KB Article T589182
Visible to All Users

How to diagnose effective access rights for a specific user or get full information about inner security permissions calculations

Problem
Security permissions calculation is quite a complex process, and sometimes it is difficult to diagnose why access to a certain object and its members is allowed or denied. It is more common for application administrators or regular XAF developers who may not want to study documentation guides or be able to debug the XAF source code as per How can I debug DevExpress .NET source code using PDB files or using other approaches. So, in addition to documenting security rules, we are researching the usefulness of a tool that would show how effective permissions are calculated for each user in the UI, very similar to our Diagnostic Action. This may be helpful even to us, to reduce time spent on diagnosing related client problems.

Solution
We created the 'Security Diagnostic' action that shows calculation results in the UI:
Clipboard-File-2.png

The Security Diagnostic Tool shows detailed information about request parameters (the RequestInfo element), the Security System settings (the SecurityInfo element), permission processing results and criteria for each role.
As you can see there is one "Demo" role, which does not grant the "Write" access to the "Property1" property.

Getting started
1. Ensure that you have XAF v17.2.6+ installed, open an application project's configuration file (App.config in WinForms and Web.config in ASP.NET) and locate the appSettings section's EnableDiagnosticActions key.
2.  Set the EnableDiagnosticActions key's value to True:

XML
<add key="EnableDiagnosticActions" value="True" />

This will add the Diagnostic Info Action to the Application Model and the Action will be added to the UI.
3. Run your project, log in under a required user, open a required object's DetailView, click the Security Diagnostic item of the Tools | Diagnostic(Child Window) action, choose an operation and a member name.

Note
the 'Security Diagnostic' action doesn't work with Middle Tier security mode.

Your feedback is needed
Please test the tool and let us know whether it is useful in your development process and how you would change it. For instance, the more specific there are use cases of this tool where it was difficult to configure permissions for a user, the greater it is possible that we can arrive at technical solutions that will address them.

See Also
Concepts > Security System > Permissions for Associated Objects
Concepts > Security System > Security Permissions Caching
Concepts > Security System > Permission Policies

Search keywords: security, diagnostic, troubleshoot, configure, setup, permissions, access rights, granted, allow, deny, roles, users, diagnose, effective, debug

Show previous comments (19)
Andrey K (DevExpress Support) 5 years ago

    Hello,

    Even though there isn't a way to use the 'Security Diagnostic' action with the Middle Tier security mode, you can temporarily connect your app to a database using SecuredObjectSpaceProvider as described in the How to: Change the Client-Side Security Mode from UI Level to Integrated in XPO applications article and diagnose your rights using this configuration.
    After the work is done, switch your app back to the middle tier server.

    Let me know if you have any questions.

    Thanks,
    Andrey

    BF BF
    Bernd Freigang 4 years ago

      Hi support!

      as of my experience, answering the questions "Why can't I do this, why don't I see that?" and so on is one of the very frequent support cases. The current solution provides information about the fact that permission for anything is not existing, but you do not see which permission rule caused this. Are there ways to determine this also?

      Kind regards,
      Markus

      DevExpress Support Team 4 years ago

        I appreciate your feedback, Markus. But, it's not quite clear to me what information you need to obtain. Would you please illustrate your use case based on a couple of roles?

        Disclaimer: The information provided on DevExpress.com and affiliated web properties (including the DevExpress Support Center) is provided "as is" without warranty of any kind. Developer Express Inc disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.

        Confidential Information: Developer Express Inc does not wish to receive, will not act to procure, nor will it solicit, confidential or proprietary materials and information from you through the DevExpress Support Center or its web properties. Any and all materials or information divulged during chats, email communications, online discussions, Support Center tickets, or made available to Developer Express Inc in any manner will be deemed NOT to be confidential by Developer Express Inc. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.