Control user access to Desktop Clients and Office Add-Ins

You can now control which users and roles have access to the Axiom Desktop Clients and the Microsoft Office Add-Ins, using permissions defined in Axiom security. These new permissions streamline and simplify the user experience, so that all of your users only have access to the specific client applications and add-ins that they need to use. For example:

  • End users who only need to access the Windows Client can be limited so that it is the only client option available.

  • The ability to use the Excel Client can now be enabled only for those users who need to perform spreadsheet design activities.

  • The ability to use the Word or PowerPoint add-ins can now be enabled only for those users who need to edit Word and PowerPoint documents within the Axiom Reports Library. Users who only need to view these documents will no longer inadvertently install the add-in when the document is opened.

  • Additionally, users who only need to use the Web Client can be limited so that they do not have permission to any of the Desktop Clients or Office add-ins, thereby removing unnecessary options from their user experience.

New security permissions

The following security permissions are now available on the Permissions tab of the Security Management dialog:

  • Excel Client Access
  • Windows Client Access
  • PowerPoint Add-In Access
  • Word Add-In Access

If a user is granted these permissions at the user or role level, then the user can see the client application or the add-in on the Quick Launch menu (and other places), and can launch the client or add-in.

New security permissions to control client access and add-in access

If a user does not have these permissions, then the client or add-in is hidden from the user, and the user cannot launch the client or add-in.

Upgrade behavior for Desktop Client permissions

When you upgrade to 2020.4, Axiom automatically enables the Windows Client Access permission on the Everyone role, so that all of your users can continue to use the Windows Client.

The upgrade behavior of the Excel Client depends on the system configuration setting AllowShowExcel (True/False). In previous versions, this optional setting was used to control whether the Excel Client displayed on the Quick Launch menu. Organizations who did not want end users to use the Excel Client could set this to False so that the icon was hidden. This did not prevent use of the Excel Client, but it did discourage use.

  • If AllowShowExcel is True, then Excel Client Access is enabled on the Everyone role, and all users can continue to use the Excel Client.

  • If AllowShowExcel is False, then the upgrade does not enable the Excel Client for any users or roles. Users with the Administrator check box can continue to use the Excel Client because administrators are implicitly granted all permissions, but no other users can access the Excel Client. In this circumstance, you must manually enable Excel Client Access for any users or roles who need to be able to use the Excel Client.

    You can tell whether AllowShowExcel is False in your current system by opening the Quick Launch menu in the Web Client. If the Excel Client is not shown, then AllowShowExcel is False.

If your installation uses subsystems, then Windows Client Access and Excel Client Access are automatically enabled for all existing subsystems. This is necessary in order to allow the permission on the Everyone role to take effect. If a particular client is not necessary for use at a subsystem level, then you can disable the access permission for the subsystem, so that users in the subsystem cannot use that client (unless the permission is allowed by another subsystem that the user belongs to).

Upgrade behavior for Office Add-In permissions

The upgrade to 2020.4 does not enable the PowerPoint Add-In Access permission or the Word Add-In Access permission for any users or roles. Users with the Administrator check box can continue to use the add-ins because administrators are implicitly granted all permissions, but no other users can access the add-ins.

If you have any non-administrator users who need to access one or both of these add-ins, then you must manually enable the necessary permissions at a user or role level.

Deprecated system configuration settings to hide icons on the Quick Launch menu

In previous versions, the only control over client and add-in access was provided by a set of system configuration settings:

  • AllowShowExcel
  • AllowShowPowerPoint
  • AllowShowWord

If any of these system configuration settings were set to False, then the corresponding icon would be hidden from the Quick Launch menu. This did not prevent use of the client or add-in, but it did discourage use.

Going forward, these system configuration settings are deprecated because they are no longer necessary. However, they have not yet been removed, and they will be honored if set to False. For example, imagine that your system has AllowShowExcel set to False, but a user has the Excel Client Access permission. The Excel Client icon will be hidden from the Quick Launch menu per the system configuration setting, but the user can launch the Excel Client using some other method (such as a desktop shortcut or a ClickOnce hyperlink).

If you currently have any of these system configuration settings set to False, we recommend changing them to True after upgrading to 2020.4. This will allow the security permissions to be the sole determiner of whether the client or add-in icons are hidden on the Quick Launch menu. If the system configuration settings are left at False, this may cause confusion in the future when trying to troubleshoot an access issue for the Excel Client or either of the add-ins.

After the upgrade, an administrator user can easily review and edit these settings as follows:

  1. In the Web Client, click the menu icon in the Global Navigation Bar The blue bar across the top of pages in the Web Client. The Global Navigation Bar provides access to system-wide features.. From the Area menu, select System Administration.

  2. From the Navigation panel, select Software Configuration > System Configuration.

  3. On the System Configuration page, review the three "AllowShow" settings and make sure they are all set to True. If you need to edit a setting:

    • Click the Edit button. This makes the Value field editable.
    • Type True into the Value field.

    • Click the Update button.