Skip to main content

Multiple User Group Permission Configuration for a Single User

Scenario Description

User group permissions are configured in the dataset, but in the card, data outside the permissions can still be seen:

image.png

Root Cause

After testing, it was found that if a user is in a child user group, and the child user group belongs to a parent user group, then the permissions of both user groups will affect that user.

Specifically for the client's scenario, because the visible fields take the union, for example, the Children's Wear Omnichannel user group has permissions to see direct sales, online, and distribution. The Children's Wear Distribution user group, as a child of the Children's Wear Omnichannel user group, even if the permission is set to only see distribution, but because the user belongs to the Children's Wear Distribution user group, and the Children's Wear Distribution user group belongs to the Children's Wear Omnichannel user group, their visible permissions are direct sales, online, and distribution.

Solution

It is recommended to split the Children's Wear Omnichannel user group into three (or multiple) parent user groups, and then set permissions for each.

Or if there are many users and rebuilding user groups is troublesome, you can create a parent user group without permissions, move the child user groups to the parent user group without permissions, and then set the corresponding permissions directly in their respective child user groups.

Additional FAQ

Q: If a user is both in Group A and Group B; Group A has permissions set, Group B has no permissions set. Will the data permissions take effect at this time?

A: Yes, permissions take the union.

Q: A dataset has 5 fields, and a user is both in user group A and user group B. User group A is set to not see field 1 and field 2, user group B is set to not see field 2 and field 3. Which fields can this user not see?

A: If the relationship between user group A and user group B is a parent-child relationship (one group belongs to another group), then this user cannot see fields 1, 2, 3, that is, invisible fields take the union. If there is no relationship between user group A and user group B, then this user cannot see field 2, but can see fields 1 and 3, that is, invisible fields take the intersection.