Editing Viewing Condition of a Permission Group who is a copy of a standard one

Did you know that there is a great video series on YouTube that covers the permission system of One Identity Manager? Maybe you find something useful there. https://www.youtube.com/playlist?list=PL242czeZwlAl46Xv0UnBDwTm-8VN5p4qI

Hi Dario,

You will find those videos very helpful indeed.  Specifically, a screen shot below for your question.  In your case you would select your CCC_4_ALLUSER_LOOKUP copy.  In addition, in general, if you ever find a window missing then select the View->Restore Default Layout option to be sure to see all windows.

Also, you may find this helper document useful, with a worked use case at the end that involves copying some of the standard permission groups: https://drive.google.com/file/d/1O75c6FNs50b1D2wvdr6Xxj8S3Gq-7M7J/view?usp=sharing

Rob.

Hi Robert,

thanks for the screenshot! Do you know whether there is a way to set the permission filters individually on the column level and not at the table? I'm trying to define different sets of columns that are editable for a single permissions group depending on, as an example if a Person Object is external or not.

Hi Ryoma,

The conditional filters for a permission group are only at the table level.  So you could make a specific permission group for your attributes with the appropriate filters at the the table level.  You can then use Permission Group inheritance to ensure that those permissions are applied.  You might need to remove those permissions from other permission groups to prevent them being granted unconditionally. There is an example like that for Person.Phone in the link from the previous post: https://drive.google.com/file/d/1O75c6FNs50b1D2wvdr6Xxj8S3Gq-7M7J/view?usp=sharing.

hth,

Rob.

You cannot define conditions for column permissions.

But you have two options here,

1. Create two permissions groups that both contain permissions set on the Person table and both using a where clause that separate both sets (externals and internals). In both permission groups, assign the view/edit conditions for all columns you want to see and edit. Remember, the permission model honors separate sets of objects for a table. So if you define edit permissions for one set but not for the other it will work even if a trustee has assigned both permissions groups.
2. Use the OnLoaded script to restrict the edit permission on your columns based on your condition. You can use the code template base.Columns("ColumnName").CanEdit = False to remove the edit permissions for the current object.

See the following threads as well.

https://www.quest.com/community/one-identity/identity-manager/f/identity-manager-forum/27186/is-it-possible-to-hide-fields-in-the-genericmasterdata-forms-and-special-forms-i-e-person-in-manager-without-editing-default-rights-v6-v8

https://www.quest.com/community/one-identity/identity-manager/f/identity-manager-forum/26946/mass-prohibit-modification-for-employees-custom-property-1-field