Security
Browse guides and technical documentation
__HIDECREDIT__
Security implementation guide
Security implementation guide
Security rules need access to the current user in the model. The way the current user is identified can differ between implementation scenarios and authentication approaches, but the model can use the identified user when evaluating authorization rules.
Make the current user available
A documented model pattern uses a class named SysSingleton. A singleton has one object instance. The OCL operation oclSingleton accesses that instance; if no instance exists when it is called, one is created.
Create a derived link from SysSingleton to the current user, for example CurrentUser. Rules can then evaluate properties of that user. For example:
SysSingleton.oclSingleton.CurrentUser.IsAdmin=true
This type of expression can be used by Enable and Visible expressions on ViewModel columns and actions, as well as by derived attributes.
Apply repeated rules with AccessGroups
Use AccessGroups when the same rule applies to multiple actions or ViewModels. For each AccessGroup, define expressions that evaluate to true or false for:
- Enable
- Visible
- View
Then add the relevant actions and ViewModels to the group. For example, an AccessGroup named MustBeAdmin can contain administrative actions and ViewModels. This keeps shared access rules in one place rather than repeating them for each item.
Restrict a ViewModel
Each ViewModel also has an AccessExpression. This expression can test both user credentials and the root object of the ViewModel.
Use a ViewModel AccessExpression when access depends on the object being opened as well as on the current user. If the expression returns false, the AccessDenied ViewModel is shown instead.
Authentication integration topics
Authentication identifies the current user; authorization rules determine what that user may access in the model. The Integration documentation includes topics for BankID, OpenID Connect, OAuth2, Azure AD with OpenID, single sign-on, JWT authentication, ASP.NET Identity, and header-based authentication.
After an authentication approach identifies the user, make that user available to the model and use AccessGroups, ViewModel AccessExpressions, and Enable or Visible expressions to apply authorization rules.
Review checklist
| Review item | What to verify |
|---|---|
| Current user | The model provides authorization rules with access to the current user. |
| Shared rules | Repeated Enable, Visible, and View rules are defined in an AccessGroup. |
| ViewModel access | ViewModels whose access depends on credentials or their root object have an AccessExpression. |
| Denied access | An AccessDenied ViewModel is available for denied ViewModel access.
|