Setting Up Discretionary Access Control Parameters

To set up parameters when discretionary access control is used, use the Discretionary Access Control tab on the Properties side panel in the web application and in the Access Control Settings dialog box in the desktop application.

Discretionary access control parameter settings can be used to determine actions of a user or a group of users to worj with an object.

The Groups or Users box displays a list of security subjects that have permissions to execute operations with objects. If the subject is selected in the Permissions or Permissions for Selected area in the desktop application, a list of access permissions by general operations (edit permissions, read, edit, delete) is displayed in the web application that can be separately changed for each security subject.

NOTE. Multiple selection of object classes is available to set up parameters on opening the Access Control Settings dialog box in the desktop application or on the Access Permissions side panel in the web application: After the permissions are determined, access permissions are set for each selected class object.

To add security subjects to the list, click the Add button. In the Select Groups and Users/Search Groups and Users dialog box that opens select users and/or groups.

After the security subject is added, determine its permissions in the Permissions or Permissions for Selected area by selecting checkboxes next to the selected operations. Checkboxes can be selected in the Allow and Deny columns. Prohibition operation has a higher priority.

Click the Delete button to delete a security subject.

NOTE. If object reading is prohibited for the user, this object is not displayed in the object navigator for this user and on the Consists Of or Included In desktop application tabs for the objects that use the current object or are used by this object. If the user is prohibited to execute some operations on objects, the corresponding menu items are unavailable in objects navigator for this user. For example, if the user does not have the Delete or Write permissions for object, the user does not see the Edit, Delete, or Cut menu items.

To set permissions for operations that are not displayed in the Permissions or Permissions for Selected list, click the Advanced or Show Full List of Operations button.

Set permissions for each selected security subject:

In the web application select the security subject in the Groups or Users box, set permissions for operations that must be allowed or denied in the Permissions for Selected list.
In the desktop application the Additional Security Parameters dialog box opens.

To distribute object permissions for child folders and objects:

Select the Replace Permissions for Folder Hierarchy and for Objects in Folders checkbox.
Click the OK button.

After a warning appears in the dialog box for viewing child object permissions, the specified permissions are displayed.

The Inherit Permissions from Parent Object or Inherit Permissions from Parent checkbox enables the object permission inheritance mode from parent object, after which object permissions become identical to parent object permissions. A parent object is a folder or a container object (for example, a modeling container, MDM dictionary, and so on) that contains an object.

NOTE. If the checkbox is selected, parent permissions, which differ from the child object permissions, are not shown in the dialog box for viewing child object permissions. To view inherited permissions, go to the Effective Permissions tab.

Dependent object permission setup enables the user to set up permissions to all objects used by this object or use this object.

To set up dependent object permissions:

In the web application click the Dependent Objects button on the toolbar and set up permissions.
In the desktop application:

Select the Set Up Dependent Object Permissions checkbox.
Click the OK button.

After executing the operations the Set Up Dependent Object Access Permissions dialog box opens.

NOTE. The dependent object permissions setup is available only for the selected object, on which other objects depend.

If the Access Control Settings dialog box in the desktop application is opened for a time series database, the Data Access Permissions button appears below the security subjects list:

To set up access permissions to time series database data, click the Data Access Permissions button for the selected security subject.

NOTE. Access permission setup to time series database is available only in the desktop application.