Record-level permissions

Hello,

I hope I'm in the right forum...

I have a web application under development based on an Access database. My client requires that recordaccess be restricted to nominated users' roles and/or specific position in the company (that is certainrecords are restricted to various users). I'm looking for a simple but effective way of implementing this requirement and would appreciate any guidance in setting up a robust solution.

TIA

ChrisN

 

Not sure what the layout of your data is, but consider the following:


Add a security level field (RecordSecurityLevel) in the data tableand populate accordingly. Records with avalue of 0, for example, would be available to all employees. Records with a 1 (or below)can be viewed by Managers, records with a 2 (or below) can be viewed by execs, and records with a 3 (or below) can be viewed by system admins, etc, etc


Add a security level field (UserSecurityLevel) in the user table. Assign your security levels and populate the table with the appropriate levels.


When a user logs into your site, you look up their security level when logging them in. Store their security level as asession variable named UserSecurityLevel.


When you run your data query, run it like this


"select * from DataTableName where" & Session("UserSecurityLevel")& ">= RecordSecurityLevel"


This will return all records where the user security level is greater than or equal to the record security level. Again, not sure your exact setup, but that might get you started towards a solution.


Mike Reilly, Secretary/Webmaster
Kiwanis Club of Rancho Penasquitos
"Serving the Children of the World"
[email protected]
(760) 419-7429