Why does custom selection script @user requires the "Administrator" username?

Hello,

i am working on database security profiles.

I have a user_name entity in which a few of my business users are stored. I don't need all users to be in this entity.

I want to implement the simple custom selection script Select user_name = @user, see screenshot below.

But then i got this error message Warning! <user_name = Administrator> not found.

Why should the member Administrator be in all the entities used within custom selection scripts? I am asking because i have several entities using the @user selection script, see this example:

How can i define a custom selection script using @user substitution formula without adding the member Administrator to the relevant board entities?

—

Board v14.4 on premises

Find more posts tagged with

Data Access Control

Security

Board 14

Accepted answers

All comments

Robert Barkaway

Hello Arnaud, you should use separate Roles for the Administrator and for Users, the Administrator role should have no restrictions, including custom selection scripts, the User role should be the one with restrictions.

Arnaud Villemain

you should use separate Roles for the Administrator and for Users, the Administrator role should have no restrictions, including custom selection scripts, the User role should be the one with restrictions.

But that is what I already do. My original message might have been misleading then, but i have not written that the Administrator role has restrictions in my case….

Anyway, the Administrator user is the one which is working in the database security profiles, defining the security restrictions of other users.

If you want to reproduce my issue, it is quick:

i assume you have a user named "Administrator". It has no restrictions.
create a new entity user_name and add two members into it: user1 and user2. Nothing more!
go into data model security profiles and try to create a new profile having this custom selection script Select user_name = @user
you should see the orange warning message Warning! <user_name = Administrator> not found. preventing you to save the change

Robert Barkaway

Okay, I assume you've previously created the Administrator role and that the Administrator user is set to connect to the database with that role? The only reason I can see that it would be giving you the message it is, is if this is the first role you've created on this database and your server profile is defaulting to connecting with that role. You should always create the Administrator role first with no restrictions, full database admin access, etc., and only then create the User role with its limited access - is that what you're doing?

Arnaud Villemain

yes, i started with Administrator and after defined the other users and roles.

Here the administrator:

data model security:
in system administration → security → profiles:
in system administration → security → users: