The Hierarchical Groups feature extends row-level security where the parent group has access to the data that belongs to its child groups. The following image shows parent/child relationships in a hierarchical group.
For more information about hierarchical groups, see the following topics:
- Using a parent group for permissions inheritance
- Controlling access to requests for Hierarchical groups
- Configuring settings E-M
- Assigning permissions for individual or multiple objects
CMDB attributes and groups that define permission for hierarchical groups
During installation or upgrade, the following new attributes and groups are added silently to all the root-level classes that define hierarchical permissions.
- CMDBWriteSecurity_Parent(Field ID: 60914)
- CMDBRowLevelSecurity_Parent(Field ID: 60989)
Note: Child classes inherit the above fields from the parent class.
- Dynamic groups with group IDs 60914 and 60989.
Note: The permissions list of the RequestId field, includes the two new permissions consisting of the dynamic groups.
The mapping between the permission field and the associated parent group field is displayed on each form in the Dynamic Permission Inheritance field under permissions tab. For example, If the permission field is 112, the associated parent group field is 60989.
On the form other than the CMDB class forms, for example the Product Catalog forms, the 112 permission field and the associated parent group field 60989 is seen along with RequestId and permission mapping (if applicable).