andycheek (Customer) asked a question.

March 21, 2024 at 4:44 PM
G&L 7.5.2 - can we define custom "Aveksa" access with constraint on target objects AND assigned users?

We have successfully created custom Aveksa entitlements (i.e. internal G&L privileges) based on the current users relationship to an attribute of the target object, e.g. application owners have view access to groups belonging to the application as shown below:

 

group.application_id > application & application.owner > user

 

What I haven't been able to work out is how to create a custom entitlement which not only defines the scope of target objects based on an attribute but also defines the constraint of users assigned the entitlement by virtue of something else such as membership of a specific group/set of group:

 

report.category = 'xxxx' AND user is in group 'group name%'

 

Has anyone done anything similar & if so how? What does your custom SecurityContext entry look like?

  • 3 answers
  • 254 views

  • TimWillemstein2 (Customer)

    I used something like this to grant birthright view rights on a specified set of reports to some set of users based on a specific criteria

     

    Report Definition,BLABLA Reports Access,Run,"t_master_enterprise_users where id=(select distinct ent_owner from pv_unified_entitlement where application_name='BLABLA' and ent_owner=${id})",,,V_LIST_REPORTS,"scope.REPORT_NAME in('xxxxx','yyyy')"

    Selected as Best

  • Boris.Lekumovich (RSA)

    what if you assign the custom aveksa entitlement via a role (with membership configuration) or using one of the available rules?

    It should give you the ability to assign to users based on a more granular condition.

  • TimWillemstein2 (Customer)

    I used something like this to grant birthright view rights on a specified set of reports to some set of users based on a specific criteria

     

    Report Definition,BLABLA Reports Access,Run,"t_master_enterprise_users where id=(select distinct ent_owner from pv_unified_entitlement where application_name='BLABLA' and ent_owner=${id})",,,V_LIST_REPORTS,"scope.REPORT_NAME in('xxxxx','yyyy')"

    Selected as Best

Don't see what you're looking for?