Maximo Open Forum

Hello, 

I recently toggled on the "Authorize Group for Labor in their Same Person Group?" for one of our Security Groups. We want to allow this group to have visibility into all the labor records in their Person Group, so they can see which users are assigned to different WOs.

However, we do not want to allow this group to have the option to select other labor records besides their own in the Assignment and Actuals tabs of WOTRACK. To achieve this, I am adding a condition in Application Designer to the Labor fields in Assignment and Actuals. Here is the expression I have written for this condition:

select laborcode from assignment where laborcode = (select laborcode from labor where personid = (select personid from maxuser where userid = :&USER&))
OR select laborcode from labtrans where labtrans.laborcode = ((select laborcode from labor, maxuser where labor.personid = maxuser.personid and maxuser.personid = :&USER&))

I am unsure what Signature Option I should select for this condition (see attached). Also, there are over 500 Properties I can choose for "Condition is True" and "Condition is False". Which property for "Condition is True" would allow the user to select the labor record that matches their userid and which property for "Condition is False" would make all the labor records that do not match their userid read only?

Please let me know if Application Designer is not the best place to enable this condition. Any help would be greatly appreciated!

Hi Carlos,

Just need to understand below two things here to provide you a response.

1. Are you trying to restrict the labor records while selecting from the labor field lookup in assignment and actuals app? If this is yes, the Probably you need Table domain on labor field to restrict the labor records.
2. Are you trying to hide the rows from the assignment and actuals tabs where the labor records are different that their own user? If this is yes, then you can use the conditional Ui option (the one you are currently using).


Please clarify...

Hello, 

I recently toggled on the "Authorize Group for Labor in their Same Person Group?" for one of our Security Groups. We want to allow this group to have visibility into all the labor records in their Person Group, so they can see which users are assigned to different WOs.

However, we do not want to allow this group to have the option to select other labor records besides their own in the Assignment and Actuals tabs of WOTRACK. To achieve this, I am adding a condition in Application Designer to the Labor fields in Assignment and Actuals. Here is the expression I have written for this condition:

select laborcode from assignment where laborcode = (select laborcode from labor where personid = (select personid from maxuser where userid = :&USER&))
OR select laborcode from labtrans where labtrans.laborcode = ((select laborcode from labor, maxuser where labor.personid = maxuser.personid and maxuser.personid = :&USER&))

I am unsure what Signature Option I should select for this condition (see attached). Also, there are over 500 Properties I can choose for "Condition is True" and "Condition is False". Which property for "Condition is True" would allow the user to select the labor record that matches their userid and which property for "Condition is False" would make all the labor records that do not match their userid read only?

Please let me know if Application Designer is not the best place to enable this condition. Any help would be greatly appreciated!

Hello Subhransu, 

I am trying to give a certain Security Group full visibility into all the Labor records in their person group, which I have achieved by turning on the "Authorize Group for Labor in their Same Person Group?" toggle. However, I only want users in this Security Group to be able to select themselves in both Assignments and Actuals of WOTRACK. 

I have achieved this by putting a data restriction on object Assignment and LabTrans for this security group. Here are the details of these Object Restrictions:
- Type: READONLY
- Expression: laborcode = :USER

I have tested it with a few different users, and it works! The user has full visibility into all the Labor records in their Person Group, but they can only select their Labor record in Assignment and Actuals.

Hi Carlos,

Just need to understand below two things here to provide you a response.

1. Are you trying to restrict the labor records while selecting from the labor field lookup in assignment and actuals app? If this is yes, the Probably you need Table domain on labor field to restrict the labor records.
2. Are you trying to hide the rows from the assignment and actuals tabs where the labor records are different that their own user? If this is yes, then you can use the conditional Ui option (the one you are currently using).


Please clarify...

Hello, 

I recently toggled on the "Authorize Group for Labor in their Same Person Group?" for one of our Security Groups. We want to allow this group to have visibility into all the labor records in their Person Group, so they can see which users are assigned to different WOs.

However, we do not want to allow this group to have the option to select other labor records besides their own in the Assignment and Actuals tabs of WOTRACK. To achieve this, I am adding a condition in Application Designer to the Labor fields in Assignment and Actuals. Here is the expression I have written for this condition:

select laborcode from assignment where laborcode = (select laborcode from labor where personid = (select personid from maxuser where userid = :&USER&))
OR select laborcode from labtrans where labtrans.laborcode = ((select laborcode from labor, maxuser where labor.personid = maxuser.personid and maxuser.personid = :&USER&))

I am unsure what Signature Option I should select for this condition (see attached). Also, there are over 500 Properties I can choose for "Condition is True" and "Condition is False". Which property for "Condition is True" would allow the user to select the labor record that matches their userid and which property for "Condition is False" would make all the labor records that do not match their userid read only?

Please let me know if Application Designer is not the best place to enable this condition. Any help would be greatly appreciated!

Your condition for READONLY you'll want something like:
:laborcode is not null and not exists(select 1 from labor where labor.personid=:&PERSONID& and labor.laborcode=:laborcode and orgid=:orgid)

Labor doesn't have to match the userid so if the standards change it would be an issue.

In general, I prefer to do validation (such as an automation script validate on the LABORCODE attribute of ASSIGNMENT or LABTRANS) rather than trying to hide values or use data restrictions like this. That way you can provide a more detailed message explaining why. 

Hello Subhransu, 

I am trying to give a certain Security Group full visibility into all the Labor records in their person group, which I have achieved by turning on the "Authorize Group for Labor in their Same Person Group?" toggle. However, I only want users in this Security Group to be able to select themselves in both Assignments and Actuals of WOTRACK. 

I have achieved this by putting a data restriction on object Assignment and LabTrans for this security group. Here are the details of these Object Restrictions:
- Type: READONLY
- Expression: laborcode = :USER

I have tested it with a few different users, and it works! The user has full visibility into all the Labor records in their Person Group, but they can only select their Labor record in Assignment and Actuals.

Hi Carlos,

Just need to understand below two things here to provide you a response.

1. Are you trying to restrict the labor records while selecting from the labor field lookup in assignment and actuals app? If this is yes, the Probably you need Table domain on labor field to restrict the labor records.
2. Are you trying to hide the rows from the assignment and actuals tabs where the labor records are different that their own user? If this is yes, then you can use the conditional Ui option (the one you are currently using).


Please clarify...

Hello, 

I recently toggled on the "Authorize Group for Labor in their Same Person Group?" for one of our Security Groups. We want to allow this group to have visibility into all the labor records in their Person Group, so they can see which users are assigned to different WOs.

However, we do not want to allow this group to have the option to select other labor records besides their own in the Assignment and Actuals tabs of WOTRACK. To achieve this, I am adding a condition in Application Designer to the Labor fields in Assignment and Actuals. Here is the expression I have written for this condition:

select laborcode from assignment where laborcode = (select laborcode from labor where personid = (select personid from maxuser where userid = :&USER&))
OR select laborcode from labtrans where labtrans.laborcode = ((select laborcode from labor, maxuser where labor.personid = maxuser.personid and maxuser.personid = :&USER&))

I am unsure what Signature Option I should select for this condition (see attached). Also, there are over 500 Properties I can choose for "Condition is True" and "Condition is False". Which property for "Condition is True" would allow the user to select the labor record that matches their userid and which property for "Condition is False" would make all the labor records that do not match their userid read only?

Please let me know if Application Designer is not the best place to enable this condition. Any help would be greatly appreciated!

Thank you, Steven! I'd like to clarify that the expression I was using was laborcode != :USER. I have tested your expression out, and it works great. It allows the user to only select their labor record. 

I am a bit confused on this portion of your expression:  not exists(select 1 from labor where labor.personid=:&PERSONID& and labor.laborcode=:laborcode and orgid=:orgid). 

This condition checks that there is not a record in the Labor table where:
- The personid attribute in the Labor table matches the PERSONID in the Assignment table, and
- The laborcode attribute in the Labor table matches the laborcode attribute in the Assignment table, 
- The orgid attibute in the Labor table matches the orgid attrbute in the Assignment table

Why would the user not get a read-only error when entering his/her Laborcode? His/Her Laborcode matches the Person ID in the Labor and Assignment table, and the orgid is the same in both the Labor and Assignment table. 

Even though this expression works, I am a bit confused on the logic behind it. Any guidance would be greatly appreciated.

Your condition for READONLY you'll want something like:
:laborcode is not null and not exists(select 1 from labor where labor.personid=:&PERSONID& and labor.laborcode=:laborcode and orgid=:orgid)

Labor doesn't have to match the userid so if the standards change it would be an issue.

In general, I prefer to do validation (such as an automation script validate on the LABORCODE attribute of ASSIGNMENT or LABTRANS) rather than trying to hide values or use data restrictions like this. That way you can provide a more detailed message explaining why. 

Hello Subhransu, 

I am trying to give a certain Security Group full visibility into all the Labor records in their person group, which I have achieved by turning on the "Authorize Group for Labor in their Same Person Group?" toggle. However, I only want users in this Security Group to be able to select themselves in both Assignments and Actuals of WOTRACK. 

I have achieved this by putting a data restriction on object Assignment and LabTrans for this security group. Here are the details of these Object Restrictions:
- Type: READONLY
- Expression: laborcode = :USER

I have tested it with a few different users, and it works! The user has full visibility into all the Labor records in their Person Group, but they can only select their Labor record in Assignment and Actuals.

Hi Carlos,

Just need to understand below two things here to provide you a response.

1. Are you trying to restrict the labor records while selecting from the labor field lookup in assignment and actuals app? If this is yes, the Probably you need Table domain on labor field to restrict the labor records.
2. Are you trying to hide the rows from the assignment and actuals tabs where the labor records are different that their own user? If this is yes, then you can use the conditional Ui option (the one you are currently using).


Please clarify...

Hello, 

I recently toggled on the "Authorize Group for Labor in their Same Person Group?" for one of our Security Groups. We want to allow this group to have visibility into all the labor records in their Person Group, so they can see which users are assigned to different WOs.

However, we do not want to allow this group to have the option to select other labor records besides their own in the Assignment and Actuals tabs of WOTRACK. To achieve this, I am adding a condition in Application Designer to the Labor fields in Assignment and Actuals. Here is the expression I have written for this condition:

select laborcode from assignment where laborcode = (select laborcode from labor where personid = (select personid from maxuser where userid = :&USER&))
OR select laborcode from labtrans where labtrans.laborcode = ((select laborcode from labor, maxuser where labor.personid = maxuser.personid and maxuser.personid = :&USER&))

I am unsure what Signature Option I should select for this condition (see attached). Also, there are over 500 Properties I can choose for "Condition is True" and "Condition is False". Which property for "Condition is True" would allow the user to select the labor record that matches their userid and which property for "Condition is False" would make all the labor records that do not match their userid read only?

Please let me know if Application Designer is not the best place to enable this condition. Any help would be greatly appreciated!

After having tested the expression ":laborcode is not null and not exists(select 1 from labor where labor.personid=:&PERSONID& and labor.laborcode=:laborcode and orgid=:orgid)", I have noticed that it does not allow this security group to put WOs in COMP status if assignment or actuals includes multiple labor records.

If Joe and Bob put their actuals into WO X, neither of them can move this WO to COMP status. However, if Joe is the only one that puts his actuals into WO X, he is able to put the WO in COMP status. I have attached the error code I receive when one of them tries to COMP a WO with multiple labor records. 

If anyone has experienced a similar issue and knows a workaround, I'd greatly appreciate your feedback. I personally think my best bet will be creating the automation script that Steven mentioned earlier in the chat...

Thank you, Steven! I'd like to clarify that the expression I was using was laborcode != :USER. I have tested your expression out, and it works great. It allows the user to only select their labor record. 

I am a bit confused on this portion of your expression:  not exists(select 1 from labor where labor.personid=:&PERSONID& and labor.laborcode=:laborcode and orgid=:orgid). 

This condition checks that there is not a record in the Labor table where:
- The personid attribute in the Labor table matches the PERSONID in the Assignment table, and
- The laborcode attribute in the Labor table matches the laborcode attribute in the Assignment table, 
- The orgid attibute in the Labor table matches the orgid attrbute in the Assignment table

Why would the user not get a read-only error when entering his/her Laborcode? His/Her Laborcode matches the Person ID in the Labor and Assignment table, and the orgid is the same in both the Labor and Assignment table. 

Even though this expression works, I am a bit confused on the logic behind it. Any guidance would be greatly appreciated.

Your condition for READONLY you'll want something like:
:laborcode is not null and not exists(select 1 from labor where labor.personid=:&PERSONID& and labor.laborcode=:laborcode and orgid=:orgid)

Labor doesn't have to match the userid so if the standards change it would be an issue.

In general, I prefer to do validation (such as an automation script validate on the LABORCODE attribute of ASSIGNMENT or LABTRANS) rather than trying to hide values or use data restrictions like this. That way you can provide a more detailed message explaining why. 

Hello Subhransu, 

I am trying to give a certain Security Group full visibility into all the Labor records in their person group, which I have achieved by turning on the "Authorize Group for Labor in their Same Person Group?" toggle. However, I only want users in this Security Group to be able to select themselves in both Assignments and Actuals of WOTRACK. 

I have achieved this by putting a data restriction on object Assignment and LabTrans for this security group. Here are the details of these Object Restrictions:
- Type: READONLY
- Expression: laborcode = :USER

I have tested it with a few different users, and it works! The user has full visibility into all the Labor records in their Person Group, but they can only select their Labor record in Assignment and Actuals.

Hi Carlos,

Just need to understand below two things here to provide you a response.

1. Are you trying to restrict the labor records while selecting from the labor field lookup in assignment and actuals app? If this is yes, the Probably you need Table domain on labor field to restrict the labor records.
2. Are you trying to hide the rows from the assignment and actuals tabs where the labor records are different that their own user? If this is yes, then you can use the conditional Ui option (the one you are currently using).


Please clarify...

Hello, 

I recently toggled on the "Authorize Group for Labor in their Same Person Group?" for one of our Security Groups. We want to allow this group to have visibility into all the labor records in their Person Group, so they can see which users are assigned to different WOs.

However, we do not want to allow this group to have the option to select other labor records besides their own in the Assignment and Actuals tabs of WOTRACK. To achieve this, I am adding a condition in Application Designer to the Labor fields in Assignment and Actuals. Here is the expression I have written for this condition:

select laborcode from assignment where laborcode = (select laborcode from labor where personid = (select personid from maxuser where userid = :&USER&))
OR select laborcode from labtrans where labtrans.laborcode = ((select laborcode from labor, maxuser where labor.personid = maxuser.personid and maxuser.personid = :&USER&))

I am unsure what Signature Option I should select for this condition (see attached). Also, there are over 500 Properties I can choose for "Condition is True" and "Condition is False". Which property for "Condition is True" would allow the user to select the labor record that matches their userid and which property for "Condition is False" would make all the labor records that do not match their userid read only?

Please let me know if Application Designer is not the best place to enable this condition. Any help would be greatly appreciated!

That error makes sense because we delete assignments on completion of the work. To validate the labor code field, I'd do something like below on an attribute validate launch point of the ASSIGNMENT.LABORCODE & LABTRANS.LABORCODE attributes. I really wanted to do this all from a cache but as I commented in the script, the profile.isAuthLaborSelf(mbo.getString("ORGID"),mbo.getString("LABORCODE")) check which should determine if the labor record matches the current user's labor record for that org doesn't work if the user has access to all sites. I'll try and open a case for that but the code as written will work and shouldn't have that significant of an impact.

One thing I did was allow users that have access to all labor to be able to enter for anyone. Admins like yourself or schedulers will need to be able to do this for anyone. I also made sure that if it was a background process (such as an integration or PM work order generation) that we let it go through so that we're not negatively impacting the performance there. 

# Ignore when labor or org is not set or set via background process (PMWOGEN, MIF, etc.)if mbo.getString("LABORCODE") and mbo.getString("ORGID") and interactive:    from psdi.server import MXServer    ss=MXServer.getMXServer().lookup("SECURITY")    profile=ss.getProfile(mbo.getUserInfo())        # Allow users with access to all labor to enter for any user and allow users to enter their own labor. Otherwise throw error    # NOTE: profile.isAuthLaborSelf(mbo.getString("ORGID"),mbo.getString("LABORCODE")) reads from a cache and should work but looks to be a bug when user has access to all sites that prevents the check from working.     # So we're opening a new set to labor to see if it matches the person record    if not profile.isLaborAuthAll() and not mbo.getString("LABOR.PERSONID")==mbo.getUserInfo().getPersonId():        service.error("emx","yourLaborOnly")

After having tested the expression ":laborcode is not null and not exists(select 1 from labor where labor.personid=:&PERSONID& and labor.laborcode=:laborcode and orgid=:orgid)", I have noticed that it does not allow this security group to put WOs in COMP status if assignment or actuals includes multiple labor records.

If Joe and Bob put their actuals into WO X, neither of them can move this WO to COMP status. However, if Joe is the only one that puts his actuals into WO X, he is able to put the WO in COMP status. I have attached the error code I receive when one of them tries to COMP a WO with multiple labor records. 

If anyone has experienced a similar issue and knows a workaround, I'd greatly appreciate your feedback. I personally think my best bet will be creating the automation script that Steven mentioned earlier in the chat...

Thank you, Steven! I'd like to clarify that the expression I was using was laborcode != :USER. I have tested your expression out, and it works great. It allows the user to only select their labor record. 

I am a bit confused on this portion of your expression:  not exists(select 1 from labor where labor.personid=:&PERSONID& and labor.laborcode=:laborcode and orgid=:orgid). 

This condition checks that there is not a record in the Labor table where:
- The personid attribute in the Labor table matches the PERSONID in the Assignment table, and
- The laborcode attribute in the Labor table matches the laborcode attribute in the Assignment table, 
- The orgid attibute in the Labor table matches the orgid attrbute in the Assignment table

Why would the user not get a read-only error when entering his/her Laborcode? His/Her Laborcode matches the Person ID in the Labor and Assignment table, and the orgid is the same in both the Labor and Assignment table. 

Even though this expression works, I am a bit confused on the logic behind it. Any guidance would be greatly appreciated.

Your condition for READONLY you'll want something like:
:laborcode is not null and not exists(select 1 from labor where labor.personid=:&PERSONID& and labor.laborcode=:laborcode and orgid=:orgid)

Labor doesn't have to match the userid so if the standards change it would be an issue.

In general, I prefer to do validation (such as an automation script validate on the LABORCODE attribute of ASSIGNMENT or LABTRANS) rather than trying to hide values or use data restrictions like this. That way you can provide a more detailed message explaining why. 

Hello Subhransu, 

I am trying to give a certain Security Group full visibility into all the Labor records in their person group, which I have achieved by turning on the "Authorize Group for Labor in their Same Person Group?" toggle. However, I only want users in this Security Group to be able to select themselves in both Assignments and Actuals of WOTRACK. 

I have achieved this by putting a data restriction on object Assignment and LabTrans for this security group. Here are the details of these Object Restrictions:
- Type: READONLY
- Expression: laborcode = :USER

I have tested it with a few different users, and it works! The user has full visibility into all the Labor records in their Person Group, but they can only select their Labor record in Assignment and Actuals.

Hi Carlos,

Just need to understand below two things here to provide you a response.

1. Are you trying to restrict the labor records while selecting from the labor field lookup in assignment and actuals app? If this is yes, the Probably you need Table domain on labor field to restrict the labor records.
2. Are you trying to hide the rows from the assignment and actuals tabs where the labor records are different that their own user? If this is yes, then you can use the conditional Ui option (the one you are currently using).


Please clarify...

Hello, 

I recently toggled on the "Authorize Group for Labor in their Same Person Group?" for one of our Security Groups. We want to allow this group to have visibility into all the labor records in their Person Group, so they can see which users are assigned to different WOs.

However, we do not want to allow this group to have the option to select other labor records besides their own in the Assignment and Actuals tabs of WOTRACK. To achieve this, I am adding a condition in Application Designer to the Labor fields in Assignment and Actuals. Here is the expression I have written for this condition:

select laborcode from assignment where laborcode = (select laborcode from labor where personid = (select personid from maxuser where userid = :&USER&))
OR select laborcode from labtrans where labtrans.laborcode = ((select laborcode from labor, maxuser where labor.personid = maxuser.personid and maxuser.personid = :&USER&))

I am unsure what Signature Option I should select for this condition (see attached). Also, there are over 500 Properties I can choose for "Condition is True" and "Condition is False". Which property for "Condition is True" would allow the user to select the labor record that matches their userid and which property for "Condition is False" would make all the labor records that do not match their userid read only?

Please let me know if Application Designer is not the best place to enable this condition. Any help would be greatly appreciated!