Case Level Permissions - Revision history

Ollvihe at 19:30, 11 December 2021

2021-12-11T19:30:47Z

← Older revision		Revision as of 19:30, 11 December 2021
Line 1:		Line 1:
	In addition to [[~~Roles_and_Permissions_in_QPR_ProcessAnalyzer~~\|project level permissions]], it's possible to set '''case level permissions''' for models, where visibility can be defined for each case separately based on rules. Usually the rules are based on case attribute values. Case level permissions are effective for all users, but users who have the '''GenericWrite''' permission, can change the case permissions setting for a model and thus change the case permissions.		In addition to [[Roles_and_Permissions\|project level permissions]], it's possible to set '''case level permissions''' for models, where visibility can be defined for each case separately based on rules. Usually the rules are based on case attribute values. Case level permissions are effective for all users, but users who have the '''GenericWrite''' permission, can change the case permissions setting for a model and thus change the case permissions.

	== Setting up==		== Setting up==

Ollvihe at 23:03, 26 January 2021

2021-01-26T23:03:28Z

← Older revision		Revision as of 23:03, 26 January 2021
Line 1:		Line 1:
	In addition to [[Roles_and_Permissions_in_QPR_ProcessAnalyzer\|project level permissions]], it's possible to set '''case level permissions''' for models, where visibility can be defined for each case separately based on rules. Usually the rules are based on case attribute values. Case level permissions are effective for all users, but users who have the '''GenericWrite''' permission, can change the case permissions setting for a model and thus change the case permissions.		In addition to [[Roles_and_Permissions_in_QPR_ProcessAnalyzer\|project level permissions]], it's possible to set '''case level permissions''' for models, where visibility can be defined for each case separately based on rules. Usually the rules are based on case attribute values. Case level permissions are effective for all users, but users who have the '''GenericWrite''' permission, can change the case permissions setting for a model and thus change the case permissions.

	== ~~Configuration~~ ==		== Setting up==
	Case level permissions are configured in the model properties (can be opened in the models list in the header) in the '''Case Level Permissions''' tab. The following settings are available:		Case level permissions are configured in the model properties (can be opened in the models list in the header) in the '''Case Level Permissions''' tab. The following settings are available:
	* '''Initialization expression''': [[QPR_ProcessAnalyzer_Expressions\|Expression]] that is run only once and can be used as initializing needed objects. This expression can be used to improve performance when part of the Case or EventLogKey expressions are common and thus they don't need to be calculated again for every Case separately.		* '''Initialization expression''': [[QPR_ProcessAnalyzer_Expressions\|Expression]] that is run only once and can be used as initializing needed objects. This expression can be used to improve performance when part of the Case or EventLogKey expressions are common and thus they don't need to be calculated again for every Case separately.

Ollvihe at 23:02, 26 January 2021

2021-01-26T23:02:36Z

← Older revision		Revision as of 23:02, 26 January 2021
Line 1:		Line 1:
	In addition to [[Roles_and_Permissions_in_QPR_ProcessAnalyzer\|project level permissions]], it's possible to set '''case level permissions''' for models, where visibility can be defined for each case separately based on rules. Usually the rules are based on ~~the~~ case attribute values. Case level permissions are effective for all users, but users who have the '''GenericWrite''' permission, can change the case permissions setting for a model and thus ~~also~~ change the case permissions.		In addition to [[Roles_and_Permissions_in_QPR_ProcessAnalyzer\|project level permissions]], it's possible to set '''case level permissions''' for models, where visibility can be defined for each case separately based on rules. Usually the rules are based on case attribute values. Case level permissions are effective for all users, but users who have the '''GenericWrite''' permission, can change the case permissions setting for a model and thus change the case permissions.

	== Configuration ==		== Configuration ==
	Case level permissions are configured in the model properties in the '''~~Details~~''' tab. The following settings are available:		Case level permissions are configured in the model properties (can be opened in the models list in the header) in the '''Case Level Permissions''' tab. The following settings are available:
	* '''Initialization expression''': [[QPR_ProcessAnalyzer_Expressions\|Expression]] that is run only once and can be used as initializing needed objects. This expression can be used to improve performance when part of the Case or EventLogKey expressions are common and thus they don't need to be calculated again for every Case separately.		* '''Initialization expression''': [[QPR_ProcessAnalyzer_Expressions\|Expression]] that is run only once and can be used as initializing needed objects. This expression can be used to improve performance when part of the Case or EventLogKey expressions are common and thus they don't need to be calculated again for every Case separately.
	* '''Permissions expression''': Expression determining which cases the accessing user can see. The expression is evaluated for each case (in the case context). If the evaluation results ''true'', the case is visible for the user; otherwise not. The evaluation is done when no existing eventlog if found based on the ''Eventlog key'' and a new eventlog needs to be generated. This expression is mandatory for the case level permissions to work		* '''Permissions expression''': Expression determining which cases the accessing user can see. The expression is evaluated for each case (in the case context). If the evaluation results ''true'', the case is visible for the user; otherwise not. The evaluation is done when no existing eventlog if found based on the ''Eventlog key'' and a new eventlog needs to be generated. This expression is mandatory for the case level permissions to work
	* '''Eventlog key''': Expression used to generate a uniquely identifying string for the eventlogs when the case level permissions are in use. If a cached eventLog with the same key already exists in the system, that eventlog is used instead of creating a new.		* '''Eventlog key expression''': Expression used to generate a uniquely identifying string for the eventlogs when the case level permissions are in use. If a cached eventLog with the same key already exists in the system, that eventlog is used instead of creating a new.

	== Configuration examples ==		== Configuration examples ==

Ollvihe: /* Configuration examples */

2020-11-24T14:00:42Z

Configuration examples

← Older revision		Revision as of 14:00, 24 November 2020
Line 23:		Line 23:
	* Eventlog key: '''If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")'''		* Eventlog key: '''If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")'''

	~~Only user~~ ''qpr'' can see cases where ~~(case attribute)~~ ''Region'' is ''Dallas'', and all other users see all cases:		User ''qpr'' can only see cases where ''Region'' is ''Dallas'', and all other users can see all cases:
	* Initialization expression: '''let userName = CurrentUser.Name'''		* Initialization expression: '''let userName = CurrentUser.Name'''
	* Permissions expression: '''(userName == "qpr" && Attribute("Region") == "Dallas") \|\| userName != "qpr"'''		* Permissions expression: '''(userName == "qpr" && Attribute("Region") == "Dallas") \|\| userName != "qpr"'''
	* Eventlog key: '''~~userName == "qpr"~~'''		* Eventlog key: '''CurrentUser.Id'''

	== Use case ==		== Use case ==

Ollvihe: /* Configuration examples */

2020-11-24T13:33:35Z

Configuration examples

← Older revision		Revision as of 13:33, 24 November 2020
Line 25:		Line 25:
	Only user ''qpr'' can see cases where (case attribute) ''Region'' is ''Dallas'', and all other users see all cases:		Only user ''qpr'' can see cases where (case attribute) ''Region'' is ''Dallas'', and all other users see all cases:
	* Initialization expression: '''let userName = CurrentUser.Name'''		* Initialization expression: '''let userName = CurrentUser.Name'''
	* Permissions expression: '''(Attribute("Region") == "Dallas~~" && userName == "qpr~~") \|\| userName != "qpr"'''		* Permissions expression: '''(userName == "qpr" && Attribute("Region") == "Dallas") \|\| userName != "qpr"'''
	* Eventlog key: '''userName == "qpr"'''		* Eventlog key: '''userName == "qpr"'''

Ollvihe: /* Configuration examples */

2020-11-24T13:33:18Z

Configuration examples

← Older revision		Revision as of 13:33, 24 November 2020
Line 23:		Line 23:
	* Eventlog key: '''If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")'''		* Eventlog key: '''If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")'''

	Only user ''qpr'' can see cases where ''Region'' ~~case attribute~~ is ''Dallas'', and other users see all cases :		Only user ''qpr'' can see cases where (case attribute) ''Region'' is ''Dallas'', and all other users see all cases:
	* Initialization expression: '''let userName= CurrentUser.Name'''		* Initialization expression: '''let userName = CurrentUser.Name'''
	* Permissions expression: '''(Attribute("Region") == "Dallas" && userName == "qpr") \|\| userName != "qpr"'''		* Permissions expression: '''(Attribute("Region") == "Dallas" && userName == "qpr") \|\| userName != "qpr"'''
	* Eventlog key: '''userName == "qpr"'''		* Eventlog key: '''userName == "qpr"'''

Ollvihe: /* Configuration examples */

2020-11-24T13:32:52Z

Configuration examples

← Older revision		Revision as of 13:32, 24 November 2020
Line 22:		Line 22:
	* Permissions expression: '''(Region == "Dallas" && "GroupA".In(groupNames)) \|\| (Region == "New York" && "GroupB".In(groupNames))'''		* Permissions expression: '''(Region == "Dallas" && "GroupA".In(groupNames)) \|\| (Region == "New York" && "GroupB".In(groupNames))'''
	* Eventlog key: '''If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")'''		* Eventlog key: '''If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")'''

			Only user ''qpr'' can see cases where ''Region'' case attribute is ''Dallas'', and other users see all cases :
			* Initialization expression: '''let userName= CurrentUser.Name'''
			* Permissions expression: '''(Attribute("Region") == "Dallas" && userName == "qpr") \|\| userName != "qpr"'''
			* Eventlog key: '''userName == "qpr"'''

	== Use case ==		== Use case ==

Ollvihe: /* Configuration examples */

2020-11-24T13:19:21Z

Configuration examples

← Older revision		Revision as of 13:19, 24 November 2020
Line 8:		Line 8:

	== Configuration examples ==		== Configuration examples ==
	~~In this example, visibility~~ of cases is limited in a way that only those users can see ~~the~~ cases belonging to a ~~user~~ group which name is same as the Region (case attribute).		Visibility of cases is limited in a way that only those users can see cases belonging to a group which name is same as the ''Region'' (case attribute).
	* Initialization expression: '''~~Let("~~groupNames", OrderByValue(CurrentUser.GroupNames))'''		* Initialization expression: '''let groupNames = OrderByValue(CurrentUser.GroupNames)'''
	* Permissions expression: '''Region.In(groupNames)'''		* Permissions expression: '''Region.In(groupNames)'''
	* Eventlog key: '''StringJoin("_", groupNames)'''		* Eventlog key: '''StringJoin("_", groupNames)'''

	~~In this example, cases~~ are only visible for users whose user name is same as the Account Manager (case attribute):		Cases are only visible for users whose user name is same as the ''Account Manager'' (case attribute):
	* Initialization expression: '''let userName = CurrentUser.Name'''		* Initialization expression: '''let userName = CurrentUser.Name'''
	* Permissions expression: '''Attribute("Account Manager") == userName'''		* Permissions expression: '''Attribute("Account Manager") == userName'''
	* Eventlog key: '''CurrentUser.Id'''		* Eventlog key: '''CurrentUser.Id'''

	~~In this example, cases having "~~Region" case attribute ~~of "~~Dallas" will only be visible for users belonging to ~~user~~ group "GroupA" (and "New York" for group "GroupB"):		Cases where ''Region'' case attribute is ''Dallas'' will only be visible for users belonging to group ''GroupA'' (and ''New York'' for group ''GroupB''):
	* Initialization expression: '''let groupNames = CurrentUser.GroupNames'''		* Initialization expression: '''let groupNames = CurrentUser.GroupNames'''
	* Permissions expression: '''(Region == "Dallas" && "GroupA".In(groupNames)) \|\| (Region == "New York" && "GroupB".In(groupNames))'''		* Permissions expression: '''(Region == "Dallas" && "GroupA".In(groupNames)) \|\| (Region == "New York" && "GroupB".In(groupNames))'''

Ollvihe: /* Configuration examples */

2020-11-24T13:17:18Z

Configuration examples

← Older revision		Revision as of 13:17, 24 November 2020
Line 9:		Line 9:
	== Configuration examples ==		== Configuration examples ==
	In this example, visibility of cases is limited in a way that only those users can see the cases belonging to a user group which name is same as the Region (case attribute).		In this example, visibility of cases is limited in a way that only those users can see the cases belonging to a user group which name is same as the Region (case attribute).
	* Initialization expression: Let("groupNames", OrderByValue(CurrentUser.GroupNames))		* Initialization expression: '''Let("groupNames", OrderByValue(CurrentUser.GroupNames))'''
	* Permissions expression: Region.In(groupNames)		* Permissions expression: '''Region.In(groupNames)'''
	* Eventlog key: StringJoin("_", groupNames)		* Eventlog key: '''StringJoin("_", groupNames)'''

	In this example, cases are only visible for users whose user name is same as the Account Manager (case attribute):		In this example, cases are only visible for users whose user name is same as the Account Manager (case attribute):
	* Initialization expression: let userName = CurrentUser.Name		* Initialization expression: '''let userName = CurrentUser.Name'''
	* Permissions expression: Attribute("Account Manager") == userName		* Permissions expression: '''Attribute("Account Manager") == userName'''
	* Eventlog key: CurrentUser.Id		* Eventlog key: '''CurrentUser.Id'''

	In this example, cases having "Region" case attribute of "Dallas" will only be visible for users belonging to user group "GroupA" (and "New York" for group "GroupB"):		In this example, cases having "Region" case attribute of "Dallas" will only be visible for users belonging to user group "GroupA" (and "New York" for group "GroupB"):
	* Initialization expression: let groupNames = CurrentUser.GroupNames;		* Initialization expression: '''let groupNames = CurrentUser.GroupNames'''
	* Permissions expression: (Region == "Dallas" && "GroupA".In(groupNames)) \|\| (Region == "New York" && "GroupB".In(groupNames))		* Permissions expression: '''(Region == "Dallas" && "GroupA".In(groupNames)) \|\| (Region == "New York" && "GroupB".In(groupNames))'''
	* Eventlog key: If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")		* Eventlog key: '''If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")'''

	== Use case ==		== Use case ==

Ollvihe: /* Usecase */

2020-11-24T13:16:24Z

Usecase

← Older revision		Revision as of 13:16, 24 November 2020
Line 23:		Line 23:
	* Eventlog key: If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")		* Eventlog key: If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")

	== ~~Usecase~~ ==		== Use case ==
	Case level permissions can be implemented with the principle illustrated in the image below. ''Users'' already belong to certain ''groups'' in the user management, and ''cases'' have certain ''case attribute values'' which is part of the loaded process mining data. Additionally, the linkage between case attribute values (of a certain case attribute) and groups needs to be defined when this security feature is configured. The image below illustrates the chain between ''users'' and ''cases'', how certain users are able to see certain cases when viewing analyses from a QPR ProcessAnalyzer model.		Case level permissions can be implemented with the principle illustrated in the image below. ''Users'' already belong to certain ''groups'' in the user management, and ''cases'' have certain ''case attribute values'' which is part of the loaded process mining data. Additionally, the linkage between case attribute values (of a certain case attribute) and groups needs to be defined when this security feature is configured. The image below illustrates the chain between ''users'' and ''cases'', how certain users are able to see certain cases when viewing analyses from a QPR ProcessAnalyzer model.