Normalization and instance permissions
Earlier than version 7.6.03, you could set row-level permissions by editing the CI, by applying default class permissions when creating a CI, or by creating a custom workflow. You can now use the Normalization Engine to set these permissions for specified classes and, with BMC Remedy AR System qualifications, specific instances.
To use the Normalization Engine for instance permissions, you must complete the following steps:
- Define the rules for setting the row-level permissions. (See Creating normalization rules to set row-level permissions.)
- For each dataset, enable the row-level security feature. (See Normalization settings for datasets.)
In addition to the CMDB Data View and CMDB Data Change roles, users must also have row-level access to instances. Each class has two attributes that specify users with read and write access to the class instances.
CMDBRowLevelSecurity— Users who are members of a group with row-level access have permission to view the instance if they also have the CMDB Data View or CMDB Data Change role.
CMDBWriteSecurity— Users who are members of a group with write access have permission to modify the instance if they also have row-level access and the CMDB Data Viewer role. This permission is useful for giving someone write access to a specific instance without giving write access to all instances with one of the CMDB Data Change roles.
You can define groups for the following permissions:
- View — Members of these groups and roles can view the attribute in the class form, but cannot modify its value.
- Change — Members of these groups and roles can view and modify the attribute value.
For more information about permissions, see BMC Atrium Core permission roles within applications.