Hi again,

I slved the first part (revoking edit/delete permissions for VIP contacts) but still struggling with the second part (revoking read access to sensitive fields).

Any help on this would be highly appreciated!

Thanks,

Robert

Hello Robert,

If I understand right, you can refer to this guide: https://academy.creatio.com/documents/administration/7-16/managing-colu…

Regards,

Akira Nguyen

Phuong Akira,

Hello Akira,

thanks for the reply, but this is not solving the issue. The reason is that I have to conditionally restrict access to the field.

Only when the contact is a VIP contact (that is, if it has a certain detail record), the sensitive fields should get accessible only by a certain role.

If I use column permissions, the field (eg the mobile number) will be restricted on every contact, not just VIP contacts.

Thanks,

Robert

Hello Robert,

To solve your issue, I think you can combine some coding + business rule

1. You can code method: if usr with specific role open page, set 1 usrfield = true; else = false

2. Business rule: customer = VIP AND usrfield = true; hide mobile phone field

Sorry, I am not a coder so I cannot guide you on how to code it.



Regards,

Akira Nguyen

If the protections on data are to comply with legal regulations, then client-side hiding or editing restrictions are not enough. I don't know what Robert's requirements for this are, but suggesting client-side logic to hide sensitive data without knowing why its access needs to be restricted is dangerous.

Harvey Adcock,

Hello Harvey,

you are absolutely right and I do not want a solution to hide the data via the UI.

The requirement is not based on legal regulations, but nevertheless, I want a robust solution where the user can't access the data no matter what he/she tries (the user could add the sensitive field in the list for example).

Unfortunately, I haven't found such a solution that is doable with the means of creatio permissions.

Do you have an idea?

Thanks,

Robert

Robert Pordes,

It would be a nice feature, given that Creatio has the ability to do row level security on a per-user basis, but it isn't possible currently.

The closest thing I could think of would be to have an extension table holding the sensitive data, which has its row level security applied by the Business Process you mentioned, but from what I can tell Creatio doesn't support extension tables either, so it would be a very code-intensive process of building that functionality in Creatio first...

Sorry I can't be of more help, hopefully others have some better ideas.

Hello Ramnath,

Could you please provide us with screenshots of the business process elements settings for further assistance on this matter?

Thank you in advance! Looking forward to your reply. 

Olga. 

Olga Avis,

Here are the screenshots of elements:-

1. Trigger element - record added

2. Read portal user name (Field name - Borrower)

3. The access rights added

The Role is the name of borrower which was read in 2nd Read Borrower element.

This process is in my local dev environment. I have also created the same process on a trial cloud environment. But the process does not seem to work. 

Is there anything I am missing?

Hello,

It is necessary to grant the rights not to User role but for the Employee  where you should indicate the value of the Borrower field http://prntscr.com/stoezu .  It should be something like this [#Read Borrower.First item of resulting collection.Borrower#]

As for now you try to grant the rights to some role and the system cannot identify it.

Best regards,

Dean

Dean Parrett,

I assigned the access role in process for employee. And the process works now.

But why can't we do for User role.

Even if it works with employee role. The borrower is not an employee. He/She is an end user who will fill the form. Why does it have to be assigned in Employee role.

Can you please elaborate?

Thanks

Ramnath

Hello,

The thing is that your process doesn't read the user role. It would be necessary to find the user's role first using additional read data elements and based on which role is found by, use it in Role parameter instead of Employee.

Regards,

Dean 

Hi Fulgen,



The suggestion is to a new column to SysAdminUnit table with link to Area. So whenever the new Area is added to the system, system will automatically check if there is a role with this area and if not - create a new role. Also, I believe when you are adding users to the role, you are following some logic (e.g. user.Contact.Area = area) so after this operation you can also automatically add users to that role.



Please note that it is a complex task so will have to think about structure and the way you want to run this procedure. If the record is added in the UI you can handle it by business process for example, but if areas are created from some kind of integration - you would need to come up with different approach depending on the integration that you are using. The structure of organizational roles is also important. I suggest you to create a new role 'Area roles' and when you are checking if the role exists, or creating a new role - this role should be the parent role.



Regards,

Dmytro

Dear Fulgen,

You need to add the non administrator user to the operation permission 'CanManageUsers'. Thus, this user will be able to create the new users. 

Best regards,

Dean

Dean Parrett,

Thanks Dean, this is what I am looking for, how about giving permission to access the Functional roles and organizational roles. I already checked all the items under operation permission but i am not able to get the permission related to this.

Dear Fulgen,

This is the same operation. It also gives the access to organizational and functional roles.

Best,

Dean

Dear Fulgen,

If you want certain role to access users section you can use CanManageUsers operation permission. We do not recommend enabling or changing access right for System administration object. Users with CanManageUsers will be able to view users and change their login/passwords. The will not be able to change licenses or roles.   

Best regards,

Angela

Angela Reyes,

Hi angela, thank you for your reply, where can i find this CanManageUsers? can you show me any example

Fulgen Ninofranco,

It is located in operation permissions section: 

http://prntscr.com/n26sj3 and has code CanManageUsers

Hi Angela, Thanks for your reply, I alredy tried but it seems it is giving all the permissions, what I want is only read permission. Any Idea how can I achieve this?

Fulgen Ninofranco,

Please note that SysAdminUnit is a system table and almost all of other table are in connection with SysAdminUnit, so making any changes to this section is a pretty dangerous operation.

Information that is stored in this table is intended for system administrators and should not be processed by a regular user.

However, you always can create your own section and fill it with data from the "System users" section via business process.



Best regards,

Alex

Dear Ezequiel,

In order to omit rights check you can create an ESQ on the server side by the means of C#. However, instead of using UserConnection, you can use SystemUserConnection, which would let you execute the functionality no matter under what user.

"Script task" business process element or service will perfectly fit and cover the task. Choose the means more comfortable for you.

Here is how to obtain SystemUserConnection:

private SystemUserConnection SystemUserConnection {
			get {
				return _systemUserConnection ?? (_systemUserConnection = (SystemUserConnection)AppConnection.SystemUserConnection);
			}

Here is an article of how to build ESQ on server side. Though, its pretty much the same as on the client side:

https://academy.bpmonline.com/documents/technic-sdk/7-11/use-entitysche…

Hope you find it helpful.

Regards,

Anastasia

Hi Anastasia!

Thanks you for your answer!

How could I validate in the Employee registration that the "Legajo" field value is not repeated in the way you are indicating?

 Can I call a business process from EmployeeMiniPage to return an answer?

I need that validation along with others before saving the employee!

King Regards!

Ezequiel

Dear Ezequiel,

In order to implement such functionality on the page, you need to do the following;

1. Create a webservice, which brushes through the Employee table for duplicates. Please see more details on how to write a service here:

https://academy.bpmonline.com/documents/technic-sdk/7-8/how-call-config…

2. Create a new virtual boolean attribute. We will use it in our further steps.

            "ESQCompleted": {
                dataValueType: Terrasoft.DataValueType.BOOLEAN,
                type: Terrasoft.ViewModelColumnType.VIRTUAL_COLUMN
                value: false
            }

3. Override a basic save() method and firstly insert a validation, that if this.get("ESQCompleted") true, than we call parent function, if not, than run service call, as in the article.

4. In the response, based on the result, you either show information dialog regarding existing duplicate, or set attribute to true and call save method again.

Regards, 

Anastasia

Dear Anastasia,

Sorry, for the delay in the response. When working with the service I found several errors, I could not include the SystemUserConnection variable because it was throwing errors and when working with UserConnection as a test I also get several errors. Am i missing a reference?. I attach the code

namespace Terrasoft.Configuration.Test
{
	using System;
	using System.ServiceModel;
	using System.ServiceModel.Web;
	using System.ServiceModel.Activation;
	using System.Collections.Generic;
	using System.Collections.ObjectModel;
	using System.Data;
	using Terrasoft.Common;
	using Terrasoft.Core;
	using Terrasoft.Core.DB;
	using Terrasoft.Core.Entities; 
	// Service class is marked with [ServiceContract] compulsory attributes and
	// [AspNetCompatibilityRequirements] with parameters.
	[ServiceContract]
	[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]
	public class EmployeeService
	{
		/*private SystemUserConnection SystemUserConnection {
			get {
				return _systemUserConnection ?? (_systemUserConnection = (SystemUserConnection)AppConnection.SystemUserConnection);
			}
		}*/
		// Service methods are marked with compulsory attributes [OperationContract] and [WebInvoke] with parameters.
		[OperationContract]
		[WebInvoke(Method = "POST", RequestFormat = WebMessageFormat.Json, 
			BodyStyle = WebMessageBodyStyle.Wrapped, ResponseFormat = WebMessageFormat.Json)]
		public string ObtenerCantidadLegajosRepetidos(string nroLegajo, string cuitEmpresa)
		{
			//var result = nroLegajo + " + output string";
			var result = "T";
			entitySchemaManager = UserConnection.EntitySchemaManager;
			var employeeSchema = entitySchemaManager.GetInstanceByName("Employee"); 
			var esqEmployee = new EntitySchemaQuery(entitySchemaManager, employeeSchema.Name);
 
			var colId = esqEmployee.AddColumn("Id");
 
			//Agrego filtros en el query
			var filtroCUIT = esqEmployee.CreateFilterWithParameters(FilterComparisonType.Equal,"Account.UsrCUIT", cuitEmpresa);
			var filtroLegajo = esqEmployee.CreateFilterWithParameters(FilterComparisonType.Equal,"UsrNroLegajo", nroLegajo);
 
 
			// Adding created filters to query collection.
			esqEmployee.Filters.Add(filtroCUIT);
			esqEmployee.Filters.Add(filtroLegajo);
 
			// Execution of cache to database and getting resultant collections of objects.
			// Query results will be placed in cache after completion of this operation.
			var employeeCollection = esqEmployee.GetEntityCollection(UserConnection);
			if (employeeCollection == null || employeeCollection.Count == 0)
			{
				result = "F";
			}
			return result;
		}
	}
}

The errors that appear to me are the following:

I hope you can help me!

King Regards,

Ezequiel

Dear Ezequiel,

The reason for an error with UserConnection, is that you are missing "var" in variable declaration:

var entitySchemaManager = UserConnection.EntitySchemaManager;

As for the SystemUserConnection, please add the _systemUserConnection property declaration before the code I have previously indicated, like this: 

private SystemUserConnection _systemUserConnection;
private SystemUserConnection SystemUserConnection {
	get {
	     return _systemUserConnection ?? (_systemUserConnection = 
        (SystemUserConnection)AppConnection.SystemUserConnection);
	}
}

Hope this will solve the issue.

Regards,

Anastasia

Dear Anastasia!

How are you? Thank you for your answer!

Could it be that I'm missing a reference? I attached image

Regards!

Ezequiel

Dear Ezequiel,

Please try to make variable, which you assign SystemUserConnection, of a static type. In case this won't help, please share the whole code.

Regards,

Anastasia

Dear Anastasia,

I continue with the problem. I attached code.

namespace Terrasoft.Configuration.Test
{
	using System;
	using System.ServiceModel;
	using System.ServiceModel.Web;
	using System.ServiceModel.Activation;
	using System.Collections.Generic;
	using System.Collections.ObjectModel;
	using System.Data;
	using Terrasoft.Common;
	using Terrasoft.Core;
	using Terrasoft.Core.DB;
	using Terrasoft.Core.Entities; 
 
	[ServiceContract]
	[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]
	public class EmployeeService
	{
		private static SystemUserConnection _systemUserConnection;
		private static SystemUserConnection SystemUserConnection {
			get {
				return _systemUserConnection ?? (_systemUserConnection = (SystemUserConnection)AppConnection.SystemUserConnection);
			}
		}
 
		[OperationContract]
		[WebInvoke(Method = "POST", RequestFormat = WebMessageFormat.Json, 
			BodyStyle = WebMessageBodyStyle.Wrapped, ResponseFormat = WebMessageFormat.Json)]
		public string ObtenerCantidadLegajosRepetidos(string nroLegajo, string cuitEmpresa)
		{
 
			//var result = nroLegajo + " + output string";
			var result = "T";
			var entitySchemaManager = SystemUserConnection.EntitySchemaManager;
			var employeeSchema = entitySchemaManager.GetInstanceByName("Employee"); 
			var esqEmployee = new EntitySchemaQuery(entitySchemaManager, employeeSchema.Name);
 
			var colId = esqEmployee.AddColumn("Id");
 
			var filtroCUIT = esqEmployee.CreateFilterWithParameters(FilterComparisonType.Equal,"Account.UsrCUIT", cuitEmpresa);
			var filtroLegajo = esqEmployee.CreateFilterWithParameters(FilterComparisonType.Equal,"UsrNroLegajo", nroLegajo);
 
			esqEmployee.Filters.Add(filtroCUIT);
			esqEmployee.Filters.Add(filtroLegajo);
 
			var employeeCollection = esqEmployee.GetEntityCollection(SystemUserConnection);
			if (employeeCollection == null || employeeCollection.Count == 0)
			{
				result = "F";
			}
			return result;
		}
	}
}

Thanks you for your help!

King Regards!

Dear Anastasia!

I have to say that removing the definition of SystemUserConnection and using UserConnection I get a similar error

King Regards!

Ezequiel

Dear Ezequiel,

Please find the modified code for your service. I have successfully tested it on my side:

namespace Terrasoft.Configuration.Test
{
	using System;
	using System.ServiceModel;
	using System.ServiceModel.Web;
	using System.ServiceModel.Activation;
	using System.Collections.Generic;
	using System.Collections.ObjectModel;
	using System.Data;
	using System.Web;
	using Terrasoft.Common;
	using Terrasoft.Core;
	using Terrasoft.Core.DB;
	using Terrasoft.Core.Entities; 
 
	[ServiceContract]
	[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]
	public class EmployeeService
	{
 
		[OperationContract]
		[WebInvoke(Method = "POST", RequestFormat = WebMessageFormat.Json, 
			BodyStyle = WebMessageBodyStyle.Wrapped, ResponseFormat = WebMessageFormat.Json)]
		public string ObtenerCantidadLegajosRepetidos(string nroLegajo, string cuitEmpresa)
		{
			var appConnection = HttpContext.Current.Application["AppConnection"] as AppConnection;
 
			//var result = nroLegajo + " + output string";
			var result = "T";
			var entitySchemaManager = appConnection.SystemUserConnection.EntitySchemaManager;
			var employeeSchema = entitySchemaManager.GetInstanceByName("Employee"); 
			var esqEmployee = new EntitySchemaQuery(entitySchemaManager, employeeSchema.Name);
 
			var colId = esqEmployee.AddColumn("Id");
 
			var filtroCUIT = esqEmployee.CreateFilterWithParameters(FilterComparisonType.Equal,"Account.UsrCUIT", cuitEmpresa);
			var filtroLegajo = esqEmployee.CreateFilterWithParameters(FilterComparisonType.Equal,"UsrNroLegajo", nroLegajo);
 
			esqEmployee.Filters.Add(filtroCUIT);
			esqEmployee.Filters.Add(filtroLegajo);
 
			var employeeCollection = esqEmployee.GetEntityCollection(appConnection.SystemUserConnection);
			if (employeeCollection == null || employeeCollection.Count == 0)
			{
				result = "F";
			}
			return result;
		}
	}
}

Dear Andrey,

You have to use only UserConnection in GetEntityCollection method. Here is a signature of a method:

public EntityCollection GetEntityCollection(UserConnection userConnection)

Peter Vdovukhin,

Dear Peter,

Thank you for answer! May be you know how to get UserConnection on start appliacation (without users)? 

Dear Andrey,

Could you create a new topic with this question? It will be available for search and may be helpful for others.

Could you try instead of:

var SysAdminUnitCollection = esqSysAdminUnit.GetEntityCollection(appConnection.SystemUserConnection)

write:

var SysAdminUnitCollection = esqSysAdminUnit.GetEntityCollection((SystemUserConnection)appConnection.SystemUserConnection)

The thing is that SystemUserConnection inherits from UserConnection so you can pass SystemUserConnection instead of UserConnection

Dear Ezequiel,



If your goal is just to hide the contacts section but you want to get the ability to read the contacts information for all users, you can try to delete it from the General workplace so that all employees won't see it and restore the read operation permissions to all system users.



System designer -> Workplace setup:



You can add this section to any other workplace and manage the access rules to it or create your own to fulfill your needs.

Best regards,

Lily

Hi Lily!

Thanks for the reply. I delete the section from the General workplace and restore the read operation permissions to all system users. How could I hide the link to Contacts from the main page?

King Regards,

Ezequiel Gómez

Dear Ezequiel,

To hide the link to the section from the main page you need to go to the Configuration, replace SimpleIntro schema, copy the code from the original schema to it and apply the necessary changes to the code. Specifically, to hide the link to the Contacts section, you need to comment the following code part: