Important
You are browsing the documentation for version 1.6 of OroCommerce, OroCRM and OroPlatform, which is no longer maintained. Read version 5.1 (the latest LTS version) of the Oro documentation to get up-to-date information.
See our Release Process documentation for more information on the currently supported and upcoming releases.
End-to-end Access Configuration in Context
We are going to illustrate how to configure access in OroCommerce on a simple example of AMCE company that consists of two organizations (ACME Manufacturing and ACME Services). We will focus on the ACME Services organization that has two regional divisions, one in the USA and the other one in the EU. Each of these two divisions has smaller subdivisions. In the USA these are Los Angeles, Dallas and New York, and in the EU it is Western Europe and Eastern Europe.
We now need to configure roles and access settings in such a way that the sales representatives could access only the data they own. Area sales managers must be able to access data of their subdivision (e.g. LA or NY), while the regional sales managers have access to data of all areas in their region. The sales director must be able to view all company data.
Step 1: Create Business Units
The first step is to create the corresponding business units, which are the following:
- Main Office
- USA
- EU
- Los Angeles
- Dallas
- New York
- Western Europe
- Eastern Europe
When creating business units, we need to specify parent business units. In this scenario, the Main Office does not have a parent business unit as it represents the business unit that has access to the whole organization.
The Main Office is the parent business unit for the USA and EU business units. The USA business unit is the parent unit for Los Angeles, Dallas, New York. The EU business unit is the parent unit for Western Europe, Eastern Europe.
Step 2: Create Roles and Apply Permissions
Once we have created business units, we need to create the following roles:
Sales rep with User access level:
Area sales manager with Business Unit access level:
Regional sales manager with the Division access level.
Sales director with the Organization access level:
These roles are created on the global level as they apply to both ACME organizations.
Step 3: Assign Roles to Users
We now need to assign four roles to users and define which business units the users must have access to.
Sales Director
The sales director has the following settings:
Status — Active
Roles — System-wide sales director role
Organization — ACME Services
As the sales director has permissions with global access level, there is no need to specify which business units the sales director must have access to.
Regional Sales Manager
The regional sales manager has the following settings:
- Roles — Regional Sales Manager
- Organization — ACME Services
- Organization Business Units — Either USA or EU
Regional sales managers have permissions with division access level.
Note
A division is a business unit with the chain of its sub business units and their sub business units. We, therefore, need to specify only the top business unit in this chain.
Area Sales Manager
Area sales managers have the following settings:
- Roles — Area Sales Manager
- Organization — ACME Services
- Organization Business Units — One of the lower level business units: Los Angeles, Dallas, New York, Western Europe, or Eastern Europe
Sales Representatives
The sales representatives have the following settings:
- Roles – Sales Rep
- Organization — ACME Services
- Organization Business Units — One of the lower level business units: Los Angeles, Dallas, New York, Western Europe, Eastern Europe
For example, when Alan Wise, a sales representative in Los Angeles, creates an account, he can assign only himself as the owner of this account (the account belongs to him). He can see only his accounts, unless his managers share other accounts with him.
Nina Anders, who is a sales manager, can manage accounts created by sales representatives of her business unit and by herself:
Samuel Lee, a USA regional sales manager, can see and manage accounts of Nina’s business unit (for Los Angeles sales) and all other business units in USA.
A sales director has access to all company accounts.
Work with Multiple Organizations
The marketing department in AMCE handles campaigns for both ACME Manufacturing and ACME Services organizations.
Jill, who is a marketing team manager, monitors two organizations and is given access to both of them.
John and Jane in the marketing team have organization level permissions. John works with ACME Manufacturing and Jane works with ACME Services.
Each of these marketing managers creates two campaigns in OroCommerce:
John and Jane can only log into the organization they work with, while Jill can log into both.
Access to Multiple Business Units
The ACME Manufacturing has the Business Development (BD) team in two geographically distributed business units, Los Angeles and New York.
We will look closer at Alex, Aaron, and Anna, who are business development representatives.
Alex is in the Los Angeles business unit and Anna is in the New York one.
Aaron manages both business units and he is granted access to Los Angeles and New York BUs.
Each of the team members creates a lead record in OroCommerce:
The diagrams below illustrate what information each of the team members can see:
Aaron has access to both LA and NY BUs and all their records.
Because Aaron has access to LA and NY BUs, the data he owns belongs to both of these BUs. That is why Alex and Anna can access Aaron’s record.
Related Articles