Skip to main content

Example Two: %Development Resource

In this example, you create a role that has the %Development:USE privilege. This role grants its members privileges to use Terminal. The role does not, however, grant its members privileges to execute code in the USER database.

  1. If you have not already done so, import the class SecurityTutorial.AuthorizationTests into the USER namespace in Caché. The class is in Authorization.xml.

  2. Create a role named DevOnly.

  3. Assign the new role the %Development:USE privilege.

  4. Create a user and add the user to the DevOnly role.

  5. Open Terminal and use $SYSTEM.Security.Login to login as the user created in the previous step. The DevOnly role provides the user with privileges to use Terminal.

  6. Attempt to execute the HelloUser method of SecurityTutorial.AuthorizationTests. A user that is member of the DevOnly role does not have sufficient privileges to execute any code stored in the USER database. Any attempt generates a <PROTECT> error.

    generated description: devonlyrole 20131

The problem is that the code is stored in the USER database. In order to execute the code, a user needs permissions to read the USER database. The DevOnly role does not grant these permissions. Enhancing DevOnly by adding the %DB_USER:READ privilege would allow a member of the DevOnly role to execute the code.


Authorization.xml is in install-dir\Dev\tutorials\security\. In a standard Caché installation, install-dir is in C:\InterSystems\Cache. Import the application files into the USER namespace using Studio. Importing Code Using Terminal contains instructions. This example assumes that you have installed Caché using minimal security.

FeedbackOpens in a new tab