Rules for Finding Valid Permissions for Tables and Columns

When a system user is used to log into the system, the currently effective permissions for the objects are determined based on the permissions groups. The following rules are used to determine the resulting permissions:

• Permissions from hierarchical permissions groups are inherited from top to bottom. That means that a permissions group contains all the permissions belonging parent permissions groups.
• The number of objects is determined first for hierarchical permissions groups. Column permissions are decided afterwards. In some cases, this results in more permissions than are defined on individual permissions groups.
• A system user receives a permission when ar least one of its permissions groups has the permission (directly or inherited).
• The limiting permissions conditions for all the system user‘s permissions groups are grouped together and used to determine a valid condition for each permission for viewing, editing, inserting and deleting an object.
• Fixed viewing permissions for the database system files are granted by the system, which are sufficient for logging a system user into One Identity Manager tools.
• A system user with read-only permissions only obtains viewing permissions to objects irrespective of any other permissions.
• If permissions are granted on a table for inserting, editing or deleting, viewing permissions are implicit.
• If permissions are granted on a column for inserting, editing or deleting, viewing permissions are implicit.
• If permissions are granted for a table, then viewing permissions are implicitly granted on the primary key column of the table.
• If viewing permissions are granted on a primary key column as a minimum, then viewing permissions are implicitly granted for references table, the primary key column and the columns that are necessary on the referenced table for viewing according to the defined display pattern.
• Permissions for database views of type "proxy" are also valid for underlying tables.
• Database view of type "ReadOnly" only have viewing permissions irrespective of any other permissions.
• If a table or column is disabled due to preprocessor conditions, permissions are not determined for those tables and columns. The table or column is considered not to exist.
• If a permissions group is disabled due to preprocessor conditions, permissions are not taken into account for this permissions group. The permissions group is considered not to exist.

Example of Permissions Grouping using Permissions Groups

The following example shows how to group permissions if the user is directly assigned in permissions groups and the permissions groups are not connected hierarchically.

A system user obtains permissions to the table ADSAccount through different permissions groups.

In addition, it is granted permissions to the table LDAPAccount through these permissions groups.

Therefore, the system user has effectively the following permissions:

Example of Limiting Conditions

A system user obtains viewing permissions to the table Person through different permissions groups:

This results in the following permissions for the individual employee objects.

Working with the Permissions Editor

Working with the Permissions Editor

Use the Permissions Editor to grant permissions groups the permissions for accessing the tables and columns in the One Identity Manager’s schema. The editor is started from the program "Designer" and opens in the document view. Only additional Permissions Editor functions are described in the following.

Menu Items

The following items are added to the menu bar when the editor starts.

Table 121: Meaning of Toolbar Icons

Icon	Meaning
	Creates table or column permissions for the selected permissions group or system user.
	Deletes table or column permissions for the selected permissions group or system user.
	Refreshes permissions display.
	Copies table (column) permissions from the selected permissions group or system user.
	Inserts copied table (column) permissions into the selected permissions group.
	Copies all table (column) permissions from the selected permissions group.
	Inserts all copied table (column) permissions into the selected permissions group.
	Starts the wizard for defining custom filters. On completion the tables are shown according to the filter. For more information, see Using User Defined Filters for Searching.
	Sorts the view. Tables and columns with permissions are shown first.
	The display names of the columns and tables are shown. If the option is not enabled, the technical names according to the One Identity Manager schema are shown.
	Shows disabled tables.

Views in the Permissions Editor

Views in the Permissions Editor

The Permissions Editor has several views for displaying and editing access permissions for permissions groups.