topic Re: Role based permissions at DataSet level in Data Management Questions

Role based permissions at DataSet level

JeffGriggs1 — Wed, 09 Mar 2011 19:47:04 GMT

Does anyone know if it is possible to grant permissions at the DataSet level based on a role instead of individual users?

Thanks,
Jeff

Re: Role based permissions at DataSet level

VinceAngelo — Wed, 09 Mar 2011 21:44:46 GMT

The grant and revoke API functions accept roles in the "user" parameter.
I always grant access through roles.

- V

Re: Role based permissions at DataSet level

JeffGriggs2 — Wed, 16 Mar 2011 19:17:17 GMT

Thanks Vince!

Re: Role based permissions at DataSet level

RandyKreuziger — Thu, 17 Mar 2011 19:03:16 GMT

Roles are the way to go.

Now is anyone mapping windows groups to roles rather than adding the users to the database and assigning the database user to roles?

For example
Windows group Parcels --> SQL role Parcels
instead of
SQL users Joe, Ted and Max ---> SQL role Parcels

Our business IT group is going that way so I'm going alway with it. But when I added all my windows users to SQL I could bring up their userid and see all the roles that user was a member of my database. With windows groups I have to query active directory which generates a list of all groups the userid is a member of. These include email groups, project groups etc. It just isn't very clean.

Re: Role based permissions at DataSet level

RobertHu — Thu, 17 Mar 2011 23:39:25 GMT

Yes, I map domain groups to DB roles in my publication GDB (read-only).