Referencing a Multi-Valued attribute

Brian,
With all due respect to John Henley (the master), there's an easier way.

The user.attributeContains function is the one designed to work with multi-valued attributes. It hunts through the values for a match, and returns a positive if found - so you don't need to code the logic to search through multiple values. Let me know if you need to see a sample, and I'll post one here.

Best regards,
Dave
(303) 773-3535

Yes, please do Dave, I'd appreciate it.

Would you have any samples of how to code within a security rule beyond an if/then? I'm confident John's code would work in process flow (where I can write open Javascript), but I couldn't get the rule editor to take it or work with it. It always wants to hard code the if / then statement.

Thanks again

Here's an example that shows several things. I see that it's somewhat overkill in that it's using the getDBFieldByIdx function when getDBField would suffice:

getDBField - uses the primary index to grab a record, from which you can interrogate any field in that record.

getDBFieldByIdx - uses any index you want, to accomplish the same purpose (use this to find a record when your keys fit a secondary index and not the primary one).

I'm using EMPSET1 in this call, which is the same thing that the simpler getDBField function would do - I should have used getDBField instead (that's what I meant by overkill).

The multi-valued attribute called TimeKeeper holds one or more SEC-LOCATION's in which this user is authorized to manage time records.

This rule is attached to PR35.2 to ensure that this user (who is a time keeper and has values attached to them in the custom TimeKeeper multi-valued attribute) has the SEC-LOCATION for this employee included as one of their attributes.

if(user.attributeContains('TimeKeeper',trim(getDBFieldByIdx('EMPLOYEE','SEC-LOCATION','EMPSET1','0001',form.TRD_EMPLOYEE))))
'ALL_ACCESS,'
else
'NO_ACCESS,'

Starting with the getDBFieldByIdx call, we grab the employee number on the screen (form.TRD_EMPLOYEE), and go to the EMPLOYEE table using company 0001 and that employee number to get the SEC-LOCATION.

The attributeContains function then searches through this user's TimeKeeper multi-valued attribute for a matching SEC-LOCATION. If found, success. Otherwise, that timekeeper isn't allowed to enter time records for that particular employee, and gets a security violation.

That controls what the timekeeper can do in PR35.2. There's another aspect to keep in mind, though. When the timekeeper clicks on the selection list icon beside the employee number, the resulting list includes ALL employees - even though they can't touch most of them because of their SEC-LOCATION. Annoying at best, or frustrating and time-consuming if they need to hunt through the big list to find specific employees.

TABLES control what the user sees in selection lists, drills and Microsoft Add-Ins.

To fix this situation, you would put a rule, similar to the one above, on the EMPLOYEE Table, which must be in an LS9 Security Class connected to the TimeKeeper's Role. That would slow the response when the TimeKeeper clicks on the icon to get the employee list, but the list would then contain ONLY the employees they're authorized to manage time for (employees with a SEC-LOCATION matching one of the ones in the TimeKeeper's multi-valued attribute).

It can be difficult to get the trims and everything working correctly in the rule, so I prefer to test incremental parts of it by hard-coding values like this:

user.attributeContains('TimeKeeper','SecLoc1')

Put SecLoc1 (or some real SEC-LOCATION) in as one of your TimeKeeper multi-valued attributes and get this working. Then try the employee side of the rule by itself (I'm using employee 1234 in this case):

getDBField('EMPLOYEE','SEC-LOCATION','0001',1234)

Adjust tic marks, trims and whatever else to get that piece working. Then put the pieces together.

Sorry - this is turning into a lengthy LS9 training course!
Did that all make sense?

Best regards,
Dave
(303) 773-3535

Nice! Thanks for posting. =

Thank you both, this was very helpful.