Re: Field level security

[CRPence <CRPbottle@xxxxxxxxx>]

Paul Nelson wrote:
> Thanks for all your suggestions. This gets even weirder. Now the
> client is saying she wants one query. If foreman A runs it, she only
> wants to him see the employees assigned to him. If foreman B runs it,
> the display should be limited to his crew.
>
> I have figured out how to do it, but this breadbox keeps getting
> bigger. :-))

  I seem to recall some recursive VIEW definitions providing 
effectively that feature, using the USER or SESSION_USER special 
register.  Of course that requires that the *USRPRF name be part of the 
data to link the user request to the data the user can see; if not 
already tied to a user profile, a new table to correlate the user 
profile name to the /foreman/ identifier would enable the relationship 
for selection.

  See the following from Gene Cobb showing an example with both column 
and row level security.  The column values are set to NULL by a UDF when 
the user is not allowed to see the data, and the rows that are generated 
depend on the current user of the job.
http://www.ibm.com/servers/enable/site/education/wp/13aae/13aae.pdf

Regards, Chuck