PDA

View Full Version : Using Groups to Restrict Report Access



rjswetzcpa
21-Jan-2015, 09:44 AM
Can anyone tell me what is the difference between user groups under Administration vs. Report Design (Under Main access design and rights)? We would like to restrict certain reports to certain user groups.

Bob Cergol
21-Jan-2015, 09:45 PM
User Groups under administration is where you maintain groups, i.e. create them and add/remove members. The purpose of these groups it three-fold:

1) to define who is allowed to see a report on a menu and run the report, or have the ability to run the report via a URL in case they don't see the menu.

2) to define what groups any given user who is allowed to save reports is then allowed to share that report with.

3) to define ownership of a report, i.e. who is allowed to change it's design.

In the user profile you determine what groups a user can share reports with.

In report design you can specify both the "user-group" the report is shared with and the "owner group". Both of these are set to either an individual user, defaults to the author of the report, or a group. Unless you share a report with a group then no other user will be able see or run the report, unless you shared ownership with a group. Ownership allows a user to modify that report.

So access to reports is completely restricted by default to the person who created the report. The report has to be shared with a group of users in order for members of that group to be able to see and/or run the report. In addition to that you can define who, if anyone, is allowed to modify that report by setting the owner group.

In case a report references other reports, i.e. as drill-down objects, or connected to filters as a selection list, then those reports must likewise be shared with the same, users who have access to the report, or they will get an error when attempting to run the report.

You may have notices an additional setting in report design called sub-sharing. This means that a person would need to be a member of both groups in order to run a report. The scenario is something like: The members of the financial group can see various accounting reports, but there is a subset of accounting reports that only financial executives are allowed to see. You can force subsharing so that if an executive is allowed to make a new report from an existing report, that report can only be shared with other executives and not all the members of the financial group.

It's all pretty simple, but the possible combinations of sharing, sub-sharing and ownership leads to a lot of combinations that can be confusing -- until you experiment with it.

The number one question/problem I'm get asked about on this subject is that just by making someone a member of a group does not mean that they will be able to share reports they make with that group. It just means they can see and run the report. In order for them to share modified or new reports with that group you must also give that user privileges to share with that group, and that you do in the user profile, not in the group maintenance under administration.

Regards,
Bob

rjswetzcpa
22-Jan-2015, 09:40 AM
Thank you Bob. We are having a problem with the groups in that the new user groups we create under Administration are not available in the drop down menus in Report Design "Main access and design rights."

Bob Cergol
22-Jan-2015, 09:54 AM
Exactly. That's the #1 question I get that I was referring to.
You have to add that group to the user's share privileges and you can only do that in the user profile screen.

8604