You can define who may view or use parts of a Turnkey application by combining authenticated users, roles, and AccessGroups; this page is for MDriven developers who configure ViewModel permissions.
Authentication and authorization
Authentication establishes who the user is. Authorization establishes what that authenticated user is permitted to do.
SysUserAuthentication provides user registration and sign-in for a Turnkey App and handles both authentication and authorization. Its SysUser class includes isAdmin, which specifies whether a user has administrator permissions.
Control access with AccessGroups
An AccessGroup is a named set of access rules for ViewModels and actions. Define an expression for an AccessGroup that evaluates to true or false.
For example, create an AccessGroup named MustBeAdmin. Add administration ViewModels and their actions to the group, then use the current user's administrator value as the rule.
SysSingleton is a singleton class: it has one object instance. oclSingleton returns that instance, creating it if needed. In this example, the singleton provides the current user to the model, and the AccessGroup rule permits the grouped administration functions only when that user is an administrator.
You can define as many AccessGroups as your application needs. Keep related rules together. For example, use one group for administrator functions and another group for functions available to a particular user role. Add both actions and ViewModels to the relevant group so that the access rule is defined in one place.
Use roles with ViewModel permissions
Use roles with AccessGroups to set ViewModel permissions for different user groups.
For example, model a role for users who may work with orders and use an AccessGroup to control the order ViewModel and its actions. The role identifies the user group; the AccessGroup defines the access for the ViewModel and actions in that group.
The access-rule expressions can depend on data in your model. This lets you evaluate the current user's properties, roles, or other model data when deciding access.
Server-side access control
In Turnkey, the ViewModel defines the slice of data shown to an authenticated and authorized user. The ViewModel data reduction happens on the server and is expressed declaratively with OCL. The resulting data slice and its changes are streamed to the client; information outside that slice is not exposed by the ViewModel.
Use AccessGroups for access to ViewModels and actions.
MDrivenServer roles
MDrivenServer has separate authorization administration for its services. In User Admin at <your site>/admin/UsersAndRolesAdmin.aspx, authorization is controlled through the SuperAdmin and AppUser roles.
| Role | Use documented for MDrivenServer |
|---|---|
SuperAdmin
|
Assign to the app-pool user and developers who control the executed model. |
AppUser
|
Assign to other users. |
When MDrivenServer uses Windows Authentication, the "Admin Require Identification" setting stops any authenticated user from making changes, and "Services require identification" stops anyone not authorized from accessing the WCF services. If services require identification, add the account that runs the MDrivenServer web application because it must use the WCF services.