Permissions between two databases (Record Level)

[CuriousGood]

I've searched for an answer to this question, but I'm hoping I just missed a topic and someone can point me to the answer.

I have a database that is used for placing orders. The customer accounts are in a separate FM databse. I want to limit my salespeople to only seeing their customers. Does this mean I need to apply record-level permissions / Record_Created_By fields on every table in my customer accounts database AND the related tables in the orders database? Will this filter records in a drop down value list of addresses, or do I also need to apply value list permissions?

Thanks, and sorry for being a nooblet.

[Steven H. Blackwell]

I've searched for an answer to this question, but I'm hoping I just missed a topic and someone can point me to the answer.

I have a database that is used for placing orders. The customer accounts are in a separate FM databse. I want to limit my salespeople to only seeing their customers. Does this mean I need to apply record-level permissions / Record_Created_By fields on every table in my customer accounts database AND the related tables in the orders database? Will this filter records in a drop down value list of addresses, or do I also need to apply value list permissions?

Privileges must be set table by table. Privileges are then attached to one or more Accounts. If you are using FileMaker Server, this is a lot easier to do, especially if you have a lot of Accounts.

Filtering a value list is a somewhat different matter. This will require a relationship to create the "filter" and that will have to be based on Account name most likely. I should note that such filters are not part of the security schema.

Keep coming back if you have questions. You might want to search FMF for posts related to record level access and for posts about filtered or cascading value lists.

Steven

[comment]

Will this filter records in a drop down value list of addresses, or do I also need to apply value list permissions?

Records you don't have access to are automatically removed from find results, related sets AND value lists. No relationship is required for this. See the attached example.

AccessUserRecordsVL.zip

[CuriousGood]

Thank you for the great example! But does the permissions relationship persist between two databases? (Say in your example, the values table was in a separate database.)

[CuriousGood]

I answered my own question with a test! It looks like they do.

Now to figure out how to get rid of the <No Access> on the records they can't see.

[comment]

It will work the same way, as long as you are logged in as a user in the values file (in my example, the re-login would have to be performed in the "other" file).

But why would you want to keep the tables in separate files?

how to get rid of the <No Access> on the records they can't see.

Note the 'Bogus Find' script in my example.

[CuriousGood]

Each database is managed by someone different, and they have their own layouts, etc. One is for customers and all the things that go into that. The other is for orders and all the other things that go into that. The relationships are pretty complex as well -- would I be better served by putting it all into one?

It will work the same way, as long as you are logged in as a user in the values file (in my example, the re-login would have to be performed in the "other" file).

But why would you want to keep the tables in separate files?

Note the 'Bogus Find' script in my example.

[comment]

I'd say keep them in the same file unless you have a good reason not to. There was an excellent post by Ender listing such good reasons, but I can't find it.

[CuriousGood]

I'm dredging this project back up again! I can't see where the Bogus Find is called in your example. I can find the script, but just don't see what's running it.

[comment]

I can't see where the Bogus Find is called in your example.

It's not. It's a demo file, and you are supposed to perform it manually when you see <No Access> records in the Values table. In real life, it's a bit more complicated because it depends on the workflow. Roughly, you'd call it the first time a user goes into a layout and also in place of Show All Records.

[CuriousGood]

It's not. It's a demo file, and you are supposed to perform it manually when you see <No Access> records in the Values table. In real life, it's a bit more complicated because it depends on the workflow. Roughly, you'd call it the first time a user goes into a layout and also in place of Show All Records.

Okay, that makes sense! I just thought I might be missing some secret FileMaker mojo. Thank you so much for taking the time to make this file. I'm sure it seems simple to you now, but it really has helped me.