One of the great features of FX is the ability to restrict financial report access to the user's assigned departments. This assignment is done by user SYS in the Financial Reporter by right-clicking on any department in the View | Departments list, and selecting "Edit user departmental restrictions", then ticking the appropriate boxes.

When assigning departments to a user, the individual departments and departmental ranges both show up to be ticked. However, it turns out that ticking a departmental range does nothing; the individual departments must be ticked in order to assign departments to a user.

There are two possibilities here - either Softrak intended to allow assigning at the individual departmental only, and the departmental ranges should not be displayed on the list, or Softrak intended to allow assigning at the departmental range level, and it is not working properly.

I'm hoping it's the latter, and that Softrak will get it working properly, because maintaining the departmental restrictions at an individual level can become a very tedious process when there are lots of users and departments.

But if it's the former, please remove the bogus departmental ranges from the list to avoid confusion.

This might apply to Ledger as well - I have not tested it out.

Thanks

Steve

Hi Steve,

This is working for me in my simple test in the sample data. But there is a question here:

If you grant a user access to a range of accounts, but not access to one of the accounts that makes up that range, what is your expectation of the behavior? In my test I gave a user access to 100:150, but not to either 100 or 150 as individual departments. I also tested with a wildcard mask ("?50") and a list ("100;150;200"). The ranges selected were the only items in the department drop down selection for the user. The individual departments do not show up unless they are also ticked.

My expectation is that every item you check as permitted for a user would show up in the drop down. What are you experiencing?

My expectation is that when you tick an item, whether it's an individual department or a departmental range, the user is granted full access to that department or range. In other words, each item stands on its own.

If it is mandatory that each individual department within a range be ticked for the user to be granted full access to the departmental range, then why bother offering the departmental range box as an option to tick. Ticking it or not ticking it makes no difference. It should show up on the dropdown list only if all of the departments in the range are ticked.

Your scenario is the exact issue that resulted in my posting. A client added a new department and it wasn't showing up in the departmental range report. They didn't expect that they would have to tick the individual department, because the departmental range was already ticked.

Steve

Hi Steve,

That's exactly the way the department selection drop down is working, so what are are you referring to?

Hi Andrew,

Reread Steve's last paragraph. I think you're saying the same thing except that Steve is pointing out that when a department is added within the previously selected range, it doesn't show that new department in the totals.

Just like the .Range command on the statement, a departmental range should include any newly created departments that fall within that range.

You may have to hit the Refresh button, or have ".AutoUpdate" in cell A2. If the department is in the range, then it will be included in the figures. If it isn't being included, then there is something other than security likely causing the problem.

Hi Steve,

I confirmed after my last post that when adding department 225 to the sample data and doing a new retrieve, a previous user restriction allowing the range 200:250 includes the entry I made to department 225 in the report. So it works for me.

Hopefully I interpreted your comments correctly.

Well it doesn't work for me, nor for my client. And of course I am Refreshing.

In the sample data, set up a test user ZZZ and give them access to dept 100 and dept range 100:150, but don't give them access to dept 150.

Then launch the statement AF!DepartmentSummary.SAM and expand it. As user SYS, you will see departments 100 and 150, but as user ZZZ you will see only dept 100, even though they have access to the dept range itself which includes dept 150. That's just not right!

To repeat from above, giving user ZZZ rights to the dept range has no effect. It should either work properly (giving the user access to all of the departments in the range) or the dept range should not appear as an option for granting access and should only be available from the dropdown list if the user has access to all of the individual departments in the range. I'm hoping it will be the former.

Steve

Hi Steve,

Thanks for the detailed series of steps to re-create what you are seeing. Your first post does not mention the "DepartmentSummary" financial statement or the "RangeDept" SmartSheet command, so Dan and I both started with different statements that do not exhibit a problem. Bugs are always obvious when you find them (and know how to create them).

The actual problem is:

But the programmer can argue that the program is working as they expected, since access has not been granted to the individual department numbers, only the summary total (and in the DepartmentSummary statement, the summary total is correctly calculated and displayed).

Perhaps the correct method of changing the program so it works the way you and your client would prefer, would be to automatically enable all the individual departments when a department range, wildcard or list is chosen. The next question would be, if you deselect an individual department, does the program need to scan all the ranges and disable all the ranges that include the department to be hidden?

For consistency (especially so you don't see the kind of problem you describe here), I think the answer has to be "yes". However, this means that it will become impossible to get the kind of result you see now - where a user is allowed to see a summary total, but not the department details that go into that total. That might be a desirable thing at some sites.


This also raises a question when a new department is added. If the new department is in a range, should it be automatically enabled? The argument would be "No" - the range should be disabled - to ensure the security is set the way the user desires (and to be consistent with the security handling elsewhere in Adagio).

So, in the interim, while these decisions are decided and implemented, your client will need to enable the individual departments if they want the user to be able to see the individual departments on expansion of "RangeDept".

I'll get R&D involved in this discussion.

Thanks for bringing this to our attention and I apologize for the long reply.

I too was originally looking at an income statement without the rangedept command. So I saw the balances of the accounts change when I selected the department range. What I didn't test was the drill down. So now I see that the drill down does not show the details of the dept that isn't ticked.

Sorry for the confusion Steve.