Clarity

Hi All,

We need to remove specific instance level rights for a user using a process.
We are using Clarity V12. Any help on how to achieve this is much appreciated.

Thanks in advance.


Regards,
Shruthi

Hi,

Please provide more details!!

Generally to revoke rights from a user through process, one would write a GEL Script to XOG IN the user without the access rights and with the option COMPLETED=True in the XOG Write file!!

You need to be cautious while using this approach, the more approriate and suitable solution is to grant the rights to a Security Group and remove the user from the security group whenever you want to revoke the access from the user.

Regards,
Mathan

Hi Matt,

Thank you so much. Your suggestion helps.

Just have a quick question. In case the user has many instance level rights and I need to revoke one say "project_view" right,I need to know all the other rights the user has.

Is there a better way to do this other than Xogging out the user's xml and parsing it? Any idea which tables would give me the list of instance level rights?


Thanks,
Shruthi

CMN_SEC_ASSGND_RIGHT
CMN_SEC_ASSGND_OBJ_PERM

These are two tables where you can find the relationship between User/Group and assigned access - System/OBS/Instance.

However, if you are thinking of using these table to run DB commands for add/remove rights, I would recommend you choose another path. The DB relations of Access Rights Tables is complicated and you would it notice when you browse the above tables and other related tables.

If at all you want the process automated, GEL process would better suit the situation. However, if you want to remove rights for a single user at a time, manual approach is just the best! -_-

Hope that helps.

~Dev

Hi,

Adding to what Dev has replied, Access Rights related data model is pretty complicate in CA Clarity.

Moreover, performing delete operation on any of the table is not recommended and needs CA Approval.

The best way is to write a simple GEL Script, to query all the instance rights held by the user other than the Instance rights you wanted to revoke and form a XOG write file with Completed = TRUE option.

If you need assistance in write a sciprt, let me know.

Regards,
Mathan

Hi,

I would like to delete the access rights of an user through GEL/XOG. I have to call XOG scripts through GEL but not able to get any idea how can I do so through XOG ? Please assist me how can i use Completed=True option in XOG file as you suggested in your last message.


Regards,
-Sunil

Hi Sunil,

Did u get any reply about how to use the tag mentioned in gel script to reoke any instance level right of the sub page. If yes , please share with me .

Thanks .

info_tel wrote:

how to use the tag mentioned in gel script

The "tag" is in the XML passed to XOG and does not have anything to do with GEL (GEL would just be used to call the XOG service). And you just specify it in the access rights section of the relevant XML.

Hi Dave,

Thanks for your reply . I would like to know how to use the tag in gel script which can be to used to revoke the specfic instance right of a sub page .

I have the below gel script which we use for giving an instance right to a user , in the same way can we use some tag in the gel script and script can be used to remove that instance right on the sub-page.


<NikuDataBus xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../xsd/nikuxog_user.xsd">
<Header action="write" externalSource="NIKU" objectType="user" version="12.0.2.5101"/>
<Users>
<User externalId=""
userName="aaaaa">
<PersonalInformation emailAddress="aaaa@bbb.com" firstName="xyz" lastName="cde"/>
<Resource resourceId="aaaaa" />
<InstanceRights>
<Right id="yyyyyyyyyyy" >
<InstanceObject id="A.xxxxx" type="SRM_PROJECTS" />
</Right>
</InstanceRights>
</User>
</Users>
</NikuDataBus>

That is NOT a GEL script. :wacko:

That is the XML that you can pass to XOG. 8o


So you just include the "tag" in the instance rights section.

i.e.

<InstanceRights complete="true">

Why don't you just try it and see what happens? :tongue

Hi ,

Thanks for the correction .

I tried using this complete ='true' tag but this removes all the instances right of the mentioned user in the xml but I want one specfic instance right to be removed for the user.

Do we have any other way rather than removing all the rights using complete = "true" tag and then xog in all other instance rights apart from the one which is going to be removed.

Thanks.

info_tel wrote:

I tried using this complete ='true' tag but this removes all the instances right of the mentioned user in the xml.

Yes, that is how it works.

So you need to supply (in the XML) all the rights that you wish to keep when using 'complete="true"' - look at it as if it means "this is the complete definition of the rights".

info_tel wrote:

Do we have any other way rather than removing all the rights using complete = "true" tag and then xog in all other instance rights apart from the one which is going to be removed.

No - :sad - so you "XOG out" the user, remove the access right you want to delete from the XML, add the complete="true" flag to the XML and then XOG it back in again.

(or build up the XML using a SQL query, but that involves an understanding of the access rights data model)

Dave:

remove the access right you want to delete from the XML, add the complete="true" flag to the XML and then XOG it back in again.

I need to remove a user from a particular project using Gel script. For that I XOGed out the user and write into a file . Now I need to delete the XML tag for tha particular instance.

How we will delete the XML tag  to remove the access ..

 

 

Thanks