Hi all,

A client I'm working at at the moment requires something interesting: they want to be able to 'mask' certain columns depending on the user rights.
The reason they want this is so that interns for example cannot see product margin information.

You can off course just create some DEFINEs in a reports; but this will be done on several dozen columns in several MASTERfiles.
So I'm looking for an easy, manageable and dynamic way of doing this.

As an added example to show what I mean: I've already found one way of doing this on the CAR file (but I'm wondering wether there isn't a better way):

The INCLUDE (off course the value &INTERN will come from a database in the future and will depend on the &IBIMR_user):

-SET &INTERN = 1;

DEFINE FILE CAR
SALES/I6=IF (&INTERN EQ 1) THEN 0 ELSE SALES;
END

Now; when you include this fex (explcitly include it or via something like the edasprof) in the following fex, this will overwrite the SALES amounts depending on the logged in user:

-INCLUDE carmask

TABLE FILE CAR
SUM SALES
BY COUNTRY
BY MODEL
ON TABLE PCHOLD FORMAT HTML
END

This is what I've come up with sofar, but I'm not entirely happy with the way this works (overwriting columns with a DEFINE with the same name).

Any thoughts?

Client WebFOCUS data:
WF Client 7.6.8 on a Win2k3 machine
WF Rep. Server 7.6.8 on OS400 (IBM iSeries machine)
Database: DB2

This message has been edited. Last edited by: Kerry,

Can't this be done with DB2 Security?

Can you bypass printing/summing the column by bypassing with Dialogue Manager?

We use DBA Security

AND, Yes, it works on RDBMS metadata masters...

here's what i do for payroll files

1) set up some &variable that has a boolean value depending on user's rights.
make a file , GOODGUYS, of users with rights
-SET &payroll = IF &USER_ID IS (GOODGUYS) THEN 1 ELSE 0;

2) in every fex, every salary variable is
AMOUNT * &payroll ;
or HOURS * &payroll ;
Everywhere.
Pain to set up, but works like a charm

Do you want to still display the column with a 0 in it, or would not displaying it at all also be an option?

I have some code where the columns to be printed out are dependent on the user chosen options. I define an &variable which contains a comment in it and use that to hide the columns.

e.g

-SET &INTERN = 1;
-SET &COMMENT=IF &INTERN EQ 1 THEN '-*' ELSE '';

TABLE FILE CAR
SUM
&COMMENT.EVALSALES
MODEL NOPRINT
BY COUNTRY
BY MODEL
END

obviously i've put the MODEL NOPRINT in otherwise you'll get an error as you won't have a field after the SUM.

Hi Guys,

Thanks for all the replies!

Francis; this could certainly be an option. How would you reset the amounts this way? The column should still be passed to the report; only set at 0. (I guess put the logic within a VIEW?)

Perhaps good to know as added information; the clients report on MASTERfiles which have around 25 to 40 tables already JOINed in them. Over these tables they've created a Business view which they use for reporting.

Ginny, Susannah; good options, unfortunately the client wants me to set it up in a way that this logic would be present in every report they create on the MASTERs in the future as well. It would be more convenient to set it up somewhere else then in the FEXes.

Tom; I know DBA, but how would you set it up for a few 100 users? I'm also going to take a look to see if I can 'reset' the columnvalues with DBA, but I think that should be possible.

As you see, I'm struggeling with the fact that they want this logic outside the FEXes and automatically included. And I know, a lot of 'yes, but-s' in my reply but of course I'm looking or the best possible way to do this for the client.

Again; thanksfor the input sofar!

Hi Tewy,

At this point they still want to display the column, so people are aware that they do not have access to some information.
(This to prevent that someone who should have access but somehow does not have the right rights can recognise this by looking at the report).

I haven't done this in DB2 but I bet the security features of DB2 would allow for this kind of thing - DB2 is one powerful RDBMS...

Jochem,

There is another way. Try createing 2 MFDs one for the people with autority to see all columns and one for people wha are restricted. Then based on the user, use the correct MFD. You can use Dialogue Manager to control the MFD.