Roles vs Permissions
So I have a group called DEVGroup that I put all our Development servers into.
I have a Role called DEVRole that has Permissions checked off for View, Add, and Edit of the DevGroup.
If I take a user and give him the DEVRole role, that seems like it should give him View, Add, and Edit Permissions to sessions in the DevGroup Security Group. However, this doesn't seem to work for me.
If I take the user and assign the View, Add, and Edit permissions directly to the user, then it works fine. If I assign the permissions to the Role and assign the Role to the User, then it doesn't seem to work.
Thanks.
All Comments (7)
Hello,
For that user, running File - My Data source information, then going in the roles tab. What do you see?
Best regards,
Maurice
I see:
Role Name, DevRole
Rights:View
DevGroup: View, Add, Edit
looks like you have two roles. Is this what you intended?
Maurice
I only have one role defined. It's called DevRole.
https://www.dropbox.com/s/c09yc3s8dfniz01/RDM_Role.jpg?dl=0
When I open it up and go to Permissions, the boxes are checked off for View, Add, and Edit of the Security Group called DevGroup.
https://www.dropbox.com/s/buwaje22ams2fxk/RDM_Role_Permissions.jpg?dl=0
When I Right-Click on an item that is assigned to the DevGroup group, I seem to only have View rights as Add, Edit, Properties, etc are grayed out
https://www.dropbox.com/s/l6ltixhxudfb49s/RDM_Role_Gray.png?dl=0
Here's the My Data Source Info section:
https://www.dropbox.com/s/e6dtale0vby5rjg/RDM_Role_DataSource.png?dl=0
I don't have any permissions assigned directly to the User as I want to simply add various users to the DevRole to get them access to the DevGroup. Is that not how it works?
ok, I see it now
Against SQL Server, the roles control the permissions against groups, but you need also to grant the corresponding rights.
The rights are what is used to grant/deny the appropriate permissions unto the tables. Therefore you need to ensure that the EDIT/DELETE rights are granted. This is why we restructured that form and named the tab accordingly.
Best regards,
Maurice
Ah, I see. So if they want to be able to edit anything they have to have the Edit box checked in the global rights area on the permissions tab for their User ID. Then we can limit that by checking or unchecking the various boxes for the Security Groups (for their User or for the Role they belong to).
exactly right.
Maurice
