About users and groups

Group authorizations

When you create a new user profile, perhaps the easiest way to assign authorizations and permissions to that user is by assigning the user to one or more user groups. This is done using the Users form, when you create the user profile.

Several default groups are already set up and delivered in the application; for example, the CoreFormsAdmin and the APPBUILDER-Administrator group. To modify the forms and permissions for an existing group, select the group on the Groups form and click Group Authorizations to open the Object Authorization for Group form.

You can add or delete groups using the Groups form.

Caution:

Although the system allows you to modify or delete default groups that are provided with your application, doing so can cause future conversion problems while upgrading, and possibly other problems. We recommend you copy the the default group and give it a new group name, then modify the new group authorizations. We strongly recommend that you NOT delete or modify the original default groups.

User authorizations by copying another user's goups

When you create a new user profile, you can copy the user's group memberships from an existing user. On the Users form, select the user who needs to add groups, and click Copy Groups from User. On the Copy Groups From User form, select the user from whom you want to copy the groups. If multiple groups are listed, you can select the groups that you want to copy to this user. To return to the Users form, click OK. Then save the changes to the new user's record there.

User authorizations

If a user is not assigned to any group, use the Object Authorizations for User form to determine what forms and privileges are available to that user.

How authorizations work together

User groups allow you to determine the authorizations and permissions for multiple users by assigning them all to a single group.

Group authorizations work together. If a user is included in a group where a privilege is granted on a certain form, that granted privilege prevails over any "not granted" setting for the same form in other groups assigned to this user. However, any user authorizations set for individuals always override group authorizations defined for a form.

At the user authorizations level (Object Authorizations for User form), privileges are either granted or revoked. There is only one set of privileges per form or per component per user. Therefore, if a privilege is revoked at the user authorizations level, the same privilege, if granted, at the group authorizations level (on the Object Authorizations for Group form) is not honored.

User authorizations cannot have multiple privileges for the same form or same component.

If privileges are left blank at the user authorization level, the user is assigned the permissions defined at the group level.

User Authorization Report

In the User Authorization Report, user and group authorizations for forms and IDOs are grouped together by user ID. Row authorizations are grouped together by user ID and group name, and are sorted by IDO and group name. Options on the form let you choose the specific forms or IDOs you want to see in the report. You can see and compare all authorizations for a single user in the same section of the report. This makes it easier for you to determine whether a user has multiple permissions set differently for the same form, through different groups to which the user is assigned.