Role Union
Access ControlCommunity Edition+Role Union is a permission management mode. According to system settings, system developers can choose to use Independent roles, Allow roles union, or Roles union only, to meet different permission requirements.
Independent roles
By default, the system uses independent roles. Users must switch between the roles they possess individually.
Allow roles union
System developers can enable Allow roles union, allowing users to simultaneously have permissions of all assigned roles while still permitting users to switch roles individually.
Roles union only
Users are enforced to only use Role Union and cannot switch roles individually.
Rules for Role Union
Role union grants the maximum permissions across all roles. Below are the explanations for resolving permission conflicts when roles have different settings on the same permission.
Operation Permission Merge
Example:
Role1 is configured to Allows to configure interface and Role2 is configured to Allows to install, activate, disable plugins
When logging in with the Full Permissions role, the user will have both permissions simultaneously.
Data Scope Merge
Data Rows
Scenario 1: Multiple roles setting conditions on the same field
Role A filter: Age < 30
Role B filter: Age > 25
After merging:
Scenario 2: Different roles setting conditions on different fields
Role A filter: Age < 30
Role B filter: Name contains "Ja"
After merging:
Data Columns
Role A visible columns: Name, Age
Role B visible columns: Name, Sex
After merging:
Mixed Rows and Columns
Role A filter: Age < 30, columns Name, Age
Role B filter: Name contains "Ja", columns Name, Sex
After merging:
Note: Cells with red background indicate data invisible in individual roles but visible in the merged role.
Summary
Role merging data-scope rules:
- Between rows, if any condition is satisfied, the row has permissions.
- Between columns, fields are combined.
- When rows and columns are both configured, rows and columns are merged separately, not by row-column combinations.