Multi-level Organization Authority Assignment

1. Version 

2. Expected Scenario

When the company organization has a tree-like hierarchical relationship, each level wants to assign different permissions.

For example, there is a tree-like relationship between the head office, branches, and sub-branches, and users need to be assigned different permissions according to different institutions.

The effect is that the head office can see all the data, the branch can see the data of the branch where it belongs and all the data of the sub-branch under the jurisdiction of the branch, and the sub-branch only sees its own data.

3. Implementation ideas

FineBI multi-level/tree permissions are "build self-looping columns > import users from server datasets (or user synchronization datasets) > match the fields where users log in > assign permissions according to institutions > assign permissions according to users".

Note: For BI projects of version 5.1.10 and later, the "Self-loop column" setting is not supported for real-time data. Users can use self-loop SQL to assign permissions. For details, please refer to: Assign permissions using the fine_username parameter .

Click to download the sample data and unzip it:Sample Data.zip

·       Institution Table: It includes the bank's head office, branches, sub-branches, and the corresponding "institution code" and "superior institution code", as shown in the following figure:

·       User Permission Table: contains the bank staff's user account, password, institution code, department and position, as shown in the following figure:

·       Business Flow Table: contains the transaction data that the corresponding staff can see, as shown in the following figure:

1. Create a new Excel dataset

The administrator logs in to the Decision-Making System, clicks "Data Preparation", and creates a new business package.

Note: When importing data, fields such as institution, parent institution, institution number, etc., need to be selected as text fields, otherwise the institution cannot be selected as the display value in the following self-looping column settings.

1) Add the Excel data set "Institution Table" in the business package, please manually modify the "Institution" and "Parent Institution" field formats to "Text", as shown in the following figure:

2) Add the Excel dataset "Business Flow Table" to the business package. Please manually modify the "regional Code", "Institution number" and "counter number" field format to "Text", as shown in the following figure:

3) Add the Excel data set "User Permission Table" to the business package. Please manually modify the "Account" and "Institution" field formats to "Text", as shown in the following figure:

2. Add association between tables

Click "Data Preparation", enter the business package, select "Institution Table", click "Associated View", configure the association relationship for the "Institution Table", "User Permission Table" and "Business Flow Table" and update the data table. As shown below:

Note 1: For the specific operation of adding an association relationship, please refer to: Adding an Inter-Table Association .

Note 2: When importing data, fields such as institution, parent institution, institution number, etc., need to be selected as text fields, otherwise the institution cannot be selected as the display value in the following self-looping column settings.

Note 3: For BI projects after 2020-08-04, when the business package is updated, the Excel dataset association will not be updated, and global update can be used.

3. Creating self-looping columns

Click "Data Preparation", enter the business package, select "Institution Table", click "Edit", select all fields , create "Self-Circulation Column", and configure the hierarchical relationship of the organization table. As shown below:

self-looping column type , select "Institution" and "Institution Name" for the displayed value of the hierarchical result, select "Institution" for the ID column of the hierarchical basis, and "Parent Institution" for the Parent ID column.

Click "Build Relationship" and "Preview" to see the following hierarchy and data preview. Click "Save" in the upper right corner to save the self-looping row operation. As shown below:

1. Create a new self-service dataset

The administrator logs in to the data decision system, clicks "Data Preparation", and adds "self-service dataset" under "My Self-Service Data Set".

Select all fields in the "Business Flow Table" and "Institution Table", and click "Save and Update", as shown in the following figure:

Note: Since the example uses the super administrator account, the super administrator is the data processing user by default. The self-service data set created under the common service package cannot inherit the basic table permissions, so it needs to be created under the My self-service data set. For data analysis users to create self-service datasets, create them directly under the common business package and check permission inheritance .

2. Create a dashboard

For the created self-service dataset, make sure to select "Permission Inheritance". Click "Create Component", select "Group Table" for the chart type, and select "Institution Name-Level 1", "Institution Name-Level 2", "Institution Name-Level 3", "Counter Number", and "Name of Trade" for the dimensions. , "Transaction serial number" and "Ticket Number", click "Enter the Dashboard", as shown below:

created dashboard is shown in the following figure:

3. Mount the Dashboard

The administrator logs in to the data decision system, clicks "Manage> Directory", and mounts the dashboard created in the previous section in the directory, as shown in the following figure:

1. Create server dataset

The administrator logs in to the data decision system, clicks "Manage> Data Connection > Server Dataset", and clicks "Create Dataset > File Dataset".

The dataset name is "User Table", the file type is "Excel", select the "User Permission Table" prepared in Chapter 2 , and click "Save", as shown in the following figure:

2. Import users

The administrator logs in to the data decision system, clicks "Manage> User", and clicks "All Users > Import User".

Select the server dataset created in the previous section , the specific settings are shown in the following figure, and click "OK" to successfully import users.

3. Set up platform users

The administrator logs in to the data decision system, clicks "Manage > User", and clicks "Platform User".

Add all the users imported in the previous section as "PC User ". If users have editing and viewing permissions, add all the newly imported users to "BI Data Processing Users", as shown in the following figure:

1. Assign directory permissions

The administrator logs in to the data decision system, clicks "Manage > Permission > General Permission Configuration", and selects "Management Department" and "Business Department".

the "View" permission of the "New Dashboard2" created in Chapter 4 to these two departments respectively . As shown below:

2. Set the field where the login user is located

The configuration of the field where the login user name is located refers to binding the login user of the system to the field where the user information of the corresponding data table is located, so as to control the user's authority.

The administrator logs in to the data decision system, clicks "Manage> Permission > General Permission Configuration", selects the rights carrier "Department/Role/User", and selects all departments here.

Select the "Data Authorization" tab, click "Please Select" in the "Login User Field", select the "User Permission Table" in the business package, and select the "Account" field, as shown in the following figure:

3. Allocate the data authority of the management department according to the organization

The administrator logs in to the data decision system, clicks "Manage > Permission> General Permission Configuration", and selects "Management Department".

Click "Data Authorization" to assign the "Use" permission of the "Business Flow Meter" and "Institution Table" used by the "Business Flow Dashboard" to the management part. As shown below:

At this point everyone in the management department can see all the data. In order to realize that the head office can see all the data, the branch can see the data of the branch and the sub-branch under its jurisdiction, and the sub-branch can see its own data, it is necessary to configure user data permissions according to the institution.

Select the "Permission Settings" button after "Institution Table", add row permission conditions, make the "User Permission Table". "Institution" field of the "Institution Table". "Institution" field "In (Login User Info)", and click "OK", as follows As shown in the figure:

4. Allocate data permissions of business department according to users

The administrator logs in to the data decision system, clicks "Administration System > Privilege Management > General Privilege Configuration", and selects "Business Department".

Click "Data Permission" to assign the "Use" permission of the "Business Flow Meter" and "Organization Table" used by the "Business Flow Dashboard" to the business department. As shown below:

At this point, everyone in the business department can see all the data. To enable tellers to only see their own data, user data permissions need to be configured according to the teller account.

Select the "Permission Settings" button after "Business Flow Table", add row permission conditions, make the "User Permission Table. Account" field of the "Business Flow Table.counter number" field "In (Login User Info)", and click "OK" ",As shown below:

Log in to the data decision-making system with the accounts of the branch manager, branch manager, and teller respectively, and view the "Salesman Flow Dashboard".

1) The head of the branch (account number 99) is displayed as all area codes 22 (namely Nanchang Branch), and the dashboard displays data including subordinate areas, as shown in the following figure:

2) The head of the branch (account number 101) is displayed as the data of all institutions whose number is 22701 (ie, branch A), as shown in the following figure: