File cabinet permissions control who can access a file cabinet and its documents, and what users are allowed to do there, for example store, search, edit index entries, or delete documents. The individual rights are bundled in profiles, which you assign to users and roles.
You configure permissions in DocuWare Configurations > File Cabinets > File cabinet x > Permissions.
Four default profiles cover the common cases: Owners, Edit, Read, and Delete. For other requirements, you create user-defined profiles, or index value profiles that give access to specific documents only.
Permissions work together with dialogs. To access documents, users need both a profile and an assigned dialog. Field permissions also decide which fields users see in the dialogs.
Default profiles and their rights
The default profiles contain the following individual rights:
Profile | Administrative permissions | General permissions | Field rights | Overlay permissions |
|---|---|---|---|---|
Edit | --- |
|
|
|
Read | --- |
|
| --- |
Delete | --- |
| --- | --- |
Owners |
|
|
|
|
The four default profiles Edit, Read, Delete, and Owners cannot be changed. You can, however, create new file cabinet profiles and assign users to them.
Administrative permissions and visible sections
Which sections of the file cabinet settings users see depends on their administrative permissions:
Owners: all four sections are shown, General, Database Fields, Dialogs, and Permissions.
Operator, Manage dialogs, and Manage permissions: all four sections are shown, General, Database Fields, Dialogs, and Permissions.
Operator and Manage dialogs: General and Dialogs are shown.
Operator and Manage permissions: General, Database Fields, and Permissions are shown.
Manage permissions: only the Permissions section is shown.
Manage dialogs: only the Dialogs section is shown.
Assigning profiles
To edit documents, users need both the Edit and the Read profile.
To print documents, users need the Read profile, because it contains the Export right.
If a user other than the creator of a file cabinet needs to edit the file cabinet, the file cabinet owner must assign them the Admin permission.
To access the documents in the file cabinet, users must be assigned dialogs as well as permissions.
More information about the permission concept in DocuWare
As an administrator, you find an overview of the file cabinet permissions of a specific user in DocuWare Configurations > User Management.
New DocuWare client: what has changed
In the new DocuWare client, introduced with DocuWare 7.15, only the file cabinet permissions decide which documents users can see. If you hide fields in a search dialog, users with access to a document can still find it by its index values. The search works directly on the file cabinet and ignores visibility settings in dialogs. Confidential information is therefore protected through file cabinet and document permissions, not by hiding dialog fields.
Advanced
Profiles
Profiles bundle rights in "containers", so you do not have to assign many individual rights. A profile can be assigned to any number of users without changing the rights structure by hand.
Here in DocuWare Configuration, you create and edit profiles for file cabinet permissions. File cabinet permissions are rights that relate exclusively to one file cabinet, for example storing and searching documents, changing index entries, or exporting documents or a file cabinet to the file directory.
File cabinet profiles and file cabinet permissions can also be created and edited in DocuWare Administration.
More about rights and profiles in DocuWare
Default profiles
The file cabinet rights are divided into four predefined profiles: Owners, Edit, Read, and Delete.
New profiles are created as user-defined profiles.
User-defined profiles
In a user-defined profile, you compile file cabinet permissions and index field permissions yourself and assign them to users and roles.
File cabinet
Some file cabinet permissions also require index field permissions. For example, to use the file cabinet permission "Store", users must be able to write in at least one index field, so that the document can be indexed.
Index fields
All fields of the file cabinet are listed in the left column of this dialog. Specify what users with this profile are allowed to do with each field.
Some activities require several permissions. For example, to edit documents, users need both the Modify and the Read permission, because only then are the documents displayed.
Field permissions also affect the visibility of fields in dialogs. Without the field permission "Search", users do not see the field in the search dialog, even if it is assigned to the search dialog at dialog level. The same applies to "Read" for the result list, "Write" for the store dialog, and "Modify" for the index dialog.
Index value profiles
Default and user-defined profiles relate to the entire file cabinet. An index value profile, in contrast, makes only specific documents accessible for a profile.
Query definition
There are two ways to enter the search conditions:
Graphical editor: search criteria per index field
SQL: an SQL statement
Graphical editor
In the graphical editor, select the fields of the file cabinet and define the rules (conditions) that documents must meet to be visible for users with this profile.
You can create as many rules as you like and combine them with the AND/OR operators. For example, rules can make only the new incoming invoices from Peters Engineering visible.
Instead of a single rule, you can also use groups of rules. With a group of rules, for example, the new, the rejected, and the approved invoices from Peters Engineering can all be visible.
The system functions User group and User role can be assigned to index fields of the type keyword and text. DocuWare then checks whether the user belongs to a group or role entered in this index field. Only then can the user access the documents. The assignment uses the following operators:
Keyword field with Contains: at least one keyword matches one of the user's roles or groups.
Text field with Equals: the text field matches one of the user's roles or groups.
Text field with Is not equal: the text field matches none of the user's roles or groups.
SQL
SQL statements let you define more complex filters than assigning index criteria per field. Type the statement in the text field. You do not need to enter the SELECT statement. You define the filter with the WHERE clause. SQL join statements and substrings can be used.
With DocuWare version 7.13 and later, SQL commands and index profiles are checked for syntax, validity, and forbidden SQL commands.
The following SQL commands are forbidden: ALTER, BEGIN, BACKUP, BULK, COMMIT, CREATE, DECLARE, DELETE, DENY, DROP, EXEC, EXECUTE, GRANT, GOTO, INSERT, KILL, MERGE, OPENDATASOURCE, OPENROWSET, PROC, PROCEDURE, RAISERROR, RECONFIGURE, RESTORE, RESTRICT, REVERT, REVOKE, ROLLBACK, SAVE, SHUTDOWN, SYSTEMUSER, TRAN, TRANSACTION, TRUNCATE, UPDATE, UNION, WAITFOR.
An invalid SQL statement cannot be saved. Existing index profiles and lists with an invalid SQL command continue to work as before. However, if you change a list or an index dialog that contains an invalid SQL command, it can only be published once the command is fixed.
File cabinet
Some file cabinet permissions also require index field permissions. For example, to use the file cabinet permission "Store", users must be able to write in at least one index field, so that the document can be indexed.
Index fields
All fields of the file cabinet are listed in the left column of this dialog. Specify what users with this profile are allowed to do with each field.
Some activities require several permissions. For example, to edit documents, users need both the Modify and the Read permission, because only then are the documents displayed.
The right to change index entries does not include the right to enter new index entries that do not exist yet. To permit this, also assign the field right "Allow new entries" in a second profile without an index filter. Use this second profile only to control the additional field right.
Field permissions also affect the visibility of fields in dialogs. Without the field permission "Search", users do not see the field in the search dialog, even if it is assigned to the search dialog at dialog level. The same applies to "Read" for the result list, "Write" for the store dialog, and "Modify" for the index dialog.