Hide packages/folders from users (Sparx V14

[Carl@arway]

Hi,

I have searched and tried find answer regarding the possibility to "hide" certain packages/folders for certain user groups within a repository.
From what I have understand this is not possible in Sparx EA, but I wonder if version 14 will allow me to hide packages for user groups.

//Carl

[Geert Bellekens]

Carl,

I heard something about a feature like that that was implemented on only a number of database backends (SQL Server and Oracle IIRC)
It works on a database level using some kind of row level security.

IIRC this feature would be shipped with the cloud server, but since it is a database level thing it doesn't need cloud server to work.

Geert

[Aaron B]

This is a feature of the Pro Cloud Server.
http://www.sparxsystems.com/products/procloudserver/#visibility-levels

See also:
http://www.sparxsystems.com/enterprise_architect_user_guide/13.5/model_repository/visibility_levels.html

[Madhav]

I think the 'Context Browser' in EA 14 is intended to do that - https://www.sparxsystems.in/blogs/sparx-systems-enterprise-architect-14-preview/

Or you can use WebEA Visibility Levels to achieve this -
 http://sparxsystems.com/enterprise_architect_user_guide/13.5/model_repository/vl_ug.html

You can also check out Prolaborate which lets you share selected parts of Enterprise Architect models - https://www.youtube.com/watch?v=ANbeDzkzQHc. You can even control visibility upto an individual element - https://prolaborate.com/resources/documentation/access-permission

[Carl@arway]

I think the 'Context Browser' in EA 14 is intended to do that - https://www.sparxsystems.in/blogs/sparx-systems-enterprise-architect-14-preview/

Or you can use WebEA Visibility Levels to achieve this -
 http://sparxsystems.com/enterprise_architect_user_guide/13.5/model_repository/vl_ug.html

You can also check out Prolaborate which lets you share selected parts of Enterprise Architect models - https://www.youtube.com/watch?v=ANbeDzkzQHc. You can even control visibility upto an individual element - https://prolaborate.com/resources/documentation/access-permission

Will WeEA only let me set visibility in the cloud service or will the changes there also be implemented directly into Sparx Architect?
I want to set Read-access directly in Sparx Architect to "secure" information in specific packages from certain user groups.

For example, I have a user group A that creates content in Package A, I also have a user group B who works in package B. Due to sensitive content in Package A, user group B is not allowed to read it. Is it possible to solve this without using separate repositories?

Context browser in version 14 could be interesting, will it be able to pre-set them for each user group or is it only able to do this for each user? Can I as admin disable project browser for other users to use?

//Carl

[Geert Bellekens]

The documentation is a bit self-contradicting if you ask me.
It says:

Only models hosted by a Pro Cloud Server are able to make use of this feature

But also

Since Row Level Security functionality is implemented by the database, it is impossible for users to bypass security implemented at the application level

Which makes me think it will work without Pro Cloud Server as well as it is basically transparent for the application.

Maybe it is a licencing issue rather then a technical limitation?

Geert

[Madhav]

Will WeEA only let me set visibility in the cloud service or will the changes there also be implemented directly into Sparx Architect?
I want to set Read-access directly in Sparx Architect to "secure" information in specific packages from certain user groups.

For example, I have a user group A that creates content in Package A, I also have a user group B who works in package B. Due to sensitive content in Package A, user group B is not allowed to read it. Is it possible to solve this without using separate repositories?

Context browser in version 14 could be interesting, will it be able to pre-set them for each user group or is it only able to do this for each user? Can I as admin disable project browser for other users to use?

//Carl

May be Sparx EA 14 will enable you do this, but if you intend to share EA models to teams for reviewing and making changes in model data(not diagrams), Prolaborate could help you solve the use case you've highlighted. In a single repository, you can set View/Read/Write access permissions to each user or group and to each package or element as per your requirements.
Here's a snap from Prolaborate. For the package"Application Domain", three users and a user group have various levels of access permissions and all others in the organization will not be able to even see it.

[Eve]

'Row Level Security' gives you enough information to know roughly what's happening at the database level.

The EA functions that manipulate it (setting visibility for a package etc) require the Pro Cloud Server. Once visibility is set, yes it does change the view offered by WebEA.

[ADucci]

I have played a little with Row Level Security, Its pretty neat  - here are my findings/comments

• Documentation is still a little contradictory (I think Sparx Systems have made a few enhancements subsequent to writing of guides
• You need the latest version of SQL (i think from 2018 or latest Oracle
• EA Adds new DATABASE roles to the DATABASE -- this means that you manage access levels against AD Groups/members, so you now grant datareader & datawriter to each AD Group, then a specific visibilitylevel Role (i.e. 1-20) 
• I like the database level security (as opposed to the tool-level security which is implemented in most other tooling)
• One thing I have not got working yet is the added menu item in the "package management" menu item -- keen to see how this works, but I suspect my database is not correct yet.

What's still in the air for me is how Sparx Systems have implemented the levels, I still need to confirm if each user/group needs to be allocated visibility roles cumulatively (i.e. you grant permissions visibility1, visibility2, visibility3 ) to get access to levels 0, 1, 2, 3  or if by just granting Visibility3, you inherently have access to all sub-levels (the help file and sample DB script say differently)  -- Granted I just need to test this, but have not had the time (or lazy)

[Uffe]

• You need the latest version of SQL (i think from 2018 or latest Oracle

SQL Server 2016 and later support row-level security.

/U