1. Identification
| Parameter | Value |
|---|---|
| Object Type | Catalog |
| Name | AccessGroupProfiles |
| Full Name | Catalog.AccessGroupProfiles (Catalogs.AccessGroupProfiles) |
| Synonym | Access group profiles |
| Configuration | Accounting for Kazakhstan, edition 3.0, version 3.0.74.2 |
| Subsystem | BSP "Access Management" (standard subsystem) |
| Hierarchy | Hierarchy of groups and elements (profiles can be grouped into folders) |
| Main Users | Administrators, information security specialists |
Purpose. The catalog stores templates of access rights (profiles), combining a set of configuration roles and restrictions by types of access (RLS) — by organizations, departments, counterparties, etc. The profile is assigned to an access group (Catalog.AccessGroups), which includes users or external users. This is the basic object for rights delimitation: a role provides functional capabilities (read/write/posting), while types and values of access restrict these capabilities to specific data.
Where to find in 1C: section "Administration" / "User and Rights Settings" → "Access Group Profiles".
Navigation link: e1cib/list/Catalog.AccessGroupProfiles
2. Attributes and Table Parts
2.1 Header Attributes
| Name | Type | Mandatory | Purpose |
|---|---|---|---|
| Name | String | Yes | Displayed name of the profile (standard attribute of the catalog). |
| DataSupplierIdentifier | UUID | Not checked | Unique identifier of the supplied (built-in) profile. Automatically filled for profiles supplied by the configuration developer and ensures synchronization of rights during updates. For user profiles — empty. |
| SuppliedProfileModified | Boolean | Not checked | Indicates that the administrator has modified the supplied profile (added/removed roles or types of access). Used to control discrepancies between the configuration standard and the current state of the database. |
| Comment | String | Not checked | Arbitrary text description of the profile's purpose, application features, change history. Does not affect business logic. |
Standard predefined profiles for BSP (e.g., "Administrator", "Opening external reports and processing") are supplied: they have the
DataSupplierIdentifierfilled.
2.2 Table Parts
Roles
List of configuration roles included in the profile. Roles define the functional capabilities of users.
| Name | Type | Purpose |
|---|---|---|
| Role | CatalogRef.MetadataObjectIdentifiers / CatalogRef.ExtensionObjectIdentifiers |
Reference to the metadata role of the configuration or extension. Storing via object identifier makes the composition resilient to renaming roles and allows including extension roles. |
AccessTypes
Defines the dimensions (organization, department, counterparty, etc.) by which the profile's rights are restricted.
| Name | Type | Purpose |
|---|---|---|
| AccessType | Reference to access type (defined by the access management subsystem) | RLS dimension: "Organizations", "Departments", "Individuals", etc. |
| Preinstalled | Boolean | The access type is automatically added by the system and recommended for use in this profile. |
| AllAllowed | Boolean | Set — access is allowed to all values of this type without restrictions; removed — access only to values from the table part AccessValues. |
AccessValues
Specific values of restrictions by types of access (e.g., access only to a specific organization).
| Name | Type | Purpose |
|---|---|---|
| AccessType | Reference to access type | Links the value to the corresponding row in AccessTypes. |
| AccessValue | Composite (Organization, Department, etc.) | Specific object to which access is granted. |
| IncludingSubordinate | Boolean | For hierarchical values — extend access to subordinate elements. |
3. Forms
| Form | Purpose |
|---|---|
| ElementForm | Main profile form: tabs "Allowed Actions (Roles)" and "Access Restrictions". Manages the composition of roles, types and values of access, displays the modification indicator of the supplied profile. |
| GroupForm | Group (folder) form of the catalog for organizing profiles by catalogs. |
| ListForm | List of profiles filtered by groups; entry point e1cib/list/Catalog.AccessGroupProfiles. |
| SelectForm | Select profile when assigning to an access group. |
| SelectGroupForm | Select group (folder) of profiles. |
4. Key Module Procedures
No special BSL-evidence for the object's modules is attached; below is a typical set of handlers for BSP access profiles.
Object Module:
BeforeWriting— validation of the composition of roles and types of access; setting theSuppliedProfileModifiedindicator if the composition differs from the standard supplied profile.OnCopying— resetDataSupplierIdentifier(the profile copy becomes user-defined, not supplied).FillingProcessing— filling in attributes during interactive creation.BeforeDeleting/OnDeleting— control of referential integrity with access groups.
Manager Module:
- Procedures for registering and updating supplied profiles during configuration updates (reconciliation with the standard by
DataSupplierIdentifier). - Functions for obtaining roles and types of access of the profile for the RLS mechanism.
Element Form Module:
OnCreatingOnServer— building the role tree, initializing lists of types and values of access.- Handlers of the restrictions tab: changing
AllAllowed, adding/removing types and values of access, updating the availability of form elements.
Requires verification (version-specific): the exact composition of the common modules of the "Access Management" subsystem (
AccessManagement,AccessManagementService) in the BSP edition supplied with 3.0.74.2.
5. Posting and Movements
The catalog is not a document and is not posted — it does not generate movements in accounting/accumulation registers. Postings according to the standard chart of accounts of the RK (e.g., 1210, 1030, 1330, 3310, 3130, 6010, 7010, VAT accruals 16%) are generated by configuration documents, not access profiles.
The role of the object in the system is influence on the records of the information register of the access management subsystem:
- When recording the profile, the sets of access values of the access groups using this profile are updated.
- The profile data is used to build RLS templates (Record Level Security): roles determine which metadata objects the restrictions apply to, while types/values of access are specific filters (e.g., "see data only for the organization LLP ...").
- Changing the profile initiates the repopulation of service registers of rights so that the restrictions take effect for all related users.
6. Related Objects and Input Based On
| Object | Relation |
|---|---|
| Catalog.AccessGroups | The profile is assigned to an access group; one group refers to one profile. |
| Catalog.Users / ExternalUsers | Belong to access groups and receive rights through the profile. |
| Catalog.MetadataObjectIdentifiers / ExtensionObjectIdentifiers | Source of values for the Role attribute. |
| Access types and values (RLS) | Organizations, departments, counterparties, etc. — sources of restriction values. |
| Information registers of the access management subsystem | Receivers of profile data for the RLS mechanism. |
Input based on: not provided. A new profile is created manually or by copying an existing one; supplied profiles are created automatically during configuration updates.
7. Extension Points
- Extension Roles — inclusion of roles defined in configuration extensions (type
CatalogRef.ExtensionObjectIdentifiers) into the profile without removing from support. - User-defined Access Types — adding custom RLS dimensions through the access management subsystem and their use in profiles.
- Programmatic Control — procedures of common modules
AccessManagementfor creating/updating profiles and filling rights from code (e.g., during deployment of standard settings). - Event Subscriptions and Form Extensions — overriding the behavior of the element form (additional checks of role composition, custom restriction logic) using configuration extension tools.
- Supplied Profiles — the mechanism
DataSupplierIdentifier/SuppliedProfileModifiedallows for correct updating of standard profiles while preserving user modifications.