{"id":37938,"date":"2023-01-20T12:03:31","date_gmt":"2023-01-20T04:03:31","guid":{"rendered":"http:\/\/localhost\/help\/?page_id=37938"},"modified":"2024-07-05T10:03:48","modified_gmt":"2024-07-05T02:03:48","slug":"how-object-access-works","status":"publish","type":"page","link":"https:\/\/oihelp.corporate.ifs.com\/help\/p2-server\/security\/how-object-access-works\/","title":{"rendered":"How Object Access Works"},"content":{"rendered":"\n

This article applies to versions 4.9.1 and later of IFS OI Explorer. For more, see Release History<\/a>.<\/p>\n

Objects in IFS OI Explorer are the lowest level of granularity that can be secured.<\/p>\n

An object is an individual, identifiable instance of a resource, such as Workspace 1 or Entity A.\u00a0 Object security is performed inside the module itself, rather than in the Security module of Server Management.<\/p>\n

Related: How Security Works<\/a>, workHow Roles Work<\/a><\/p>\n

\n

What Can Be Secured<\/h2>\n

Every resource has corresponding objects, however not all objects can be secured individually. Generally speaking, resources that have a View privilege also have objects that can be secured, while those without a View privilege can only be secured at the resource level.<\/p>\n

Server<\/h3>\n\n\n\n\n\n\n\n\n\n\n
Objects that can be secured<\/strong><\/td>\nObjects that cannot be secured<\/strong><\/td>\n<\/tr>\n
Calculations<\/td>\nDigital States<\/td>\n<\/tr>\n
Datasources<\/td>\nImages<\/td>\n<\/tr>\n
Entities<\/td>\nUnits<\/td>\n<\/tr>\n
Hierarchies<\/td>\n <\/td>\n<\/tr>\n
Named List Items<\/td>\n <\/td>\n<\/tr>\n
Links<\/td>\n <\/td>\n<\/tr>\n
Templates<\/td>\n <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Read more: Securing Server Objects<\/a><\/p>\n

Explorer<\/h3>\n\n\n\n\n\n\n
Objects that can be secured<\/strong><\/td>\nObjects that cannot be secured<\/strong><\/td>\n<\/tr>\n
Forms<\/td>\nStyles<\/td>\n<\/tr>\n
Workbooks<\/td>\n <\/td>\n<\/tr>\n
Workspaces<\/td>\n <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Read more: Securing an Explorer Object<\/a><\/p>\n

Sentinel<\/h3>\n\n\n\n\n\n
Objects that can be secured<\/strong><\/td>\nObjects that cannot be secured<\/strong><\/td>\n<\/tr>\n
Workspaces<\/td>\nEvents<\/td>\n<\/tr>\n
\u00a0<\/td>\nUser Processes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Read more: Sentinel Security<\/a><\/p>\n

Commentary<\/h3>\n

The Commentary module can only be secured at the resource level.<\/p>\n

Read more: Security for Comments<\/a><\/p>\n

\n

Object Privileges Matrix<\/h2>\n

As with module- and resource-level privileges, object privileges are assigned to roles, rather than individual users.<\/p>\n

Object-level privileges can only be changed by a user with Admin privileges for the relevant module (e.g. Server Admin for securing hierarchy objects, or Explorer Admin for securing workspace objects).<\/p>\n

Assigning Object Privileges<\/h3>\n

You can assign object privileges by directly clicking the privilege against the object, from within the containing module\/resource. For example, to manage privileges for a workspace, go to workspaces in IFS OI Explorer, and open the workspace for which you want to change the privileges. The available privileges are the same as those available for the resource.<\/p>\n

Note that privileges cascade here too, with the highest level privilege generally on the right, and the lowest on the left. When you assign a high level privilege, such as Delete,<\/strong> lower level privileges are also automatically granted when that privilege is required to perform the action. This is shown by a green circle with a dot.<\/p>\n

For object-level privileges, privileges are either granted explicitly or inherited from a resource. If a privilege is not granted via one of these methods, it is denied. Note that the Everyone role shows the actual default View privilege as being granted, whereas Edit and Delete are denied at the object level.\u00a0<\/p>\n

\"\"<\/a><\/p>\n

What the Colours Mean<\/h3>\n

As with resource-level security, the privileges matrix is colour-coded to indicate the cascading nature of privileges. The colours are:<\/p>\n

\"\"<\/a>\u00a0Grey: Privilege not granted
\n\"\"<\/a>\u00a0Green tick: Privilege is explicitly granted, associated privileges will also be automatically granted.
\n\"\"<\/a>\u00a0Green dot: Privilege is granted because a higher level privilege has been granted on the resource.
\n\"\"<\/a>\u00a0Blue: Privilege is granted because it is inherited by a resource privilege.<\/p>\n

Related: Locking Down an Object<\/a><\/p>\n

\n

Release History<\/h2>\n