Clarity

Just wondering if the financial OBS's like departments can be used for security?

Apparently when they are associated with an entity they cannot be selected any more for security.

On the other hand you can make the selection before associating them with and entity.

Will it work if you do it like that?

Yes they can be used for security.

However painful if you ever need to move the OBS about, so I would recommend against doing this if there is a complex security model.

Please enable it for access rights before associating it to an entity.

Once an OBS has beenm tied to an entity can not be changed.

You might want to query:

select * from prj_obs_types

Check the affected OBS and update the is_security column to 1

As you can see from my screenshots the financial OBS's can be tagged for use for access rights.That is what I should expect the direct update to accomplish.

However, that is just the beginning.

A (financial)l OBS tagged for use for access rights is also expected to appear in OBS section in Administration Resource's properties on OBS and Partitions page.

In my case that does not.

Secondly it is expected that rights based on that OBS to say a group. - In my case that is possible

If OBS based right were given a member of the group should have eg displayed in the OBS rights of the user properties - in my case they are not

Finally when there are OBS based rights assigned to a user they should work as designed - in my case they don't.

So my conclusion is that my initial question

Can the financial OBS's be used for security?

is not answered yet.

Hi Urmas,

so I did some digging for you and the community.

TLDR: the OBS is taken off the view and your OBS will now appear under "Department"

Once you've set up the entity you get this message:

it then removes them from the view, and you lose the OBS attributes.

In it's place you'll see the obs under "department"

This makes sense as now the only way to manage the OBS is through "departments". (so no "move" capability etc)

Which leads me back to my original comment of not recommending to use the financially enabled OBS for access rights.

As you can see you can add security rights to it post being associated with entity.

I've marked your answer as correct as I am starting to think the short answer is yes.

It behaves differently from other OBS's.

As I posted

Secondly it is expected that rights based on that OBS to say a group. - In my case that is possible

If OBS based right were given a member of the group sho isuld have eg displayed in the OBS rights of the user properties - in my case they are not

Finally when there are OBS based rights assigned to a user they should work as designed - in my case they don't.

Now that I think back I kinda remember  Dave_3.0     pointing out something like that the last two behave just like that.

The final test is to test the rights: do the work as expected. In my case they do.

So to use a financial OBS for access rights the "supported" way is to make the choice before associating that with an entity.

If you think it more cumbersome to change a financial OBS used for access rights than changing the department structure not used for access rights and a copy of it as an OBS structure used for access rights would you please elaborate.

Rights on departments work fine, it's more the effort maintaining the OBS I was cautioning about.

if you have a very large organisation, maintaining a team level structure through the departments is very painful. (no move capability, so you can't lift and shift)

If you need a very granular OBS to support a rights model, you may want to think about keeping the departments high level and having a separate detailed OBS.

I'd like to hear more about how other users are using the "department" OBS

There seems to be a "feature" in v13.2

If you have any OBS used for security all are available for selection when you create OBS rights for a group.