[DevExpress Support Team: CLONED FROM T559861: Security permissions processing mechanism optimization and important changes in XAF v17.2]
I also love the new features! Can't do any testing myself though but wanted to express my appreciation for all your effort towards XAF!
Do you plan to develop some diagnostics tool that allows administrators to verify how the security settings work out in practice for different users? This is an issue of growing importance for us because of all anti data leak and data privacy laws. How can we show management that the right security settings for each web portal user are in place? Or does this question deserve an own ticket?
Thank you!
Willem
Hello Willem,
>>
Do you plan to develop some diagnostics tool that allows administrators to verify how the security settings work out in practice for different users? This is an issue of growing importance for us because of all anti data leak and data privacy laws. How can we show management that the right security settings for each web portal user are in place?
<<
If I understand your main business problem and the application acceptance procedure right, there is a simpler solution: you can sit in front of your stake holder and show how you log in under different users and that protected data is hidden, as expected.
At this stage, I do not quite understand why you think a complicated tool is required for this or exactly how this tool can be used, which results it should report, etc.
If my simple suggestion does not work, I would need to learn more about your current acceptance procedure and real problems with it before thinking of any technical solutions on our end, because they may vary a lot depending on a source problem.
I am looking forward to hearing from you.
One of my clients has a similar request - originating from their governance team. They want to be able to audit the permissions setup on a system. In reality this took the form of a report that churns out huge quantities of data that I suspect no one looks at in detail but are satisfied by the volume of the report and the fact that such a report exists means it "must" have been considered.
I think some reports could solve this by listing which users have with groups and then a report of the access control data for each group. Whilst not complex (fairly simple listing of table contents) it would be nice if these reports were standard because we all hate doing these boring routine stuff right?
Steve,
I think that we should come up with something better than just trying to impress with huge amounts of data. But for starters, it would be good to have this information in a frozen form (pdf or something).
Willem
PS As @MartinBrekhof noted last week (realworld meeting) Novell's Netware already provided 'current effective rights' functionality.
@Steve, Willem: Thanks for your updates. To make sure we understand your requirements well, would you please take our MainDemo app as an example and provide specific examples of such security reports for Sam and John? Please use the exact format, which you likely already presented to your client or the audit team in the past and are planning to do so in the near future. We will do our best to learn from your examples. Once we understand what you are after specifically, we will better see how to approach it technically.
>>
there is a simpler solution: you can sit in front of your stake holder and show how you log in under different users and that protected data is hidden, as expected.
<<
Am I correct that this would not work for you?
Will do.
>>>>>>
there is a simpler solution: you can sit in front of your stake holder and show how you log in under different users and that protected data is hidden, as expected.
<<
Am I correct that this would not work for you?
<<<<
That's correct. It is not about real-time convincing. It is about governance and to ascertain / certify that data is correctly secured (or not). To make sure that only authorized people have/had access to certain information.
Willem
>>That's correct. It is not about real-time convincing. It is about governance and to ascertain / certify that data is correctly secured (or not). To make sure that only authorized people have/had access to certain information.
Thanks, Willem.
Hello,
We are planning to provide a tool that will show how permissions are calculated. If you are interested in such an instrument please refer to the How to diagnose effective access rights for a specific user or get full information about inner security permissions calculations thread and leave your feedback there.
Thanks,
Andrey
I see requests a report list here. I think would be helpful to add possibility to request all types and return some report for all types. Also would be good to request additionaly types members.
For specific objects permissions maybe should be added some rules to test it.
So maybe separate tool (or a list view) with get list of rights of all types by default for every role (user or maybe role combination with multiselect) and possibility to request type members on demand.
I think would be helpful to test roles in one place.
@Andrey: We appreciate your feedback. Would you please additionally elaborate on how this report is going to be used: is it going to be used by application users or XAF developers? If this requirement is important for your app and you already realized it (or plan to do so), we would greatly appreciate it if you share your implementation details with us (e.g., screenshots of the resultant application UI) so that we can better understand expected results.
>> is it going to be used by application users or XAF developers?
I think for developers, but maybe for administrative role as well. I think it would be good to allow clients check rights for objects types as mentioned above.
I have no such implementation, but I think maybe it is poosible with xaf out of the box to create non-persstent list with columns: ObjectType, Read, Write, Navigate, Create, Delete.
Just as permission table but for several selected roles instead of one.
Also as improvement way to members could be added. So result table type column will looks like:
TypeName1
TypeName2
TypeName1/Property1
Table should show all object types and Properties I would added in another place to avoid too many info for user (will looks bad if you add all types and it's properties to table).
Maybe separate view with customizing properties.
For objects with specific criteria should be also add some customization. For example system should has specific test objects to check permissions with criteria and user could specify this objects there.
For example in another view user could selectЖ
- Type and Property to add type and property path to permissions check list
- Type and object to add specific object to permissions check list
Another question how to check associations?
I think it could be implemented as module or module part and will useful in both platforms: win and web.
So user could setup needed types, properties and objects. Then fix roles in one window and check it in aonther one by save role and refresh permissions table instead of logoff, login, go to required view to check.
Something like this.
@Andrey: Thanks for your elaboration - it is now clearer. We will also continue monitoring similar requests in this regard, though we are not ready to make any generic implementations at this stage. Even though we do not provide public APIs for testing permissions for you to recommend right now, please keep us posted of your progress if you come up with a suitable implementation for your clients.
Hello,
With 17.2.6, we have included Security diagnostic tool into the standard delivery. You can enable it using <add key="EnableDiagnosticActions" value="True" /> in the configuration file and check whether it is helpful in your scenarios. Refer to the T589182: How to diagnose effective access rights for a specific user or get full information about inner security permissions calculations thread to learn more.
Thanks,
Andrey