Portal Data Access

Data Access decides which IBM i libraries and tables Portal (CoderFlow for Business) users can query. The limits cover queries from Ask, reports and scheduled questions in one environment. Library lists choose which copy of a table a query reads when it names the table without its library.

The rules only narrow access. Every Portal query runs with the person's own IBM i login, so nobody can read more than that login allows: their effective access is their IBM i authority, narrowed by these rules.

What the rules don't cover:

• data scripts and runtime tools;
• connections that Ask and report agents use with the connection's own login, such as SQL Server.

Only Portal queries made with each person's own IBM i login follow these rules.

Before you start

• Portal is on for the server (Server Settings → Portal → Enable Portal) and for the environment (Enable Portal for this environment on its Portal tab).
• The environment has an IBM i connection with the SQL feature turned on. Without one, the card says there is nothing to set.
• Portal users need the portal:access and portal:data permissions, and must save their personal IBM i login under Profile Settings → IBM i Connections. Without the permissions, Portal answers Environment data access denied; that comes from permissions, not from these rules.
• Editing needs environments:manage on the environment. People who can only view its settings see a summary (the mode and rule counts) and Environment managers can view and change these rules.

Configure Data Access

Open Environments → Portal and find the Data Access card.

Choose a mode

Under What can Portal users query?, choose one of:

Option	Meaning
Anything their IBM i login can read	No Portal limit; IBM i authority decides. This is the setting for a new environment. Saving it deletes every rule (the card warns that they will be removed); only the setup repository history can bring them back.
Everything except what you block	Good for hiding a few sensitive tables, such as payroll.
Only what you allow (Recommended)	Start closed, then open libraries or tables for each team.

The mode applies to every Portal query in the environment, including saved, shared and scheduled reports.

In Everything except what you block, IBM i system libraries (names starting with Q or SYS) still need an allow rule.

Add rules

Use + Block data or + Allow data. In the rule dialog:

• Rule: Allow lets these people query the data. Block stops them, even when another rule allows it.
• Who: Everyone (all users with Portal data access in the environment), or Selected teams and people. Team membership is read again for every query.
• Except: teams or people the rule does not apply to, for example the payroll team on a payroll block.
• Which data: one or more rows of Library and Table. Use Browse IBM i… to pick them. Browsing uses your own IBM i login for the connection and needs your own Portal data access in this environment (see the note under Check access…). Otherwise, type the names.
• Applies to: All IBM i connections, or only selected ones. This appears when the environment has more than one IBM i SQL connection.
• Reason (optional): shown to IT in the rule list, in Check access and in the setup repository history. Portal users never see it.

Click Save rule. The dialog previews what the rule does. A block notes that it also applies to reports people already have and to reports shared with them.

Library and table names:

You enter	Matches
HR.PAYROLL or HR/PAYROLL	one table
HR with Table empty, HR.* or HR/*ALL	every table in the library
HR.PAY*	tables whose names start with PAY
*.PAYROLL, CO*.PROD_SCHED*	the same pattern in any matching library
* or *ALL	everything

• Use the SQL (long) names. Only a trailing * is a wildcard.
• Special values such as *LIBL or *CURLIB are not libraries and are refused.
• Rules work on libraries and tables; there are no column or row rules.

How rules combine

1. A block always wins, whatever order the rules are in.
2. Otherwise, any allow that applies allows the table.
3. Otherwise the mode decides.

A rule applies to someone when they match Who, aren't listed under Except, and the query uses one of the rule's connections.

Blocks also match a table's 10-character IBM i system name, so a block can't be bypassed through the short name. Allows match SQL names only.

The rule list groups Allowed and Blocked rules, each written as a sentence with Edit and Delete (Undo brings a deleted rule back). Use the filter box to find rules by team, person or table.

The card also warns you about likely mistakes:

• Only what you allow with no allow rules: Nobody can query IBM i data in the Portal until you allow some libraries or tables.
• A rule naming a team or person that no longer exists.
• A block that applies to one connection while another connection reaches the same IBM i system. The fix offered is Apply to all connections.

Save

Changes are drafts until you Save the environment (toolbar Save or Ctrl+S); the card shows Unsaved changes.

• The rules and lists are stored in the environment's setup repository, as portal-data-policy.json and portal-library-lists.json.
• The next query uses the saved version, with no restart.
• If another administrator saved first, your draft is kept and you can Discard and reload.

If the saved rules file is not valid, Portal refuses all IBM i data in the environment until it is fixed. The card then shows Policy file needs attention.

Check access…

Check access… shows whether a person could query each table under the rules, and which rule decides it. Unsaved changes are included.

1. Choose a Person and a Connection.
2. Enter up to 50 Tables as LIBRARY.TABLE, separated by commas or spaces. A table name without a library (up to 10) shows which copy that person's library list reads.
3. Click Check.

Each table shows Allowed, Blocked or Allowed, unconfirmed, with the reason.

• Check access checks the rules only, not IBM i authority. The person still needs IBM i authority to each table.
• Allowed, unconfirmed: CoderFlow matches long table names to their system names using your own IBM i login for that connection. Without that login the result is provisional; add it under Profile Settings → IBM i Connections to confirm it.

Your own access for browsing and confirming

Browse IBM i… and confirming an Allowed, unconfirmed result use your access, not the person you are checking:

• the portal:access and portal:data permissions in this environment;
• your own saved IBM i login for the connection.

Without these permissions, browsing is refused.

• Profile Settings → IBM i Connections lists the connection only when you have portal:access and either portal:data or portal:apps there. Without them, you can't save a login for it.
• Ask for the permissions, or type library and table names instead.

Portal library lists

When someone names a table without its library, Portal reads the first copy on their library list that the rules let them query. Business users and Ask see the list's name, never the library names.

Lists never change what someone is allowed to query, but they do change which tables are offered. When a list applies to someone:

• Ask and report authoring are shown only the tables in that list's libraries: the first allowed copy of each table, without library names.
• Tables in other libraries aren't offered. A query that names a table with its library still runs, if the rules allow it.

To add one, use + Add library list:

• Name: what business users and Ask see. Avoid library names.
• Description (optional).
• Who uses this list: Everyone (a default for anyone no earlier list applies to), or Selected teams and people, with Except.
• Libraries, searched in order: up to 25 libraries, like an IBM i library list. The first library with the table wins, and a copy the rules block for someone is skipped.
  • Enter each library's SQL schema name.
  • A schema whose SQL name is longer than 10 characters can't be used in a list yet; entering its short system name instead finds nothing. Browse IBM i… marks such schemas.
• Applies to: the connections it is for.

Click Save list.

People don't choose a list. Each person uses the first list in the card's order that applies to them, so put specific lists above the Everyone default; the arrows reorder them.

• A shared report reads the copy on each viewer's own list.
• When no list applies to someone, a query that names a table without its library is refused: Qualify table X with its library… For a shared or scheduled report, whose SQL a viewer can't change, the report fails for that viewer.
• To avoid this, end the list order with an Everyone default list. Remember that it also limits the tables Ask and report authoring offer to everyone it applies to, so include every library people should see.

Warnings point out problems without blocking a save:

• a list that names nobody active;
• a list that is hidden by a list above it;
• a list that names a library the rules make unavailable to its users.

With no lists, Portal queries name each table with its library.

What Portal users see

• Ask or report authoring: a query that uses a table the rules don't make available is refused, and the assistant is told to use only tables listed by schema discovery or to ask IT for access. Schema discovery lists only permitted tables.
• Viewing a report: This report uses IBM i data that IT has not made available to you in the Portal. Ask IT or the report owner for access.
• Changed during a request: if the rules change while a request runs, the request is refused with Data access changed while this request ran. Try again.
• IBM i refuses: IBM i rejected this query. Check that the table and columns exist and that your IBM i user can read the table.

Whatever the rules say, a Portal query is one read-only SELECT:

• physical tables only (no views or logical files) and built-in functions only;
• at most 10 tables and 100 rows returned;
• the job's library list is never used or changed.

Limits

• Rules: up to 100 rules, 100 libraries or tables per rule, and 500 in total. Use LIBRARY.* or PREFIX* patterns for more.
• Library lists: up to 50 lists, 25 libraries each, with names up to 60 characters.

Ask CoderFlow

Portal data policy is set up rarely, so Ask CoderFlow explains it from this page rather than changing it. Ask does not read or change Data Access rules or library lists. Make changes on the environment's Portal tab.

For launching IBM i applications from Portal, see IBM i Portal Applications.