# User management access requirement question

**URL:** <https://forum.inductiveautomation.com/t/user-management-access-requirement-question/43314>\
**Category:** Ignition\
**Created:** [February 11, 2021, 4:50pm UTC](https://forum.inductiveautomation.com/t/user-management-access-requirement-question/43314 "2021-02-11T16:50:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ksadda](https://avatars.discourse-cdn.com/v4/letter/k/ac91a4/32.png) [@ksadda](https://forum.inductiveautomation.com/u/ksadda)\
**Post date:** [February 11, 2021, 4:50pm UTC](https://forum.inductiveautomation.com/t/user-management-access-requirement-question/43314/1 "2021-02-11T16:50:45Z")

</div>

I have a requirement like for the user management window depending on the Role of the user I need to give access to the users. There are 4 users with roles ( manager and operator, manager, operator and no role). So when the manager logs in he should able to edit all the users along with him. when operator logs in he should be able to change only his details and when user with no role logs in he should not be able to change anything in the user management. I have used hasrole(“operator”) in the Mode of the user management, it is allowing managers to edit and operators to change only theirs but when user has both roles and no roles the expression is not working. How to make this work.

---

<div class="post-metadata">

**Author:** ![bpreston](https://avatars.discourse-cdn.com/v4/letter/b/4af34b/32.png) [@bpreston](https://forum.inductiveautomation.com/u/bpreston)\
**Post date:** [February 11, 2021, 6:16pm UTC](https://forum.inductiveautomation.com/t/user-management-access-requirement-question/43314/2 "2021-02-11T18:16:53Z")

</div>

The “Mode” when you look at it in the property editor is a drop down with three options(Manage User, Edit Current, and Edit single). If you only have hasRole(“operator”) then when it is in any role other than operator it will return a 0 which will allow all users to be managed by whoever is logged in. A simple single hasRole() function won’t work for what your describing. Also since it doesn’t have an option for no role not being allowed to change anything, you would need to handle that in a different way. For that one I would set it to “Edit Current” and turn off the “Enable” bit for the object. That way they can see theirs but can’t do anything with it. I would probably do something more like:

This would be in the expression binding for the “Mode”:

```auto
if(hasRole("manager"),0,1)

```

This would be in the expression binding for the “Enable”:

```auto
hasRole("operator")||hasRole("manager")

```

With this I’m also assuming the users with manager and operator are one user with two separate roles assigned to them. If it is an actual separate role that covers someone that has both accesses then this won’t work, you would have to add another condition into both spots to handle the extra role.

---

<div class="post-metadata">

**Author:** ![ksadda](https://avatars.discourse-cdn.com/v4/letter/k/ac91a4/32.png) [@ksadda](https://forum.inductiveautomation.com/u/ksadda)\
**Post date:** [February 11, 2021, 6:50pm UTC](https://forum.inductiveautomation.com/t/user-management-access-requirement-question/43314/3 "2021-02-11T18:50:41Z")

</div>

I did not find the Enable bit. Is it in the user management properties. And the user with two roles should be able to edit all the users.

Its like If user ( manager and operator) or ( manager) edit all users  
if user ( operator) edit only his user details

For no role option I did not find where is the Enable bit that you were mentioning.

---

<div class="post-metadata">

**Author:** ![bpreston](https://avatars.discourse-cdn.com/v4/letter/b/4af34b/32.png) [@bpreston](https://forum.inductiveautomation.com/u/bpreston)\
**Post date:** [February 11, 2021, 6:55pm UTC](https://forum.inductiveautomation.com/t/user-management-access-requirement-question/43314/4 "2021-02-11T18:55:58Z")

</div>

The enable bit is the second item in the property editor:  
 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/3/e3e825cad6c3f13bb36f2a4d17a3e5a2486f227f.png)

With it being a seperate role then it would be like this:

```auto
if(hasRole("manager")||hasRole("manager and operator"),0,1)

```

You would also add the extra or to the enable bit one too.

---

<div class="post-metadata">

**Author:** ![ksadda](https://avatars.discourse-cdn.com/v4/letter/k/ac91a4/32.png) [@ksadda](https://forum.inductiveautomation.com/u/ksadda)\
**Post date:** [February 11, 2021, 6:57pm UTC](https://forum.inductiveautomation.com/t/user-management-access-requirement-question/43314/5 "2021-02-11T18:57:44Z")

</div>

I did not have that option. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/c/4c9d743d38d373a9957c8dd9dd85f9372d908ade.png)

---

<div class="post-metadata">

**Author:** ![bpreston](https://avatars.discourse-cdn.com/v4/letter/b/4af34b/32.png) [@bpreston](https://forum.inductiveautomation.com/u/bpreston)\
**Post date:** [February 11, 2021, 6:58pm UTC](https://forum.inductiveautomation.com/t/user-management-access-requirement-question/43314/6 "2021-02-11T18:58:32Z")

</div>

Change the filter from basic to all.

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/8/18f57b652a224f8629912c89d4155f021cd582bb.png)