BusinessObjects Enterprise Administrator's Guide

Group and folder inheritance

Group inheritance allows users to inherit rights as the result of group membership. Group inheritance proves especially powerful when you organize all of your users into groups that coincide with your organization's current security conventions. For example, if you create a user called Sample User, and add it to an existing group called Sales, then Sample User will automatically inherit the appropriate rights for each of the reports and folders that the Sales group has been added to.

When group inheritance is enabled for a user who belongs to more than one group, the rights of both groups are considered when the system checks credentials. The user is denied any right that is explicitly denied in any group, and the user is denied any right that remains completely "not specified"; thus, the user is granted only those rights that are granted in one or more groups (explicitly or through access levels) and never explicitly denied.

Folder inheritance allows users to inherit any rights that they have been granted on an object's parent folder. Folder inheritance proves especially powerful when you organize BusinessObjects Enterprise content into a folder hierarchy that reflects your organization's current security conventions. For example, suppose that you create a folder called Sales Reports, and you provide your Sales group with View On Demand access to this folder. By default, every user that has rights to the Sales Reports folder will inherit the same rights to the reports that you subsequently publish to this folder. Consequently, the Sales group will have View On Demand access to all of the reports, and you need only set the object rights once, at the folder level.

Note:    If you need to disable or modify inheritance patterns for a particular folder or object within your folder hierarchy, you can do so with access levels or with advanced rights.