Record Level Access

[bevo1801]

Hi Everyone,

Not to beat this topic to death, but I keep hitting the wall on this one. I understand using the auto-entered Get(AccountName) with the Extended Privileges to allow the record creator to view, edit and delete their own records. Here is where I am am stuck.

Let's say Allison, Ann and Alexander are in Group A, and Bob, Brandon and Bailey are in Group B.

Is it possible for Allison to create a record that can also be viewed or edited by the two other members of her group (Ann and Alexander), while restricting access to all members of Group B? In other words, I wanted each user to be able to create, edit and view their own records, but also flag the record with their appropriate group so that it can be viewed or edited by anyone in the same group.

I have experimented with a Users Table, but have read here that it's not a good idea to use one for this purpose. It would not be used for authentication, but possibly RLA. Is this the route to take?

Not sure if it complicates matters or not, but I will be using External Authentication as well.

Suggestions, anyone?

David

PS (I have search the forum for Record Level Access, and have read the discussions)

Edited February 2, 2010 by Guest

[David Jondreau]

Extended Privileges aren't necessary relevant here.

Create two privilege sets, GroupA and GroupB and assign user accounts to one of those sets. Edit those sets so that they can only view/edit/delete if the current privilege set matches the one that created it.

You'll need an auto-enter field that captures Get(PrivilegeSetName) to make the RLA work.

[Steven H. Blackwell]

Bear in mind that the RLA calculation may evaluate differently than you assume it does. It may not return the Privilege Set information of the Account that opened the file. See thefmkb.com/7161 Tech Info for more information.

Steven

[David Jondreau]

Right, I forgot about that.

So, the calculation would need to be equal to the hard coded, literal string Priv Set?