Using explicitly denied rights to globally remove privileges for non-administrators

Deny overrides grant in Business Objects

The way that "explicitly denied" rights work (on the advanced rights tab) enables us to globally remove rights for groups or individuals.

Important: "explicitly denied" rights will always override an "explicit grant"

For any given right, if a user is a member of any group where that specific right is denied, the net right is denied.

Deny always trumps grant.

Using explicit denies at the highest level

We can set folder rights in CMC at the highest level, the "Settings" level. Doing this will effectively deny the right at all levels (since the "settings" level is the parent folder of all folders). Setting rights at this level avoids needing to individually remove rights at the folder level for various groups.

 businessobjects global settings

 

Go to the "Rights" tab in the settings.

business objects rights tab

 

On the rights tab, add a group that you wish to explicitly deny rights.

In our case we created a "non-administrators" group. We wanted to deny all non-administrators certain rights, like scheduling reports. We added all non-admins to the non-administrators group. Added an entry on the rights tab for the non-admin group and set the advanced rights.

On the "Advanced Rights" each individual right (row) can be set to either "Explicitly Granted," "Explicitly Denied," or "Not Specified."

advanced rights explictly denied granted

 

By setting rights that are explicitly denied, it effectively denies the right for any members of the specified group (non-administrators in our case).

 

Here is a list of the rights that can be set in this way in BusinessObjects:

 

General Rights

Desktop Intelligence Rights

 

Desktop Intelligence Add in

 

Report

 

Web Intelligence Document

 

 

Filed under by

Spread the word

del.icio.us Digg Furl Reddit

Permalink • Print • Comment