Security access rules are XML documents attached to user groups. Each user's security clearance is based in a union of all of the rules coming from the groups they are planned to. Admin users have no rules because, by default, everything is allowed in TACTIC.
In the Groups table, the Access Rules column shows the XML rules which are automatically generated by either the TACTIC toolset like the Permission Manager or manual editing for very specific and custom control. In general, the access level is ranked like this from bottom up: deny < view < edit < allow.
The following sample shows access rules applied to a 'Client' group:
In this sample, any users in the Client group can see only a project named "game" and cannot access the side_bar items (which have been denied).
<?xml version='1.0' encoding='UTF-8'?> <rules> <rule key='admin' access='deny' group='side_bar'/> <rule key='site_admin' access='deny' group='side_bar'/> <rule key='Level_Manage' access='deny' group='side_bar'/> <rule key='levels_folder' access='deny' group='side_bar'/> <rule key='characters_folder' access='deny' group='side_bar'/> <rule key='myTactic_folder' access='deny' group='side_bar'/> <rule group='project' access='deny'/> <rule group='project" key="game" access='allow'/> </rules>
The following are examples of different access rules which can be used to customize group access rules. Make sure the <rule/> tag is a child of the <rules/> tag.
Project level Examples
This rule denies access to all projects except for the "sample3d" project. In the following example, the "default" project is a home page the user needs to use to select projects. Because it is part of the group, you must explicitly allow viewing access to this default project when you deny access to all projects. It is also needed for XML-RPC communication to the client computer.
<rules> <rule group='project' default='deny'/> <rule group='project' key='sample3d' access='allow'/> <rule group='project' key='default' access='view'/> </rules>
All projects can be viewed by default.
<rule group='project' default='view'/>
Search Type level Examples
The layer search type is not viewable in all projects
<rule group='sobject' search_type='prod/layer' project='*' access='deny'/> or <rule group='sobject' search_type='prod/layer' access='deny'/>
The task search type is not viewable in project 'sample3d'. Note that this is not the same as tasks assigned in project 'sample3d' is not viewable. It merely restricts the user's ability to view tasks when he is in a particular project.
<rule group='sobject' search_type='sthpw/task' project='sample3d' access='deny'/>
The note search type is not viewable in project 'sample3d'.
<rule group='sobject' search_type='sthpw/note' project='sample3d' access='deny'/>
The note search type is not editable in project 'sample3d'. This currently only applies to the main TableLayoutWdg used in most places. NoteSheetWdg and DiscussionWdg which also handle note entry are not bound by this rule.
<rule group='sobject' search_type='sthpw/note' project='sample3d' access='view'/>
The shot search type is editable in project 'sample3d'
<rule group='sobject' search_type='prod/shot' project='sample3d' access='edit'/>
The 3d Asset search type from project 'sample3d' is not viewable. This is also applicable when you are in a different project looking at a task in 'sample3d' and the parent of which happens to be a 3d Asset in project 'sample3d'.
<rule group='sobject' search_type='prod/asset' project='sample3d' access='deny'/>
Search Type Column level Examples
These examples affect the display of the columns in different views
The 3d Asset search type's code and description are not editable in all projects
<rule group='element' search_type='prod/asset' key='code' access='view'/> <rule group='element' search_type='prod/asset' key='description' access='view'/>
The Shot search type's status is not editable in the 'sample3d' project
<rule group='element' search_type='prod/shot' key='status' access='view' project='sample3d/>
The Shot search type's description is not visible in the 'sample3d' project
<rule group='element' search_type='prod/shot' key='description' access='deny' project='sample3d/>
Database level Examples
While Search Type and Search Type Column level examples affect the display of the main TableLayoutWdg and EditWdg, the following database level examples are applied when attempts are made to edit or insert data into the database. It can block even server or client API script access to the databases.
This rule prevents the display and writing of the "is_current" field for snapshots found in the Checkin History.
DEPRECATED and UNSUPPORTED format:
<rule group='sobject|column' key='sthpw/snapshot|is_current' access='deny'/>
New format:
<rule group='sobject_column' search_type='sthpw/snapshot' column='is_current' access='deny'/>
The description column for Shot cannot be edited in any widget or any script. It is view only.
<rule group='sobject_column' column='description' search_type='prod/shot' access='view'/>
The status column for Task cannot be edited in any widget or any script. It is view only.
<rule group='sobject_column' column='status' search_type='sthpw/task' access='view'/>
The custom sType project/asset is view-only and not editable by a particular group.
<rule group='sobject' search_type='project/asset' access='view'/>
The custom sType project/asset is not viewable by a particular group. The search result will always come up empty.
<rule group='sobject' search_type='project/asset' access='deny'/>
Search Filter Examples
To enforce what can be searched or filtered out in any situation like script query or UI view, search_filter rules can be applied. The 'access' attribute is not required here.
This rule filters out tasks belonging to project "pacman" and "sample3d". Notice you don't need "access" here.
<rule group='search_filter' column='project_code' value='pacman' op='!=' search_type='sthpw/task' /> <rule group='search_filter' column='project_code' value='sample3d' op='!=' search_type='sthpw/task' />
This rule retrieves task that is assigned to the current login user, applicable when navigating in project 'sample3d'. Notice the 'value' attribute can accept an expression. $LOGIN and $PROJECT are also supported.
<rule column='assigned' value='@GET(login.login)' search_type='sthpw/task' op='=' group='search_filter' project='sample3d'/> or <rule column='assigned' value='$LOGIN' search_type='sthpw/task' op='=' group='search_filter' project='sample3d'/>
Miscellaneous Examples
This rule blocks a user from seeing the options "Approved" and "Complete" in the task status drop-down
<rule access='deny' key='Complete' category='process_select'/> <rule access='deny' key='Approved' category='process_select'/>