Granting permissions selectively¶

Grant permissions selectively by using uiElementValue Properties. You can selectively provide access to tools and features in the System Admin and Digital Factory Toolsets by configuring tab access.

To configure tab access, use the uiElement and uiElementValue subjects and properties. The uiElement subject has only one possible property, name. The uiElementValue subject has several properties. Each uiElementValue property maps to a first- or second-level tab in the System Admin or Digital Factory Toolset.

Each tool in the System Admin and Digital Factory Toolsets contains at least one tab. Tabs contain settings that you use to configure the tools. Each tab has a name that differs from the names of all other tabs for that tool. Tabs are classified as either first- or second-level tabs.

If a tool has only one first-level tab, the name of the tool and tab are identical. For example, the single, first-level Migration Import Tool tab is named Migration Import Tool and the single, first-level Digital Factory Manager tab is named Digital Factory Manager. For these cases, when you open the tool, the first-level tab appears.

If a tool has more than one first-level tab, when you open the tab, the first-level tabs appear in a clickable list.

A second-level tab is a tab that appears or is listed on a first-level tab. First- and second-level tab sets are considered multi-generational. The first-level tab is referred to as a parent tab, while each second-level tab is referred to as a child tab.

For example, in the System Admin Toolset, the System Administrator tool contains a first-level tab named Groups. The Groups tab contains three second-level tabs:

Associated Permissions
Members
Attributes

Each of the three second-level tabs is a child of Groups, which is their first-level parent tab.

Similarly, the Data Deployment tab is a first-level tab that you use to configure the Data Deployment tool in the Digital Factory Admin Toolset. These second-level tabs are children of the Data Deployment tab:

Currency
Process Groups
Cost Taxonomy Display Names

These tables include the uiElementValue property mappings for all the first- and second-level tabs in the System Admin and Digital Factory Toolsets that you can control access to. Child tabs are listed in the indented cells of rows below the row that contains their parent tab.

Toolset	Tool	Tab Name	Tab Name	Level	uiElementValue Property
System Admin Toolset	System Administrator	LDAP connections		First	ldapConnections
System Admin Toolset	System Administrator	Users		First	users
System Admin Toolset	System Administrator	Roles		First	roles
System Admin Toolset	System Administrator	Licenses		First	licenseModules
System Admin Toolset	System Administrator	Deployment - Default		First	deployments
System Admin Toolset	System Administrator	Groups		First	groups
System Admin Toolset	System Administrator		Associated Permissions	Second	groupPermissions
System Admin Toolset	System Administrator		Members	Second	groupMembers
System Admin Toolset	System Administrator		Attributes	Second	groupAttributes
System Admin Toolset	System Administrator	User Defined Attributes		First	userDefinedAttributes
System Admin Toolset	System Administrator	Dialog Views		First	dialogViews
System Admin Toolset	System Administrator	Permissions		First	permissions
System Admin Toolset	System Administrator	System Variables		First	systemVariables
System Admin Toolset	System Administrator	Composites Mapping Files		First	compositeMappingFiles
System Admin Toolset	Migration Import Tool	Migration Import Tool		First	migration

Granting “Open” permission for the Migration Import Tool, enables users to run the utility but does not enable users to edit the utility settings. Users can edit the utility settings only if you grant them “Edit” permission for the Migration Import Tool.

Toolset	Tool	Tab Name	Tab Name	Level	uiElementValue Property
Digital FactoryToolset	Digital FactoryManager	Digital FactoryManager		First	vpeManager
Digital FactoryToolset	Cost Model Workbench	Cost Model Workbench		First	costModelEditor
Digital FactoryToolset	Process Group Site Variables	Process Group Site Variables		First	procesGroupSiteVariables
Digital FactoryToolset	Deployment Data	Deployment Data		First	deploymentData
Digital FactoryToolset	Deployment Data		Currency	Second	deploymentDataCurrency
Digital FactoryToolset	Deployment Data		Process Groups	Second	deploymentDataProcessGroups
Digital FactoryToolset	Deployment Data		Cost Taxonomy Display Names	Second	deploymentDataCostTaxonomyDisplayNames
Digital FactoryToolset	BOM Loader	BOM Loader		First	bomLoader

Granting “Open” permission for the BOM Loader, enables users to run the utility but does not enable users to edit the utility settings. Users can edit the utility settings only if you grant them “Edit” permission for the BOM Loader.

All the open and edit permissions that you apply for the vpeManager settings are extended to these plugins:

Push Plant Variables to Descendants
Add/Update Machine Field
Add/Update Material Field
Create New Process
Search CSL

To access the plugins, in the Digital Factory Toolset menu bar, click Tools.

Grant admin permissions to only a specific group¶

This example shows how you can grant administration permissions to only the users in a certain group by using uiElementValue properties. To enable open and edit rights to the System Admin Toolset for managing users only, the example applies the users uiElementValue property:

Open the Permissions tab. From the aP Pro menu bar, select Tools > System Admin Toolset > System Administrator > Permissions.
In the Permissions tab, create and configure the new permission:
1. Under the permissions list, select the Add, , button.
2. In the Input tab, for Permission Name enter YC.SystemAdmin.Users.OE and then click OK.
3. In the Permissions tab, for:
  - Description: Enter Allow configured admins rights to the manage users.
  - Resource: From the drop-down menu, select System Admin.
  - Action: Select Use, Open, Edit, and When this rule is true. For:
  - Subject: Select uiElement.
  - Property: name is the only option.
  - Operator: Select ==
  - Subject: Select uiElementValue.
  - Property: Select users.
    
    For this configuration, the generated rule is uiElement.name==uiElementValue.users
  - Grant: Select Normal: Actions are permitted unless blocked by a Strong Deny permission.
  - Deny: Select Normal: Actions are blocked unless permitted by another permission.
To save your changes, click the publish, , button.