Hi Abinaya,

SysAdminUnit object is not accessible from the portal due to security reasons and creating filtration using this object is not possible for portal users. Also it is not recommended to use "Sys" objects on the portal since system objects have restrictions in the application core related to the portal.

You need to create a separate object to store connections between system users, their roles and contacts. This custom object will be accessible from the portal and you will be able to execute filtration under a portal user.

Best regards,

Oscar

Hi Fulgen,



The suggestion is to a new column to SysAdminUnit table with link to Area. So whenever the new Area is added to the system, system will automatically check if there is a role with this area and if not - create a new role. Also, I believe when you are adding users to the role, you are following some logic (e.g. user.Contact.Area = area) so after this operation you can also automatically add users to that role.



Please note that it is a complex task so will have to think about structure and the way you want to run this procedure. If the record is added in the UI you can handle it by business process for example, but if areas are created from some kind of integration - you would need to come up with different approach depending on the integration that you are using. The structure of organizational roles is also important. I suggest you to create a new role 'Area roles' and when you are checking if the role exists, or creating a new role - this role should be the parent role.



Regards,

Dmytro

Dear Rocher,

There are no basic tools to achieve your business task. Even if you remove all employees role from the users list of role, he or she will still have it on the database level. This logic can only be changed with the development tools but we would not recommend to do it since  there  are a lot of application functions  associated with All employees role. Removing it from the users might lead to inappropriate application performance.

Best regards,

Dean

Dean Parrett,

Thanks a lot for your answer, but I'm curious (and on a demonstration platform) so, you said that is possible to change that by the development tools, where exactly can I change this group by default?

Best regards, 

Dear Rocher, 

You can try to update the default All employees role id associated with the user.For example, as you see the user doesn't have any roles selected http://prntscr.com/q26wjn, however she still has All employees on the database level. You would need to update the sysadminunitroleid with the id of required role  http://prntscr.com/q26ywo instead of All employees role id. I do not guarantee that it would help you to achieve your business task since we do not have any examples of any similar changes in the default roles logic. 

Best regards,

Dean

Dean Parrett,

Thanks for your answer, it is really nice of you! 

Best regards 

Dear Janine,

First of all please don't delete "All employees" and "System adminsitrators" roles from the application, because they are essential for correct work of the system. Also we don't recommend deleting of roles, just rename them if you have a need to do it (just open roles tree and use a role you need to rename and after that you will be able to do that in this field http://prntscr.com/mwg2ct). If you delete a role then you will need to find all processes where it is used and add newly created role. In other words - if you delete a role that is used somewhere then it will prevent processes from being executed. Please rename available roles or create your new ones. Meanwhile we have a problem registered for our R&D team about displaying of roles and creating of ways to easy delete them if it is needed. I will notify them about your request so to raise the priority of this problem. Thank you for helping us to make our application better!

Best regards,

Oscar

Oscar Dylan,

Renaming a role doesn't work when the role needs to be in a different location in the hierarchy.  I would want the processes to fail and need to be updated if the wrong people are being assigned to roles.

Janine White,

Then please create a separate role that you need to use and find all processes where you used the previous role and update the business process so to use newly created role. This is the only way how it can be done now.

Unfortunately you will not be able to create a field linked to the VwSysRole view in the account object. VwSysRole is not a table. It's a view and it doesn't allow all of the operations that you can do with a table. 

Additionally, account is a unit that is not related to the system roles. Simply, you can't login with an account. Even contacts are not linked to system roles directly. 

Only admin units that you can find in the system section "System users" are linked to roles directly. Basically, when the system decides what permissions you should have, the system looks at the login credentials that you used and it doesn't look at your contact or an account.

Maybe this example can help

	function getUserSaveRights(callback, renderTo, scope) {
		var currentUser = Terrasoft.SysValue.CURRENT_USER.value;
		var sysAdmins = ConfigurationConstants.SysAdminUnit.Id.SysAdministrators;
		var esq = Ext.create("Terrasoft.EntitySchemaQuery", {
			rootSchemaName: "SysUserInRole"
		});
		esq.addColumn("SysRole");
		esq.addColumn("SysUser");
		esq.filters.add("SysUser", Terrasoft.createColumnFilterWithParameter(
			Terrasoft.ComparisonType.EQUAL, "SysUser", currentUser));
		esq.filters.add("SysRole", Terrasoft.createColumnFilterWithParameter(
			Terrasoft.ComparisonType.EQUAL, "SysRole", sysAdmins));
		esq.getEntityCollection(function(response) {
			if (response && response.success) {
				var result = response.collection;
				var isSysAdmin = (result.collection.length !== 0);
				callback.call(scope, renderTo, isSysAdmin);
			}
		}, this);
	}

Federico,

Thanks for you help!

I was able to solve the query in the following way:

var esq = Ext.create("Terrasoft.EntitySchemaQuery", {
						rootSchemaName: "SysUserInRole"
					});
esq.addColumn("[SysFuncRoleInOrgRole:OrgRole:SysRole].FuncRole.Name", "RolFuncionaAsociado");
 
var esqFilter = esq.createColumnFilterWithParameter(Terrasoft.ComparisonType.EQUAL, "SysUser.Id", userId);
var esqFilter2 = esq.createColumnFilterWithParameter(Terrasoft.ComparisonType.EQUAL, "[SysFuncRoleInOrgRole:OrgRole:SysRole].FuncRole.Name", nombreRol);
esq.filters.add("esqFilter", esqFilter);
esq.filters.add("esqFilter2", esqFilter2);
esq.getEntityCollection(function (result) {
   if (!result.success || result.collection.collection.length == 0) {
		// error processing/logging, for example
		this.showInformationDialog("Data query error");
		return;
   }
   debugger;
   this.set(nombreRol, true);
   return;
}, this);

King Regards!

Ezequiel

Hello!

You can use the following global variable

var currentUserId = Terrasoft.SysValue.CURRENT_USER.value;

Following that, build ESQ Select query.

You can find an example in the following article: 

https://academy.bpmonline.com/documents/technic-sdk/7-11/getting-query-…

Finally, Select from SysUser or SysAdminUnitInRole to obtain roles.

Hello,

Is that Select query from SysAdminUnitInRole still available ? I got an error :

ErrorCode: "SecurityException", message: "Current user does not have permissions for the "SysAdminUnitInRole" object", stackTrace: undefined, errors: Array(0)

I get my role with Select Query in SysUserInRole