ManagedOrOwnedObjectsAccessModifier Class

The access modifier controls access to data objects of unspecified types.

It is only to be used in views as it has no access calculation logic (only load-option modification!).

The view should not apply any data object type filtering or it should filter on one or more of these types: identities, org. units, role folders, roles, systems.

- The object has the "Manager" property and the user is selected as manager or is member of a group selected as manager.

- The object has the "Owner" property and the user is selected as owner or is member of a group selected as owner.

The access modifier either shows managed/owned objects for the active user or for a specified user. A user can be specified by adding a USERID parameter to the url of the view where the access modifier is applied. It is only possible for members of the administrators group to specify a userid other than their own.

The access modifier supports the parameter ADMINGROUPS which can be used to specify a number of user groups who's members should have access to managed/owned objects for users other than themselves. The value of ADMINGROUPS must be a comma delimited string with user group uids. If ADMINGROUPS is not specified then the value defaults to the built-in Administrators group. If ADMINGROUPS is specified then the built-in Administrators group must be included in order to have access. The access modifier also supports the parameter ADMINGROUPSKEY which works in the same way except that the value must be the key of a customer setting which holds a comma delimited string with user group uids.

The access modifier supports the parameter OVERRIDEGROUPS which can be used to specify a number of user groups who's members should have access to all objects. The value of OVERRIDEGROUPS must be a comma delimited string with user group uids.