Help with Permission

Frappe Framework Permissions
1

Hi There,

We have created two custom doctype as below:

Hardware:

  • ID: Select (naming_series)
  • Description: Data

Hardware Allocation:

  • Allocation ID
  • Hardware ID (Link to Hardware doctype)
  • Employee (Link to Employee doctype) - with “Ignore User Permissions” ticked
  • Allocation Date

Roles:
IT User:

  - Doc Type: Hardware
       - Create, Write, Read
  - Doc Type: Hardware Allocation
       - Apply User Permissions - Ticked, Under "Select Document Types", it has "If Hardware is permitted" ticked.
       - Create, Write, Read

Employee:

- Doc Type: Employee
      - Apply User Permissions - Ticked, Under "Select Document Types", it has "If Employee is permitted" ticked.
      - Read, Write

“User A” has been assigned with two roles “IT User” and Employee. As per “User Permission Manager”, “User A” has access to only his Employee ID.

The issue we are having is that when “User A” create a new Hardware Allocation DocType, they can only see their name in Employee Field. They can’t see/search another employee. We have made sure that the “Ignore User Permissions” is ticked for Employee Link field for Hardware allocation doctype.

Why is system not allowing “User A” to select other users for Employee field on Hardware Allocation?

Please let me know if you need more detail?

2

@umair
are you able to help on above issue? Thanks.

3

Mayur,

For Employee docytpe, add new Permission Rule, and assign Read Permission to IT User. Steps below:

  1. Setup >> Role Permission Manager
4
  1. Setup >> Role Permission Manager
  2. Document = Employee
  3. Add new Permission Rule
  4. Role = IT User, Perm Level = 0
  5. Assign (atleast) Read permission to IT user on Employee master. Do not check Apply User Permission or any other permission restriction.
6

Thanks @umair for your response.

If I assign read permission to IT users for Employee doctype then
won’t “User A” will be able to see all the confidential detail of all
other employees? “User A” should only see employee page of his own
employee id. But on Hardware Allocation, page he should be able to
search for all the employee (since ignore user permission is ticked) and
assign them the appropriate hardware.

In version 3.0, I didn’t have this issue.

7

@umair
Any thoughts on the above? Thanks

8

@umair
Any suggestions on how to handle the above use case?

9

@umair, Happy New Year. Any suggestion on above? Thanks.

10

Hello,

If user permission is ignored, the User A will be able to see all the Employees as well. Perhaps you can try Perm Level permission customization where in you can define which specific field of Employee master will be visible to User A.

https://frappe.github.io/erpnext/user/manual/en/setting-up/articles/managing-perm-level.html

11

Hi @umair

Trust you’re doing great. I also thought the ‘Ignore User Permission’ option should only allow the user select any Employee from the link field but NOT to view the actual Employee Form for all employees. This will be very helpful in a lot of scenarios

Right now, I’m not seeing the significance of the ‘Ignore User Permission’ option. Please let me know if this is the expected functionality

Thanks