Help on Security Suite - Groups and Roles

[bernyperera]

Hi Forum,

My sugar : 5.5.0 CE

I have just installed SecuritySuite (GA_2.1.1_for_550) and works fine.
But I do not understand how to configure the following scenario.

My requirement is as follows.

I have 3 Roles defined as Managers, Executives and Employees.

Case 1:

Managers create Tasks and assign to Executives (or Employees).

So now the assigned task should be able to be

(a) list, view and edit by the Manager (who created it) and the assignee ONLY.
(b) others in the system should not be able to list or view the Tasks created by the Manager and not assigned to them.

Case 2:

Employees or Executives create Tasks and assign to Manager, Executives or Employees.

Now the assigned task should be able to be

(a) list, view and edit by the creator and the assignee ONLY.
(b) if the assignee is NOT the Manager, he should not see the tasks created by the others which are NOT assigned to him.

Summary

The tasks created should be accessible (list, view and edit) to the CREATOR and the ASSIGNEE ONLY

Please let me know what groups need to be created to achieve this and what roles need to be defined (with regard to Tasks)

What should be Security Suite settings ?

Thank you,
Berny

[eggsurplus]

It sounds like you need to just have the roles set to Task->Owner. This should completely fill your needs as the created by and assigned to users are both treated as owners in data/SugarBean.php->getOwnerWhere.

[bernyperera]

Thank you so much eggsurplus,

Can you kindly elaborate on this please.

I tried setting Task list and view to "owner".
But when a task is created and assigned to someone else, the ownership gets assigned to the assignee and the creator cannot view the task he created.

What changes (if any) do I have to do on data/SugarBean.php ?

And by the way, what should be the settings for Security Suite ? and what groups need to be created ?

Thank you again for your help.

Best Regards
Berny

[eggsurplus]

OK, that makes sense. This change is not upgrade safe but you got to do what you got to do sometimes. Open data/SugarBean.php and look for:

     function getOwnerWhere($user_id)
    {
        if(isset($this->field_defs['assigned_user_id']))
        {
            return " $this->table_name.assigned_user_id ='$user_id' ";
        }
        if(isset($this->field_defs['created_by']))
        {
            return " $this->table_name.created_by ='$user_id' ";
        }
        return '';
    } 
  

and change to:

     function getOwnerWhere($user_id)
    {
        if(isset($this->field_defs['assigned_user_id']) || isset($this->field_defs['created_by']))
        {
            returnStr = " (";
            if(isset($this->field_defs['assigned_user_id'])) {
                returnStr .= " $this->table_name.assigned_user_id ='$user_id' ";
            }
            if(isset($this->field_defs['created_by']))
            {
                if(returnStr != " (") returnStr .= " OR ";
                returnStr .= " $this->table_name.created_by ='$user_id' ";
            }
            returnStr .= ") ";
            return returnStr;
        }
        return '';
    } 
  

I haven't tested it and there are probably better ways to code it but the general idea is to treat both the created by and the assigned to users as owners. The original code returns the assigned user as the owner if there is an assigned user id field which means the created by doesn't get used in your case.

[bernyperera]

Thank you again eggsurplus,

So do you think that I do not need Security Suite to accomplish this ?
It looks to me that this change will apply to records in all modules.
However I wanted to apply this only to Tasks.
Is this achievable ?

I am extremely sorry for the troubles and I apologize.

Thanks & Regards,
Berny

[eggsurplus]

Only set the rights for Tasks and you'll be fine. Yes, in your case just the built in roles should be fine. If for some reason you need to group users into teams of users then a module like Security Suite would be perfect for you. There are some things in Security Suite that may be useful in itself without using teams such as the Additive security option which takes all your roles and gives you the greatest of the rights. By default Sugar is restrictive which gives the least of your roles which works for some organizations.

[shailendra001]

Hi !

I had SecuritySuite on SugarCRM 5.5 was working fine , now i have upgraded into SugarCRM 6 , and SugarSuite stoped working because in role management only defalut values of drop down(owner, all , not set etc) are availabe set to Group option is not there .

1) is there any code change required to make it work ?

Could you please help me on this

[eggsurplus]

The version of Security Suite must match the version of Sugar. The version for 6.0 has not been made available yet. Expect it to be ready to download next week on SugarForge.

[bernyperera]

Thank you once more eggsurplus,

I am so sorry for the late reply.
I appreciate your support.

Cheers
Berny

[shailendra001]

Hi eggsurplus ,

We are waiting for updated version of Security Suite , compatible with SugarCRM 6
Hope we will get updated version of this soon

I would like to thank you for your great contribution to the Open source software


Regards
Shailendra Kumar