Hiding schemas for Some users

The sysFilter element in a schema allows you to define conditions that control who can read or write to the schema. By setting a readAccess filter, you can prevent non-authorized users from even seeing the schema in the interface (e.g., in the query editor or table selection dropdowns). This approach leverages expressions like hasNamedRight() or $(login) to check user permissions or identity.

Steps to Hide a Schema

1. Edit the Schema: Open the schema you want to restrict under Administration > Configuration > Data schemas in the Adobe Campaign client console.
2. Add a sysFilter: Insert a sysFilter element at the root <element> level of the schema.
3. Define readAccess: Use a condition to limit read access to specific users, such as those with the "admin" named right or a specific login.

Example Schema Modification

Here’s an example of how to modify a schema to hide it from all users except those with the "admin" named right:

Explanation

• <sysFilter name="readAccess">: Defines a filter for read permissions.
• <condition enabledIf="hasNamedRight('admin')=false" expr="FALSE"/>: This means that if the user does not have the "admin" named right (hasNamedRight('admin')=false), the condition evaluates to FALSE, denying read access. Only users with the "admin" right will see the schema.
• expr="FALSE": Explicitly denies access when the condition is met.

Here, only the user with the login "admin" can see the schema.

Notes

• Regenerate Schemas: After modifying the schema, save it and regenerate the schemas (via Tools > Advanced > Update database structure) to apply the changes.
• Clear Cache: Log out and back in, or clear the client cache, to ensure the updated visibility takes effect.
• Admin Override: Users with the "admin" right might still bypass restrictions due to their elevated privileges, so test thoroughly with non-admin users.
• Workflow Access: Even with sysFilter, advanced users with workflow permissions might still access the schema via manual queries if they know its name. For complete security, combine this with operator group permissions.

Thanks

Sushant Trimukhe