How to Limit User Access to One Namespace Only

Question

Question

Simcha Gershon · Aug 6, 2017

#Namespace #Security #Access control #Caché

Hi Everybody

Question , I need to define a user that will be limited to only to one namespace.

I defined the start up namespace in the user's definition , but it doesn't limit the user.

Any advice would be appreciated.

Thank you Simcha

Discussion (3)0

Log in or sign up to continue

Robert Cemper · Aug 6, 2017

If this user should also be programmer you can create a new role copying from %Developer
and then remove the DB's that you want him to lock out like this just for NS = USER

.

2 0

John Murray · Aug 10, 2017

Expanding on the earlier answers by Eduard and Robert:

A process will not be able to switch to a namespace (e.g. with Do $ZU(5,ns) or ZNAMESPACE ns or Set $NAMESPACE=ns or via Do ^%CD) unless the user holds the Read privilege on the database resource of the default globals database associated with that namespace.

To read about this, see the "Namespaces" subsection of this doc section.

1 0

score 1 · Answer 1 · 2017-08-06T06:39:19-04:00

Eduard Lebedyuk · Aug 6, 2017

User roles should be limited to databases in that namespace.

1 0