confirm-Group nnnn // this has a 0 or 1 as out put. ztmp1 is a integer, display only field

AL2
ztmp1=1 then change field permossion/Visibility


Note: "Assignee Group" permission is a row level permission and can be used to control the visibility of records as whole not a field in records.


--------------------------------------------------------
Best Regards

Abdul Ghani M Farooque
Sabic Services Limited,
2nd Floor West, SABIC Bldg, Jubail, Saudi Arabia
Tel: +966 3 345 2865 Fax: +966 3 347-0631
Mob:+966 5444 7826
--------------------------------------------------------


-----Original Message-----
From: Carey Matthew Black [mailto:matt.black@VERIZON.COM]
Sent: Tue, March 23, 2004 9:49 PM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Kenny,
I am not sure why I think this... but give it a shot.... Add
"Assignee Group" to field 1.
For some reason I have this nagging feeling that if the group is not
on field 1 then ARS just ignores the permission group all together on the
rest of the fields. (I might be very wrong about this... Like I said.. it
is just a nagging feeling.)


Other than that...
Make sure that the user does not gain access to Field B through any
other group. (Like Public, or some other static group.)
ARS Permission's are cumulative. If any group grants access, then the
rest do not matter. The user will be granted access. So the only way that a
user does not get access to the field is if ALL groups they are a member of
do not have access to the field.

HTH.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"
LTEL.COM> cc:
Sent by: "Action Subject: Re: "Assignee Group" permission to control field (not row) access
Request System
discussion
list(ARSList)"
ORG>


03/23/2004 12:13
PM
Please respond to
arslist






If user is not permitted to field 1 in any way, then he will not be able to
access the record at all, correct? I need him to see the record, just not
field "B" (in my example) for that record.

Thanks,
kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of
lars.j.pettersson@VATTENFALL.COM
Sent: Tuesday, March 23, 2004 11:55 AM
To: ARSLIST@ARSLIST.ORG
Subject: SV: "Assignee Group" permission to control field (not row)
access


Have You checked permisson for field 1? User must not belong to any group
with access to field 1, but give assignee group access, hope I understand
correctly.

L ars Pettersson
Vattenfall Data AB
ARS Systems Engineer
S-461 88 Trollhattan
Sweden

Phone +46 520 888 35 Mobil +46 70 608 99 95
e-mail: lars.j.pettersson@vattenfall.com
www.vattenfall.se

-----Ursprungligt meddelande-----
Fran: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Skickat: den 23 mars 2004 18:31
Till: ARSLIST@ARSLIST.ORG
Amne: "Assignee Group" permission to control field (not row) access


Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
****************************************************************************

**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.




UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
******************************************************************************************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com

Kenny,
Is there some way that you can identify a person who "simply should
not see the field at all"? If so then you could build workflow to hide the
field for those users. (on those data rows) Something like a Window Open
Active Link should do the job nicely.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"
LTEL.COM> cc:
Sent by: "Action Subject: Re: "Assignee Group" permission to control field (not row) access
Request System
discussion
list(ARSList)"
ORG>


03/23/2004 07:42
PM
Please respond to
arslist






Thanks for the several responses on this inquiry so far. Here is what I
have discovered:

A. As Carey suggested, Field ID 1 does have to have Assignee Group
permissions.
B. This special permission does not prevent visibility of the field, only
absence of the data associated with that field (thanks Lars!)

I have two conflicting thoughts regarding B. One is that it is logical, as
you don't want to hide the field, because the very next record could be
something that the user does have access to the field data for. The second
is that the situation is restrictive because it means I can never use the
Assignee Group permission on a field if there are any other users who
simply should not see the field at all...I am arguing that this second part
may be a bug with Remedy currently.

Thanks,
Kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of Carey Matthew Black
Sent: Tuesday, March 23, 2004 12:49 PM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Kenny,
I am not sure why I think this... but give it a shot.... Add
"Assignee Group" to field 1.
For some reason I have this nagging feeling that if the group is not
on field 1 then ARS just ignores the permission group all together on the
rest of the fields. (I might be very wrong about this... Like I said.. it
is just a nagging feeling.)


Other than that...
Make sure that the user does not gain access to Field B through any
other group. (Like Public, or some other static group.)
ARS Permission's are cumulative. If any group grants access, then the
rest do not matter. The user will be granted access. So the only way that a
user does not get access to the field is if ALL groups they are a member of
do not have access to the field.

HTH.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"

ARSLIST@ARSLIST.ORG

LTEL.COM> cc:

Sent by: "Action Subject: Re: "Assignee
Group" permission to control field (not row) access
Request System

discussion

list(ARSList)"


ORG>



03/23/2004 12:13

PM

Please respond to

arslist







If user is not permitted to field 1 in any way, then he will not be able to
access the record at all, correct? I need him to see the record, just not
field "B" (in my example) for that record.

Thanks,
kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of
lars.j.pettersson@VATTENFALL.COM
Sent: Tuesday, March 23, 2004 11:55 AM
To: ARSLIST@ARSLIST.ORG
Subject: SV: "Assignee Group" permission to control field (not row)
access


Have You checked permisson for field 1? User must not belong to any group
with access to field 1, but give assignee group access, hope I understand
correctly.

L ars Pettersson
Vattenfall Data AB
ARS Systems Engineer
S-461 88 Trollhattan
Sweden

Phone +46 520 888 35 Mobil +46 70 608 99 95
e-mail: lars.j.pettersson@vattenfall.com
www.vattenfall.se

-----Ursprungligt meddelande-----
Fran: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Skickat: den 23 mars 2004 18:31
Till: ARSLIST@ARSLIST.ORG
Amne: "Assignee Group" permission to control field (not row) access


Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
****************************************************************************


**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.





UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com




UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
******************************************************************************************

The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.




UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com






UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
******************************************************************************************

The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com

Thanks for the continued responses. I often use purely workflow to accomplish the desired restrictions, but envisioned considerably less work if the Assignee Group thing worked the way I thought it would.

By the way, the description of my bug has changed a bit, and would like to know if anyone else has seen this behavior, and if you agree that surely it is not intended:

1) Assume form already exists with field id 112, and that "Assignee Group" permission is granted to field id 1
2) Create 2 new field B, and C
3) Apply only "Assignee Group" write permission to field B
4) Apply only "Public" read permission to field C
5) Create record and set field 112 to "Example Group"
6) Log in as user with membership in "Example Group" and NO membership in Administrator.
7) Access existing record
8) Update field C and save

...which you will be able to do with no errors or warning!

Thanks,
Kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of Carey Matthew Black
Sent: Wednesday, March 24, 2004 9:39 AM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Kenny,
Is there some way that you can identify a person who "simply should
not see the field at all"? If so then you could build workflow to hide the
field for those users. (on those data rows) Something like a Window Open
Active Link should do the job nicely.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"
LTEL.COM> cc:
Sent by: "Action Subject: Re: "Assignee Group" permission to control field (not row) access
Request System
discussion
list(ARSList)"
ORG>


03/23/2004 07:42
PM
Please respond to
arslist






Thanks for the several responses on this inquiry so far. Here is what I
have discovered:

A. As Carey suggested, Field ID 1 does have to have Assignee Group
permissions.
B. This special permission does not prevent visibility of the field, only
absence of the data associated with that field (thanks Lars!)

I have two conflicting thoughts regarding B. One is that it is logical, as
you don't want to hide the field, because the very next record could be
something that the user does have access to the field data for. The second
is that the situation is restrictive because it means I can never use the
Assignee Group permission on a field if there are any other users who
simply should not see the field at all...I am arguing that this second part
may be a bug with Remedy currently.

Thanks,
Kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of Carey Matthew Black
Sent: Tuesday, March 23, 2004 12:49 PM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Kenny,
I am not sure why I think this... but give it a shot.... Add
"Assignee Group" to field 1.
For some reason I have this nagging feeling that if the group is not
on field 1 then ARS just ignores the permission group all together on the
rest of the fields. (I might be very wrong about this... Like I said.. it
is just a nagging feeling.)


Other than that...
Make sure that the user does not gain access to Field B through any
other group. (Like Public, or some other static group.)
ARS Permission's are cumulative. If any group grants access, then the
rest do not matter. The user will be granted access. So the only way that a
user does not get access to the field is if ALL groups they are a member of
do not have access to the field.

HTH.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"

ARSLIST@ARSLIST.ORG

LTEL.COM> cc:

Sent by: "Action Subject: Re: "Assignee
Group" permission to control field (not row) access
Request System

discussion

list(ARSList)"


ORG>



03/23/2004 12:13

PM

Please respond to

arslist







If user is not permitted to field 1 in any way, then he will not be able to
access the record at all, correct? I need him to see the record, just not
field "B" (in my example) for that record.

Thanks,
kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of
lars.j.pettersson@VATTENFALL.COM
Sent: Tuesday, March 23, 2004 11:55 AM
To: ARSLIST@ARSLIST.ORG
Subject: SV: "Assignee Group" permission to control field (not row)
access


Have You checked permisson for field 1? User must not belong to any group
with access to field 1, but give assignee group access, hope I understand
correctly.

L ars Pettersson
Vattenfall Data AB
ARS Systems Engineer
S-461 88 Trollhattan
Sweden

Phone +46 520 888 35 Mobil +46 70 608 99 95
e-mail: lars.j.pettersson@vattenfall.com
www.vattenfall.se

-----Ursprungligt meddelande-----
Fran: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Skickat: den 23 mars 2004 18:31
Till: ARSLIST@ARSLIST.ORG
Amne: "Assignee Group" permission to control field (not row) access


Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
****************************************************************************


**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.





UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com




UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
******************************************************************************************

The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.




UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com






UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
******************************************************************************************

The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com






******************************************************************************************
The information contained in this message, including attachments, may contain
privileged or confidential information that is intended to be delivered only to the
person identified above. If you are not the intended recipient, or the person
responsible for delivering this message to the intended recipient, ALLTEL requests
that you immediately notify the sender and asks that you do not read the message or its
attachments, and that you delete them without copying or sending them to anyone else.

Hi Kenny

It was always my understanding that field 112 Assignee Group was designed to
control access to table rows only, not to change permissions on a per field
basis. It seems to me that you are trying to use it in a way that it was
not designed for. Just IMHO

David Sanders
Remedy Consultant
==============

tel +44 1494 468980
mobile +44 7710 377761
email david.sanders@westoversonsulting.co.uk


web http://www.westoverconsulting.co.uk



-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of Kenny Young
Sent: Wednesday, March 24, 2004 7:06 PM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Thanks for the continued responses. I often use purely workflow to
accomplish the desired restrictions, but envisioned considerably less work
if the Assignee Group thing worked the way I thought it would.

By the way, the description of my bug has changed a bit, and would like to
know if anyone else has seen this behavior, and if you agree that surely it
is not intended:

1) Assume form already exists with field id 112, and that "Assignee Group"
permission is granted to field id 1
2) Create 2 new field B, and C
3) Apply only "Assignee Group" write permission to field B
4) Apply only "Public" read permission to field C
5) Create record and set field 112 to "Example Group"
6) Log in as user with membership in "Example Group" and NO membership in
Administrator.
7) Access existing record
8) Update field C and save

...which you will be able to do with no errors or warning!

Thanks,
Kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of Carey Matthew Black
Sent: Wednesday, March 24, 2004 9:39 AM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Kenny,
Is there some way that you can identify a person who "simply should
not see the field at all"? If so then you could build workflow to hide the
field for those users. (on those data rows) Something like a Window Open
Active Link should do the job nicely.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"
LTEL.COM> cc:
Sent by: "Action Subject: Re: "Assignee
Group" permission to control field (not row) access
Request System
discussion
list(ARSList)"
ORG>


03/23/2004 07:42
PM
Please respond to
arslist






Thanks for the several responses on this inquiry so far. Here is what I
have discovered:

A. As Carey suggested, Field ID 1 does have to have Assignee Group
permissions.
B. This special permission does not prevent visibility of the field, only
absence of the data associated with that field (thanks Lars!)

I have two conflicting thoughts regarding B. One is that it is logical, as
you don't want to hide the field, because the very next record could be
something that the user does have access to the field data for. The second
is that the situation is restrictive because it means I can never use the
Assignee Group permission on a field if there are any other users who
simply should not see the field at all...I am arguing that this second part
may be a bug with Remedy currently.

Thanks,
Kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of Carey Matthew Black
Sent: Tuesday, March 23, 2004 12:49 PM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Kenny,
I am not sure why I think this... but give it a shot.... Add
"Assignee Group" to field 1.
For some reason I have this nagging feeling that if the group is not
on field 1 then ARS just ignores the permission group all together on the
rest of the fields. (I might be very wrong about this... Like I said.. it
is just a nagging feeling.)


Other than that...
Make sure that the user does not gain access to Field B through any
other group. (Like Public, or some other static group.)
ARS Permission's are cumulative. If any group grants access, then the
rest do not matter. The user will be granted access. So the only way that a
user does not get access to the field is if ALL groups they are a member of
do not have access to the field.

HTH.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"

ARSLIST@ARSLIST.ORG

LTEL.COM> cc:

Sent by: "Action Subject: Re: "Assignee
Group" permission to control field (not row) access
Request System

discussion

list(ARSList)"


ORG>



03/23/2004 12:13

PM

Please respond to

arslist







If user is not permitted to field 1 in any way, then he will not be able to
access the record at all, correct? I need him to see the record, just not
field "B" (in my example) for that record.

Thanks,
kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of
lars.j.pettersson@VATTENFALL.COM
Sent: Tuesday, March 23, 2004 11:55 AM
To: ARSLIST@ARSLIST.ORG
Subject: SV: "Assignee Group" permission to control field (not row)
access


Have You checked permisson for field 1? User must not belong to any group
with access to field 1, but give assignee group access, hope I understand
correctly.

L ars Pettersson
Vattenfall Data AB
ARS Systems Engineer
S-461 88 Trollhattan
Sweden

Phone +46 520 888 35 Mobil +46 70 608 99 95
e-mail: lars.j.pettersson@vattenfall.com
www.vattenfall.se

-----Ursprungligt meddelande-----
Fran: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Skickat: den 23 mars 2004 18:31
Till: ARSLIST@ARSLIST.ORG
Amne: "Assignee Group" permission to control field (not row) access


Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
****************************************************************************


**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.





UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com





UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
****************************************************************************
**************

The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.





UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com







UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
****************************************************************************
**************

The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.




UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com






UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
****************************************************************************
**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com

I believe that granting permission to field id 1 essentially grants
permission to the entire record. If you wanted to prevent Example Group from
updating field C, then you would need to explicitly define View permission.

-Howard

-----Original Message-----
From: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Sent: Wednesday, March 24, 2004 8:06 PM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Thanks for the continued responses. I often use purely workflow to
accomplish the desired restrictions, but envisioned considerably less work
if the Assignee Group thing worked the way I thought it would.

By the way, the description of my bug has changed a bit, and would like to
know if anyone else has seen this behavior, and if you agree that surely it
is not intended:

1) Assume form already exists with field id 112, and that "Assignee Group"
permission is granted to field id 1
2) Create 2 new field B, and C
3) Apply only "Assignee Group" write permission to field B
4) Apply only "Public" read permission to field C
5) Create record and set field 112 to "Example Group"
6) Log in as user with membership in "Example Group" and NO membership in
Administrator.
7) Access existing record
8) Update field C and save

...which you will be able to do with no errors or warning!

Thanks,
Kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of Carey Matthew Black
Sent: Wednesday, March 24, 2004 9:39 AM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Kenny,
Is there some way that you can identify a person who "simply should
not see the field at all"? If so then you could build workflow to hide the
field for those users. (on those data rows) Something like a Window Open
Active Link should do the job nicely.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.




"Kenny Young"


LTEL.COM> cc:

Sent by: "Action Subject: Re: "Assignee
Group" permission to control field (not row) access
Request System

discussion

list(ARSList)"


ORG>





03/23/2004 07:42

PM

Please respond to

arslist









Thanks for the several responses on this inquiry so far. Here is what I
have discovered:

A. As Carey suggested, Field ID 1 does have to have Assignee Group
permissions.
B. This special permission does not prevent visibility of the field, only
absence of the data associated with that field (thanks Lars!)

I have two conflicting thoughts regarding B. One is that it is logical, as
you don't want to hide the field, because the very next record could be
something that the user does have access to the field data for. The second
is that the situation is restrictive because it means I can never use the
Assignee Group permission on a field if there are any other users who
simply should not see the field at all...I am arguing that this second part
may be a bug with Remedy currently.

Thanks,
Kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of Carey Matthew Black
Sent: Tuesday, March 23, 2004 12:49 PM
To: ARSLIST@ARSLIST.ORG
Subject: Re: "Assignee Group" permission to control field (not row)
access


Kenny,
I am not sure why I think this... but give it a shot.... Add
"Assignee Group" to field 1.
For some reason I have this nagging feeling that if the group is not
on field 1 then ARS just ignores the permission group all together on the
rest of the fields. (I might be very wrong about this... Like I said.. it
is just a nagging feeling.)


Other than that...
Make sure that the user does not gain access to Field B through any
other group. (Like Public, or some other static group.)
ARS Permission's are cumulative. If any group grants access, then the
rest do not matter. The user will be granted access. So the only way that a
user does not get access to the field is if ALL groups they are a member of
do not have access to the field.

HTH.

--
Carey Matthew Black
Remedy Skilled Professional (RSP)
ARS = Action Request System(Remedy)

Solution = People + Process + Tools
Fast, Accurate, Cheap.... Pick two.
Never ascribe to malice, that which can be explained by incompetence.



"Kenny Young"

ARSLIST@ARSLIST.ORG

LTEL.COM> cc:

Sent by: "Action Subject: Re: "Assignee
Group" permission to control field (not row) access
Request System

discussion

list(ARSList)"


ORG>



03/23/2004 12:13

PM

Please respond to

arslist







If user is not permitted to field 1 in any way, then he will not be able to
access the record at all, correct? I need him to see the record, just not
field "B" (in my example) for that record.

Thanks,
kenny

-----Original Message-----
From: Action Request System discussion list(ARSList)
[mailto:ARSLIST@ARSLIST.ORG]On Behalf Of
lars.j.pettersson@VATTENFALL.COM
Sent: Tuesday, March 23, 2004 11:55 AM
To: ARSLIST@ARSLIST.ORG
Subject: SV: "Assignee Group" permission to control field (not row)
access


Have You checked permisson for field 1? User must not belong to any group
with access to field 1, but give assignee group access, hope I understand
correctly.

L ars Pettersson
Vattenfall Data AB
ARS Systems Engineer
S-461 88 Trollhattan
Sweden

Phone +46 520 888 35 Mobil +46 70 608 99 95
e-mail: lars.j.pettersson@vattenfall.com
www.vattenfall.se

-----Ursprungligt meddelande-----
Fran: Kenny Young [mailto:Kenneth.Young@ALLTEL.COM]
Skickat: den 23 mars 2004 18:31
Till: ARSLIST@ARSLIST.ORG
Amne: "Assignee Group" permission to control field (not row) access


Has anyone accomplished this? Row-level is no problem, but permission to
fields is not working correctly.

Here is my experiment:

1) Create field A (w/ field id 112) on form
2) Create another char field (B), and grant view permission only to
"Assignee Group"
3) Open an existing record from the form, and populate the A-field with a
single specific group, using the menu attached to the field

4) Log in to Remedy as a user without admin permissions, and without
membership in the group specified in the A-field of the subject record
5) Open form, search by id for the record
6) Record is displayed, and field B is also visible (shouldn't be)

Where might I be going wrong? Am I correct in understanding that this
should be possible?

Thanks,
Kenny Young
Remedy IT Support
****************************************************************************


**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.





UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com





UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
****************************************************************************
**************

The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.





UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com







UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
****************************************************************************
**************

The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered
only to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.




UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com






UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com
****************************************************************************
**************
The information contained in this message, including attachments, may
contain
privileged or confidential information that is intended to be delivered only
to the
person identified above. If you are not the intended recipient, or the
person
responsible for delivering this message to the intended recipient, ALLTEL
requests
that you immediately notify the sender and asks that you do not read the
message or its
attachments, and that you delete them without copying or sending them to
anyone else.



UNSUBSCRIBE or access ARSList Archives at http://www.ARSLIST.org (Support:
mailto:support@arslist.org ) ARSList is hosted by QMX SUPPORT SERVICES at
www.QMXS.com

Hi Kenny

Was not able to reconstruct your testcase.

Just tried this one:

1) Create new Form
2) Add 112 Field to Form
3) No changes to Request ID Permissions (Read Permissions for Public,
Submitter and Assignee)
4) Change Permissions of status field to read Public only
5) Change Permissions of short description to write Assignee Group only
6) Change Permissions of Assignee Group to write Submitter only
7) Set Default Values for short description and Submitter
8) Login with Group1 Permissons only, both fields are visible
9) Submit two Requests with :
Request1: Assignee Group = Group1
Request2: Assignee Group = Group2
10)
Change Request 1 short description (write Group1) => without error
Change Request 1 status (read public) => error no write permissons
Change Request 2 short description (write Group2) => error no write
permissons
Change Request 2 status (read public)=> error no write permissons


For me that works as designed.

Best Regards
Christoph