Hello,

I have some problems with Data Restriction. The first problem, If I define Data Restriction under the security group, Restriction is not working. For some reason, I don't understand global data restriction is blocking my rule. 
What I want to do;
If a fault is raised by a user in one security group, only users in that security group should be able to view and edit that fault. I have defined global data restriction. 
Object = INCIDENT,  Applocatin = Fault, Type = QUALIFIED and Condition = FAULTHIDE
Expression =

SELECT TICKETID , receivedby  FROM INCIDENT WHERE class = 'INCIDENT' and status != 'RESOLVED' and receivedby = :user and exists (select 1 from groupuser where groupname='FRC=RESTRICTIONS' AND  USERID=INCIDENT.RECEIVEDBY)

and exists (select 1 from groupuser where groupname='FRC-RESTRICTIONS' and  userid = :user));

PS: I used the field INCIDENT.RECEIVEDBY to determine this

But this query is not working properly, each login user sees their own data. I login with the admin user, only the records of the admin user are listed. 
How can I fix this issue according to the requirements?
Many Thanks,

------------------------------
Alan
------------------------------
#Maximo
#AssetandFacilitiesManagement

Hi Alan,

I haven't had the time to test this fully but i think you need an expression along the lines of:

select * from groupuser where groupname in (
select distinct groupname from groupuser where groupname in (select groupname from groupuser where userid = :RECEIVEDBY))
and userid = :username;

This returns a list of groups that match between the ReceivedBy user and the current logged on user.
So if the logged on user is not in any of the groups that the ReceivedBy user is a member of then you could make it Qualified so these records are not displayed.

One thing you may also need to validate is to only consider the groups that have access to the Incidents application as you may have some groups that all users are in and this would not work.

Hope this at least gives you some ideas to progress

------------------------------
Steve Lee
Maximo Technical Sales Specialist
IBM
Leeds
------------------------------

Your condition should only be the where clause, so I'm going to assume the "SELECT... FROM INCIDENT " of your query isn't actually there. It seems like you want anyone in the group to have the ability to see any of the faults if it was reported by them or someone else in the group. But in your where clause you have a receivedby=:user which will filter only to where the receivedby is the current user. 

I'd also recommend avoiding status filters in a data restriction unless these users really should never see the historical record, at which point you also should also include historyflag=0. The way it's written they would be able to see when it goes into a closed status (since there is no filter for historyflag=0). It would be weird to block a single status.

------------------------------
Steven Shull
Director of Development
Projetech Inc
Cincinnati OH
------------------------------

Hi Steven, 

Thank you for the warning.  I added the changes to my SQL.

Thanks,

------------------------------
Alan Egman
London
07555344655
------------------------------

Original Message:
Sent: Mon October 12, 2020 08:25 AM
From: Steven Shull
Subject: Data Restriction Probblem

Your condition should only be the where clause, so I'm going to assume the "SELECT... FROM INCIDENT " of your query isn't actually there. It seems like you want anyone in the group to have the ability to see any of the faults if it was reported by them or someone else in the group. But in your where clause you have a receivedby=:user which will filter only to where the receivedby is the current user. 

I'd also recommend avoiding status filters in a data restriction unless these users really should never see the historical record, at which point you also should also include historyflag=0. The way it's written they would be able to see when it goes into a closed status (since there is no filter for historyflag=0). It would be weird to block a single status.

------------------------------
Steven Shull
Director of Development
Projetech Inc
Cincinnati OH
------------------------------