Is there a way to obtain the logged on user's MR group(s) in the same way that you can get the user's id from &IBIMR_user?

Short answer is no. Those attributes are all stored in the user's .htm files and are not available as system variables. There have been posting on this forum about how to parse / read those files so you may be able to get that information another way and then read them in as local variables.

That's a good question. You can set up variables in WebFOCUS Administration Console > Custom Settings to give you the MRE program's domain and folder, but I haven't seen a variable for the MRE User's Group.

The Custom Settings look something like this:

<set> IBIC_server (pass)

<set> IBIMR_domain (pass)
<set> IBIMR_folder (pass)

<set> MR_BASE_DIR (pass)

WF_PROGRAM=&CGI_PROG
<set> WF_PROGRAM (pass)

CURMRDOM=&IBIMR_domain
<set> CURMRDOM (pass)

This document, Manipulating WebFOCUS Variables describes how to set up Custom Settings (WebFOCUS Variables in this sense are not Dialogue Manager variables, but end up becoming them because of the command described therein).

Look in the "WebFOCUS Security and Administration" manual for chapter "Managed Reporting Internal Variables" for an example of what I've shown above. I can't seem to find a document that lists ALL the MRE variables that can be created.

In principle you could (periodically) extract user and group data from the repository (see MR Admin Manual), load a Focus file with the group membership data based on the IBIMRUSR and IBIMRGRP extract files, query that at run time for rows with USER_ID EQ '&IBIMR_user', and transfer the result to dialog manager variable(s).

But there are obvious security, latency, and delivery issues:

You would be exposing the users' group memberships.

When the admin makes changes, the extract becomes out-of-date and needs to be refreshed.

You need to decide how to represent the list of group_ids in a single &var (or a set of them) so that you can make use of them. (What use do you have in mind?)

I was actually testing a similar solution to what you suggested. The idea is to put a check on each report to make sure that unauthorized users aren't getting to them (since they may reside on the data server and aren't governed by MR at that point).

If the procedures reside on the data server, they are completely outside the realm of Managed Reporting so how would you associate a user's MR groups with them? And if a user's MR groups CAN bee associated with them, they should probably be IN the MRE.

If you're concerned about unauthorized users accessing server procedures, you've got several additional things to do to secure them, or they shouldn't be there at all.

One additional item, which Jack mentions, is that a user could belong to SEVERAL groups, which would somehow have to be handled as either a a single concatenated string, or an indexed local variable.

You may be able to get the groups for a user from the MRE API.

Darin,

I was wondering if just like IBIMR_user can be passed to the server if the group could be passed. You mention some other possibilities to secure the procedures. Are you referring to being able to lock down the server to only be accessible via MR?