Permissions Overview
You manage user security with privileges and permissions. Permissions define the level of access that users and groups have to an object.
Even if a user has the privilege to perform certain actions, the user may also require permission to perform the action on a particular object.
Types of Permissions
Users and groups can have the following types of permissions in a domain:
- Direct permissions
- Permissions that are assigned directly to a user or group. When users and groups have permission on an object, they can perform administrative tasks on that object if they also have the appropriate privilege. You can edit direct permissions.
- Inherited permissions
You cannot revoke inherited permissions. You also cannot revoke permissions from users or groups assigned the Administrator role. The Administrator role bypasses permission checking. Users with the Administrator role can access all objects.
You can deny inherited permissions on some object types. When you deny permissions, you configure exceptions to the permissions that users and groups might already have.
- Effective permissions
- Superset of all permissions for a user or group. Includes direct permissions and inherited permissions.
When you view permission details, you can view the origin of effective permissions. Permission details display direct permissions assigned to the user or group, direct permissions assigned to parent groups, and permissions inherited from parent objects. In addition, permission details display whether the user or group is assigned the Administrator role which bypasses permission checking.
Permission Search Filters
When you assign permissions, view permission details, or edit permissions for a user or group, you can use search filters to search for a user or group.
When you manage permissions for a user or group, you can use the following search filters:
- Security domain
- Select the security domain to search for users or groups.
- Pattern string
- Enter a string to search for users or groups. The Administrator tool returns all names that contain the search string. The string is not case sensitive. For example, the string "DA" can return "iasdaemon," "daphne," and "DA_AdminGroup."
You can also sort the list of users or groups. Right-click a column name to sort the column in ascending or descending order.