How do you secure the larger stand-alone developments that run within Smart Office?  This is a question that I have had to ask on some developments.  Because your development isn’t native M3 code you can’t secure it through the traditional SES400 or SES003 methods.

So how do you allow some users access to some functions but not others, or just read access, rather than read/write?

We can build our own security model, but then we have to store this information somewhere. Creating a whole database UI and associated webservices is horribly expensive. We can store it in a configuration file on the M3 UI Adapter server – but this makes maintaining it pretty difficult.

Or we can use the MNS405 roles. This had been something that I had traditionally ignored as IFL didn’t use MNS405 (or SES400 security) – we were stuck using SES003 and menu security. But when I was engaged on another customer project I decided to take a little time to investigate.

Under the UserContext.Roles we have a list of the roles that a user is in from MNS410. So what I tend to do these days is create roles for my applications in MNS405, and then assign the operator to that role in MNS410. You application can query the UserContext.Roles to see if the desired role(s) exist and provide or restrict access as appropriate.

A user can belong to multiple roles.

Figure 1 – the roles that an user can be assigned to

Figure 2 – a user assigned to a role in MNS410

You can add roles and associations without using role based security. And it means that your customer can manage your applications security within familiar M3 panels and programs and it really provides an extremely quick and easy way for you to add and check security.

And to test

I’m only assigned to one role, but if I was assigned to multiple roles I would see them listed.

And of-course, a post wouldn’t be complete without some code…

import System;
import System.Windows;
import System.Windows.Controls;
import MForms;

package MForms.JScript
{
   class viewRoles
   {
      public function Init(element: Object, args: Object, controller : Object, debug : Object)
      {
      	debug.WriteLine(UserContext.Roles.Count);
      	for(var i = 0; i < UserContext.Roles.Count; i++)
      	{
      		debug.WriteLine("Role: " + UserContext.Roles[i].Role + " Name: " + UserContext.Roles[i].Name + " Description: " + UserContext.Roles[i].Description);
      	}
      }
   }
}

As Thibaud notes below in the comments, this isn’t designed as a method to replace M3 security as it can be circumvented.