1. Identification
| Parameter | Value |
|---|---|
| Object Type | Directory (CatalogRef.AccessGroups) |
| Name | AccessGroups |
| Synonym | Access groups |
| Configuration | Accounting for Kazakhstan, edition 3.0, version 3.0.74.2 |
| Subsystem | Access Management (Standard Subsystem Library mechanism — SSL) |
| Hierarchy | Hierarchical (groups/elements), supports predefined elements |
Purpose. The directory AccessGroups is the central element of the user rights management subsystem. It links access group profiles (sets of roles and access types) with system users and determines which specific objects are accessible to each user through the mechanism of access types and values.
Instead of manually assigning roles to each user, the administrator creates an access group linked to a profile and includes the necessary users. When the profile or group composition changes, the system automatically recalculates the effective roles of all participants and restructures the service registers of access restrictions (RLS).
Where to find: section "Administration" → "User and Rights Settings" → "Access Groups".
Navigation link 1C: e1cib/list/Catalog.AccessGroups.
2. Attributes of Header and Table Parts
2.1 Header Attributes
| Name | Type | Mandatory | Purpose |
|---|---|---|---|
| Profile | CatalogRef.AccessGroupProfiles |
Mandatory (ShowError) | Defines the set of roles and access types that all users in the group will receive. A key attribute upon which the entire rights logic depends. |
| User | CatalogRef.Users, CatalogRef.ExternalUsers |
Optional (DontCheck) | Used for personal access groups (the group is automatically created for one user with individual settings). Not filled in regular group settings. |
| Comment | String |
Optional | Text description of the group's purpose for the administrator (documentation). |
| Responsible | CatalogRef.Users |
Optional | The administrator user responsible for the composition and settings of this group. |
| MainAccessGroupOfDeliveredProfile | Boolean |
Optional | Indicates that the group is the main (predefined) group for the standard profile from the delivery (e.g., "Administrators"). Such groups have a special status and are protected from deletion. |
Standard attributes:
Name,Parent,ThisIsGroup,DeletionMark,Predefined.
2.2 Table Parts
Table Part "Users"
A list of users and user groups included in this access group.
| Name | Type | Purpose |
|---|---|---|
| User | CatalogRef.Users, CatalogRef.ExternalUsers, CatalogRef.ExternalUserGroups |
Reference to a user or user group. Inclusion in the table part automatically assigns the participant roles from the access group profile. |
Table Part "AccessTypes"
Defines which types of access restrictions apply to the group (e.g., "Organizations", "Departments", "Counterparties"). Manages the visibility and editability of objects for group users.
| Name | Type | Purpose |
|---|---|---|
| AccessType | Reference (value from the set of access types) | A specific type of access (e.g., "Organizations"). |
| AllAllowed | Boolean |
True — access to all objects of this type without restrictions; False — rules from the table part "AccessValues" apply. |
Table Part "AccessValues"
A list of specific allowed/forbidden values across access types (clarifies the rows of the table part "AccessTypes" when AllAllowed = False).
| Name | Type | Purpose |
|---|---|---|
| AccessType | Reference | The type of access to which the value relates. |
| AccessValue | Composite reference | A specific object (organization, counterparty, department, etc.) to which access is allowed/forbidden. |
| Inclusion | Boolean (in some releases) |
Indicates permission/forbiddance of the value. |
3. Forms
| Form | Purpose |
|---|---|
| ListForm | A list of access groups with hierarchy and filtering. The main entry point for the administrator. |
| ElementForm | Editing the group: selecting a profile, managing the composition of participants (table part "Users"), setting restrictions (table parts "AccessTypes", "AccessValues"), comment, and responsible person. |
| GroupForm | Editing the folder group of the hierarchical directory. |
| SelectForm | Selecting an access group from other objects and processes. |
The element form is controlling: when selecting a profile, the set of available access types is dynamically rebuilt, and some attributes (for personal and predefined groups) become unavailable for editing.
4. Key Module Procedures
BSL-evidence for this object is not attached. Below are the typical handlers of this type of object in the implementation of SSL applicable to "Accounting for Kazakhstan 3.0".
Object Module (ObjectModule):
BeforeWriting— checks the correctness of filling (profile is mandatory), prohibits changing predefined and personal groups beyond the allowed, sets service flags.OnWriting— initiates the update of service registers of information on composition and rights (see section 5); when changing the profile/composition, marks participants for role recalculation.BeforeDeleting— blocks deletion of the main group of the delivered profile (MainAccessGroupOfDeliveredProfile = True) and groups "Administrators".FillingHandler— fills in default attributes upon creation (including for a personal group for a specific user).FillingCheckHandler— checks the consistency of the rows "AccessTypes"/"AccessValues".
Manager Module (ManagerModule):
- Procedures for obtaining/updating groups by profile, searching for the main group of the profile, service functions for the access restriction mechanism (RLS).
Element Form Module:
OnCreationOnServer/OnReadingOnServer— setting the availability of attributes and visibility of pages depending on the type of group (regular, personal, predefined).ProfileOnChange— restructuring the composition of access types under the selected profile.- Handlers for tables "Users", "AccessTypes", "AccessValues" — validation of entered values and synchronization of dependent table parts.
5. Posting and Movements
The directory AccessGroups is not a document and does not generate accounting entries. It does not affect the accounting register and the standard chart of accounts of the RK (in particular, accounts 1210, 1030, 1330, 3310, 3130, 6010, 7010), does not influence tax calculations (VAT 16%, PIT, WPP, etc.) and does not participate in the processing of electronic documents (ESF, SNT). This is an administrative-technical object of the access rights subsystem.
Instead of entries, when recording an element, the SSL mechanism updates the service registers of information for access management:
| Information Register | What is recorded |
|---|---|
| UserAccessGroups | Correspondence "user ↔ access group" for all participants from the table part "Users" (with unfolding user groups in the composition). |
| AccessValuesGroups / AccessValuesSets | Unfolded values of restrictions from the table parts "AccessTypes" and "AccessValues", used in RLS templates. |
| AccessGroupRoleRights / RolesByProfiles | Effective set of roles for participants, calculated from the profile. |
The actual assignment of roles in the information base to users (the object Users of the platform) is performed deferred/regulatively when updating access after recording the group or changing the profile.
6. Related Objects and Input Based On
- AccessGroupProfiles (
CatalogRef.AccessGroupProfiles) — source of roles and access types; the main "parent" of the group's logic. - Users, ExternalUsers, ExternalUserGroups — participants of the group (table part "Users").
- Objects that act as access values: Organizations, Departments, Counterparties, Warehouses, Document types, etc. — depending on the composition of access types of the profile.
- Information Registers of the access subsystem (see section 5) — receivers of movements.
Input based on: for this directory, the typical "input based on" mechanism is not provided. Group creation is performed manually by the administrator or automatically (personal group for the user, main group of the delivered profile).
7. Extension Points
- Configuration extension / external reports and processes. Adding attributes and columns to table parts through extension is allowed, but it should be noted that the composition of access types and values is managed by the profile and the RLS mechanism — arbitrary fields will not automatically fall into restrictions.
- SSL programming interfaces. For programmatic work, use the common modules of the access management subsystem (
AccessManagement,AccessManagementService) — updating composition, recalculating roles, working with access values. Direct entries into service registers of information are not recommended. - Additional access types. Expanded at the level of profiles and session/template parameters of RLS, rather than by changing the directory itself.
- Event subscriptions. Logic when recording/deleting a group should be correctly connected through subscriptions to events
BeforeWriting/OnWriting/BeforeDeletingto avoid disrupting the typical rights recalculation.
Version-specific (requires verification on the specific release 3.0.74.2): the exact composition of service registers and the presence of the attribute
Inclusionin the table part "AccessValues" — these details depend on the version of the built-in SSL.