(Record Level) Security Registry entry

Record Level Security provides organisations with control over access to records on a per user and per group basis.

At its simplest it is possible to set permissions that determine who can view, edit and delete records. However, by specifying additional criteria it is possible to refine these three standard security privileges. For instance, it is possible to specify that:

• Records with a Record Status: (Access) of Retired cannot be viewed by a certain group of users.

  Note: Any field in a module can be used to set conditions when applying Record Level Security.

• Only members of a department can edit and delete that department's records.

The Security Registry entry is used to refine the three standard Record Level Security permissions, Display, Edit, Delete, and also to apply the special Insert Record Level Security permission.

It is worth stressing that a Security Registry refines the Display, Edit and Delete permissions that a user / group has to a record, it does not replace the necessity to add the user (or a group to which the user belongs) to the Security box on the Security tab for that record and to specify permissions in the Permissions box. In other words, a Security entry that gives a user / group the Edit permission to a record when Record Status is Active, is only effective if the user (or a relevant group to which the user belongs) has been added to the Security box on the Security tab for that record and the Edit checkbox is ticked.

Even if a Security Registry entry is added to allow members of group Managers to edit records in the Parties module when Record Status: (Access) = Active, members of group Managers will be unable to edit the following record:

It is necessary to add group Managers to the Security box and provide it with the Edit permission:

User	user	Table	table	Security	permission	value;value;...
User	user	Table	Default	Security	permission	value;value;...
Group	group	Table	table	Security	permission	value;value;...
Group	group	Table	Default	Security	permission	value;value;...
Group	Default	Table	table	Security	permission	value;value;...
Group	Default	Table	Default	Security	permission	value;value;...

A Vital Records Office decides that all staff should be able to view every record in the Parties module, but only members of each department (e.g. Registrations, Accounts, etc.) should be allowed to edit and delete their department's records.

In this example we restrict records to members of the following groups:

• Registrations Managers
• Accounts Managers

Suitable Registry entries are:

1.	Group Registrations Manager Table eparties Security Edit SecDepartment_tab= Registrations This entry specifies that members of group Registrations Managers are able to edit records in the Parties module when the Department field on the Security tab holds the value Registrations.
2.	Group Registrations Manager Table eparties Security Delete SecDepartment_tab= Registrations This entry specifies that members of group Registrations Managers are able to delete records in the Parties module when the Department field on the Security tab holds the value Registrations.
3.	Group Registrations Manager Table eparties Security Insert SecDepartment_tab=Registrations; SecCanDisplay=Group Default; SecCanDisplay=Group $group; SecCanEdit=Group $group; SecCanDelete=Group $group This entry specifies that when members of group Registrations Managers add a record to the Parties module, the Department field on the Security tab is populated with the value Registrations and permissions are set which allow everyone to view the record but only members of group Registrations Managers to edit and delete the record.
4.	Group Accounts Managers Table eparties Security Edit SecDepartment_tab=Accounts This entry specifies that members of group Accounts Manager are able to edit records in the Parties module when the Department field on the Security tab holds the value Accounts.
5.	Group Accounts Managers Table eparties Security Delete SecDepartment_tab=Accounts This entry specifies that members of group Accounts Manager are able to delete records in the Parties module when the Department field on the Security tab holds the value Accounts.
6.	Group Accounts Managers Table eparties Security Insert SecDepartment_tab=Accounts; SecCanDisplay=Group Default; SecCanDisplay=Group $group; SecCanEdit=Group $group; SecCanDelete=Group $group This entry specifies that when members of group Accounts Manager add a record to the Parties module, the Department field on the Security tab is populated with the value Accounts and permissions are set which allow everyone to view the record but only members of the Accounts Manager group to edit and delete the records.

When these entries have been set in the Registry module, all that remains is to apply these settings to existing records in the Parties module:

1. In the Parties module, locate all staff records for the Registrations department.
2. Add group Registrations Managers to the Security box on the Security tab and give the group Edit and Delete permissions.
3. Uncheck all but the Display permission for the Everyone group.
4. Use the Set Record Security batch update tool to apply these settings to all Registrations records.
5. Use the Global Replace tool to insert the value Registrations in the Department field on the Security tab for all records found in your search.

   Now when Registrations Managers log in, they will have edit and delete permissions for these Registrations records; other users will be able to view them but not edit or delete them.

6. Repeat steps 1 to 5 for group Accounts Managers.

This Registry entry allows members of group Managers to view records in the Parties module only when Record Status: (Access) = Active:

Key	Setting	Description
Key 1	Group
Key 2	Managers
Key 3	Table
Key 4	eparties
Key 5	Security
Key 6	Display	Type of permission: Display, Edit, Delete, Insert.
Value	SecRecordStatus=Active	The condition that must be met for the permission to apply. In this case, if Record Status is set to Active, members of group Managers will be able to view the record. If Record Status is anything other than Active, members of group Managers will be unable to view the record. Note: Any field can be used to set a security permission. Multiple values (multiple conditions) can be set here.

In this example:

• Group Everyone can display, edit and delete the following record in the Parties module.
• Record Status: (Access) is set to Active:

When a member of group Managers logs in and searches for this record, the record is returned and the user has inherited the permissions of group Everyone (they can edit and delete the record).

If Record Status: (Access) is changed from Active to Retired, and a member of group Managers searches for this record, the record will not be located:

Even if group Managers is added to the Security box for this record:

members of group Managers will not be able to display the record unless Record Status: (Access) is set to Active.

Note that it is not necessary to add group Managers to the Security box as long as group Everyone is listed in the Security box: members of group Managers inherit the permissions of any other group to which they belong, which by default includes group Everyone. If the above Security Registry has been set and a record has the following security values, members of group Managers will be able to view, edit and delete the record even though group Managers has not been added to the Security box:

However, if we take away the Edit and Delete permissions from group Everyone:

and wish to provide group Managers with the ability to edit records where Record Status: (Access) = Active, then it is necessary to add group Managers to the Security box and provide it with the Edit permission:

When members of group Managers add a new record to the Parties module, the Department field on the Security tab is populated with Managers:

Key	Setting
Key 1	Group
Key 2	Managers
Key 3	Table
Key 4	eparties
Key 5	Security
Key 6	Insert
Value	SecDepartment_tab=Managers

The following entry not only inserts a value in the Department field when group Managers adds a record to the Parties module, it also specifies the security permissions for group Everyone and the current group (Managers) using the $group variable:

Key	Setting
Key 1	Group
Key 2	Managers
Key 3	Table
Key 4	eparties
Key 5	Security
Key 6	Insert
Value	SecDepartment_tab=Managers;SecCanDisplay=GroupDefault;SecCanDisplay=Group $group;SecCanEdit=Group $group;SecCanDelete=Group $group

When specifying an attachment field in a Security Registry entry, the value must be:

1. The field's Link Column name, not its column name.

   -AND-

2. A record's IRN.

For example, if referencing the Party: (Associated With) field in a Security Registry entry, we would use AssAssociationRef_tab and not AssAssociation_tab:

A suitable Security Registry entry referencing an attachment field would be:

Key	Setting
Key 1	Group
Key 2	Managers
Key 3	Table
Key 4	eparties
Key 5	Security
Key 6	Display
Value	AssAssociationRef_tab=6