BusinessObjects Enterprise Administrator's Guide

Setting common access levels

An access level is essentially a predefined set of object rights. BusinessObjects Enterprise provides a set of access levels that allow you to set common object security levels quickly. The available predefined access levels are No Access, View, Schedule, View On Demand, and Full Control. Access levels are based on a model of increasing rights: beginning with No Access and ending with Full Control, each access level builds upon the rights granted by the previous level. For example, the Schedule access level includes and adds to the rights that are granted by the View access level. For a complete listing of the object rights that make up each access level, see the BusinessObjects Enterprise Administrator's Reference Guide.

Tip:    By default, users or groups who have rights to a folder will inherit the same rights for any object that you subsequently publish to that folder. Consequently, the best strategy is to set the appropriate rights for users and groups at the folder level first. Then publish objects to that folder.

Although access levels grant predefined sets of object rights, they do not explicitly deny any object rights. Instead, each access level grants some rights and leaves the other rights "not specified." The system then denies the "not specified" rights by default. This is important, because it allows users to inherit the greatest rights when they belong to multiple groups:

• When you assign an access level to a group, each user in the group will have at least that level of access to the object. If the user is a member of multiple groups, then he or she inherits the combination of each group's rights. Thus, when a user is a member of multiple groups, he or she inherits the greatest possible rights.
• When you assign an access level directly to a user, you ensure that the user has only that level of access to the object. In other words, you prevent the user from inheriting rights that he or she may have otherwise acquired by virtue of group membership.

This list provides a brief description of each access level:

• No Access

  The user or group is not able to access the object or folder. InfoView, the Publishing Wizard, and the CMC enforce this right by ensuring that the object is not visible to the user.

• View

  If this access level is set at the folder level, the user or group is able to view the folder, the objects contained within the folder, and all generated instances of each object. If this access level is set at the object level, the user can view the object, the history of the object, and all generated instances of the object. The user cannot, however, schedule the object or refresh it against its data source.

• Schedule

  The user or group is able to view the object or folder and its contents, and to generate instances by scheduling the object to run against the specified data source once or on a recurring basis. The user or group can view, delete, and pause the scheduling of instances that they own. They can also schedule to different formats and destinations, set parameters and database logon information, pick servers to process jobs, add contents to the folder, and copy the object or folder.

• View On Demand

  In addition to the rights provided by the Schedule access level, the user gains the right to refresh data "on demand" against the data source.

• Full Control

  This access level grants all of the available advanced rights. It is the only access level that allows users to delete objects (folders, objects, and instances). This access level also allows users to modify all of the object's properties, including the object rights that are set on the folder or object.

  Basically, this access level is designed to provide a user or group with administrative control over one or more folders or objects. Users can then log on to the CMC and add, edit, and remove content as required, without being members of the actual Administrators group.

• Advanced

  This access level does not include a predefined set of object rights. Instead, it allows you to customize a user's or group's access to an object by selecting from the complete range of available object rights. For more information, see Setting advanced object rights.

Note:    There is no predefined access level to grant users the rights required to create or modify reports through the Report Application Server (RAS). For details, see the BusinessObjects Enterprise Administrator's Reference Guide.

Note:    In the developer documentation, access levels are referred to as roles.

To set an access level for a user or group

1. Go to the Objects or Folders management area of the CMC.
2. Locate the object whose rights you want to modify.
3. Click the link to the object, and then click its Rights tab.
4. In the Name column, locate the user or group whose rights you want to specify.

If the user or group is not listed, click Add/Remove. Add the appropriate user or group and click OK. You are returned to the object's Rights tab.

5. In the Access Level column, select the access level (No Access, View, Schedule, View On Demand, or Full Control) that is appropriate for the user or group.
6. Click Update.

Tip:    For detailed tutorials that walk you through sample implementations of object rights, see Customizing a 'top-down' inheritance model.