Ticket T561660
Visible to All Users

Testing security permissions for different users

created 7 years ago

[DevExpress Support Team: CLONED FROM T559861: Security permissions processing mechanism optimization and important changes in XAF v17.2]
I also love the new features! Can't do any testing myself though but wanted to express my appreciation for all your effort towards XAF!

Do you plan to develop some diagnostics tool that allows administrators to verify how the security settings work out in practice for different users? This is an issue of growing importance for us because of all anti data leak and data privacy laws. How can we show management that the right security settings for each web portal user are in place? Or does this question deserve an own ticket?

Thank you!
Willem

Show previous comments (9)

    >> is it going to be used by application users or XAF developers?
    I think for developers, but maybe for administrative role as well. I think it would be good to allow clients check rights for objects types as mentioned above.

    I have no such implementation, but I think maybe it is poosible with xaf out of the box to create non-persstent list with columns: ObjectType, Read, Write, Navigate, Create, Delete.
    Just as permission table but for several selected roles instead of one.
    Also as improvement way to members could be added. So result table type column will looks like:
    TypeName1
    TypeName2
    TypeName1/Property1

    Table should show all object types and Properties I would added in another place to avoid too many info for user (will looks bad if you add all types and it's properties to table).
    Maybe separate view with customizing properties.

    For objects with specific criteria should be also add some customization. For example system should has specific test objects to check permissions with criteria and user could specify this objects there.
    For example in another view user could selectЖ
    - Type and Property to add type and property path to permissions check list
    - Type and object to add specific object to permissions check list

    Another question how to check associations?

    I think it could be implemented as module or module part and will useful in both platforms: win and web.
    So user could setup needed types, properties and objects. Then fix roles in one window and check it in aonther one by save role and refresh permissions table instead of logoff, login, go to required view to check.

    Something like this.

    Dennis Garavsky (DevExpress) 7 years ago

      @Andrey: Thanks for your elaboration - it is now clearer. We will also continue monitoring similar requests in this regard, though we are not ready to make any generic implementations at this stage. Even though we do not provide public APIs for testing permissions for you to recommend right now, please keep us posted of your progress if you come up with a suitable implementation for your clients.

      Andrey K (DevExpress Support) 7 years ago

        Hello,

        With 17.2.6, we have included Security diagnostic tool into the standard delivery. You can enable it using <add key="EnableDiagnosticActions" value="True" /> in the configuration file and check whether it is helpful in your scenarios. Refer to the T589182: How to diagnose effective access rights for a specific user or get full information about inner security permissions calculations thread to learn more.

        Thanks,
        Andrey

        Disclaimer: The information provided on DevExpress.com and affiliated web properties (including the DevExpress Support Center) is provided "as is" without warranty of any kind. Developer Express Inc disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.

        Confidential Information: Developer Express Inc does not wish to receive, will not act to procure, nor will it solicit, confidential or proprietary materials and information from you through the DevExpress Support Center or its web properties. Any and all materials or information divulged during chats, email communications, online discussions, Support Center tickets, or made available to Developer Express Inc in any manner will be deemed NOT to be confidential by Developer Express Inc. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.