More Details about Groups

More Details about Groups

Creating an Authority Group

Press the New Group button. Go to the User Details tab and give the group a caption and a user profile. The group's profile does not have to exist anywhere, because groups cannot sign on.

Specifying Authorities for the Group

Go to the Authorities tab. Authorize the group to Framework objects in exactly the same way as you would a user.

Attaching a User to a Group

Click an individual user in the list on the left of the users panel and go to the User Details tab. The group that you created is shown in the list of groups at the bottom of this tab. Check the group to attach the user to it (or attach it to the user).

Authorities are Additive

If an individual user, or any of the groups they belong to, are authorized to an object, then the user can use the object.

This means that:

• If the individual user is not authorized to the object, but one of the groups they belong to is authorized, the user will be able to use the object.

• If the individual user is authorized to the object, and the user is attached to a group that is not authorized to the object, the user will still be able to use the object

• If the user belongs to two groups, and one group is authorized to an object and one group isn't, the user will be able to use the object.

Authorities of a Member of a Group

When viewing the Authorities tab, the objects to which a user has group authority are shown as shaded and protected. This is because you cannot remove users' authorities to an object to which they have group authority (because authorities are additive).

You can remove users' authorities to an object to which they have individual authority, but not group authority.

You can also authorize the individual users to an object to which they do not have group authority. This is called an individual override authority to an object.

Note about Individual Override Authority

Giving individual override authority to an object may cause the Framework to give the user individual authority to the parents of the object (if the user is not authorized to the parent already). This implementation ensures the users have a coherent individual authority even if they are removed from all groups.

The user is given individual authority only to the direct ancestors of the object.

However, if new objects that belong to the same parent are subsequently added to the Framework this may result in unexpected individual authority to the new object. To avoid this problem, when adding new objects to a Framework which has already had user authorities set up, set the new object's Restricted Access property to checked. Alternatively, you can edit each user's authority after adding the new Framework object.

Custom Property Values Cannot Be Assigned to Group Profiles

Do not assign custom property values to group profiles because they will not be applied to any users belonging to the group.