Case Level Permissions: Difference between revisions

From QPR ProcessAnalyzer Wiki
Jump to navigation Jump to search
No edit summary
No edit summary
 
(229 intermediate revisions by 4 users not shown)
Line 1: Line 1:
There is model JSON settings for each QPR ProcessAnalyzer model. The JSON settings contain configurations and settings related to the model. The model needs to be reloaded for the changed settings to take effect.
In addition to [[Roles_and_Permissions|project level permissions]], it's possible to set '''case level permissions''' for models, where visibility can be defined for each case separately based on rules. Usually the rules are based on case attribute values. Case level permissions are effective for all users, but users who have the '''GenericWrite''' permission, can change the case permissions setting for a model and thus change the case permissions.


Following settings are supported:
== Setting up==
Case level permissions are configured in the model properties (can be opened in the models list in the header) in the '''Case Level Permissions''' tab. The following settings are available:
* '''Initialization expression''': [[QPR_ProcessAnalyzer_Expressions|Expression]] that is run only once and can be used as initializing needed objects. This expression can be used to improve performance when part of the Case or EventLogKey expressions are common and thus they don't need to be calculated again for every Case separately.
* '''Permissions expression''': Expression determining which cases the accessing user can see. The expression is evaluated for each case (in the case context). If the evaluation results ''true'', the case is visible for the user; otherwise not. The evaluation is done when no existing eventlog if found based on the ''Eventlog key'' and a new eventlog needs to be generated. This expression is mandatory for the case level permissions to work
* '''Eventlog key expression''': Expression used to generate a uniquely identifying string for the eventlogs when the case level permissions are in use. If a cached eventLog with the same key already exists in the system, that eventlog is used instead of creating a new.


== Configuration examples ==
Visibility of cases is limited in a way that only those users can see cases belonging to a group which name is same as the ''Region'' (case attribute).
* Initialization expression: '''let groupNames = OrderByValue(CurrentUser.GroupNames)'''
* Permissions expression: '''Region.In(groupNames)'''
* Eventlog key: '''StringJoin("_", groupNames)'''
Cases are only visible for users whose user name is same as the ''Account Manager'' (case attribute):
* Initialization expression: '''let userName = CurrentUser.Name'''
* Permissions expression: '''Attribute("Account Manager") == userName'''
* Eventlog key: '''CurrentUser.Id'''
Cases where ''Region'' case attribute is ''Dallas'' will only be visible for users belonging to group ''GroupA'' (and ''New York'' for group ''GroupB''):
* Initialization expression: '''let groupNames = CurrentUser.GroupNames'''
* Permissions expression: '''(Region == "Dallas" && "GroupA".In(groupNames)) || (Region == "New York" && "GroupB".In(groupNames))'''
* Eventlog key: '''If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")'''
User ''qpr'' can only see cases where ''Region'' is ''Dallas'', and all other users can see all cases:
* Initialization expression: '''let userName = CurrentUser.Name'''
* Permissions expression: '''(userName == "qpr" && Attribute("Region") == "Dallas") || userName != "qpr"'''
* Eventlog key: '''CurrentUser.Id'''
== Use case ==
Case level permissions can be implemented with the principle illustrated in the image below. ''Users'' already belong to certain ''groups'' in the user management, and ''cases'' have certain ''case attribute values'' which is part of the loaded process mining data. Additionally, the linkage between case attribute values (of a certain case attribute) and groups needs to be defined when this security feature is configured. The image below illustrates the chain between ''users'' and ''cases'', how certain users are able to see certain cases when viewing analyses from a QPR ProcessAnalyzer model.
[[File:CasePermissions.png|800px]]
Example: There are groups G1, G2 and G3. Case permissions have been set as follows:
* group G1 can only see cases where (case attribute) Region is Dallas
* group G2 can only see cases where Region is Austin
* group G3 can only see cases where Region is either Austin or New York
QPR ProcessAnalyzer model contains the following cases:
{| class="wikitable"
{| class="wikitable"
! Property name
! Case name
! Description
! Region (case attribute)
! Groups can see
|-
|-
|Permissions
|A
|Permissions configuration specifies additional permissions and visibilities of objects within the model. The security feature is available in [[Installing QPR ProcessAnalyzer Server#Configure_Web_Service_to_use_In-Memory_or_In-Database_processing|In-Memory core]]. By default, all the model data within model's EventLog is visible to all the users having '''GenericRead''' permission for the project in which the model resides. It is possible to configure additional case -level permissions by using permission model configuration.
|Dallas
 
|G1
Consists of a JSON object having the following supported properties:
|-
|B
|Dallas
|G1
|-
|C
|Austin
|G2, G3
|-
|-
|Initialization
|D
|An expression language expression used to initialize calculation environment for all the other expressions within this same permissions context. Evaluated within a generic context.
|New York
|G3
|-
|-
||Case
|E
||An expression language expression evaluated within the context of every case one-by-one. If the evaluation results true, then the case is visible for the current request. Otherwise the case and its events are not visible. The evaluation is performed whenever a client requests for any analysis or model information requiring the loading of the event log having event log key specified in 2.3 into the memory and the event log has not yet been loaded, or has already been dropped out of the memory.
|New York
|G3
|-
|-
||EventLogKey
|F
||An expression language expression used to uniquely identify all the unique event logs created by case permission filters. Evaluated within a generic context. If any permissions have been defined for a model, trying to generate a eventlog (#30979#) dependent analysis (= analyses not listed in #11084#) will throw an exception.
|New York
3.2. Any model bound analysis performed using SqlCore on a model that has any defined permissions will result into an exception.
|G3
|}
|}


== Examples ==
Thus, when viewing analyses, a user see that the model contains the following cases:
Create a permission filter so that visibility of cases is limited in a way hat only users belonging to a user group whose name equals to Region case attribute value.
* If the user belongs to group G1 only, the user can see cases A and B (2 cases)
<pre>
* If the user belongs to group G2 only, the user can see case C (1 case)
{
* If the user belongs to group G3 only, the user can see cases C, D, E and F (4 cases)
  "Permissions": {
* If the user belongs to groups G1 and G2 only, the user can see cases A, B and C (3 cases)
    "Initialization": "Let(\"groupNames\", OrderByValue(CurrentUser.GroupNames))",  
    "Case": "Region.In(groupNames)",
    "EventLogKey": "StringJoin(\"_\", groupNames)"
  }
}
</pre>


There is no way for a user to be aware of the existence of cases that the user doesn't have rights to.


Create a permission filter so that every case is only visible for users whose user name equals to Account Manager case attribute value.
[[Category: QPR ProcessAnalyzer]]
<pre>
{
  "Permissions": {
    "Initialization": "Let(\"userName\", CurrentUser.Name)",
    "Case": "(Attribute(\"Account Manager\") == userName)",
    "EventLogKey": "CurrentUser.Id"
  }
}
</pre>

Latest revision as of 19:30, 11 December 2021

In addition to project level permissions, it's possible to set case level permissions for models, where visibility can be defined for each case separately based on rules. Usually the rules are based on case attribute values. Case level permissions are effective for all users, but users who have the GenericWrite permission, can change the case permissions setting for a model and thus change the case permissions.

Setting up

Case level permissions are configured in the model properties (can be opened in the models list in the header) in the Case Level Permissions tab. The following settings are available:

  • Initialization expression: Expression that is run only once and can be used as initializing needed objects. This expression can be used to improve performance when part of the Case or EventLogKey expressions are common and thus they don't need to be calculated again for every Case separately.
  • Permissions expression: Expression determining which cases the accessing user can see. The expression is evaluated for each case (in the case context). If the evaluation results true, the case is visible for the user; otherwise not. The evaluation is done when no existing eventlog if found based on the Eventlog key and a new eventlog needs to be generated. This expression is mandatory for the case level permissions to work
  • Eventlog key expression: Expression used to generate a uniquely identifying string for the eventlogs when the case level permissions are in use. If a cached eventLog with the same key already exists in the system, that eventlog is used instead of creating a new.

Configuration examples

Visibility of cases is limited in a way that only those users can see cases belonging to a group which name is same as the Region (case attribute).

  • Initialization expression: let groupNames = OrderByValue(CurrentUser.GroupNames)
  • Permissions expression: Region.In(groupNames)
  • Eventlog key: StringJoin("_", groupNames)

Cases are only visible for users whose user name is same as the Account Manager (case attribute):

  • Initialization expression: let userName = CurrentUser.Name
  • Permissions expression: Attribute("Account Manager") == userName
  • Eventlog key: CurrentUser.Id

Cases where Region case attribute is Dallas will only be visible for users belonging to group GroupA (and New York for group GroupB):

  • Initialization expression: let groupNames = CurrentUser.GroupNames
  • Permissions expression: (Region == "Dallas" && "GroupA".In(groupNames)) || (Region == "New York" && "GroupB".In(groupNames))
  • Eventlog key: If("GroupA".In(groupNames), "_A", "_") + If("GroupB".In(groupNames), "_B", "_")

User qpr can only see cases where Region is Dallas, and all other users can see all cases:

  • Initialization expression: let userName = CurrentUser.Name
  • Permissions expression: (userName == "qpr" && Attribute("Region") == "Dallas") || userName != "qpr"
  • Eventlog key: CurrentUser.Id

Use case

Case level permissions can be implemented with the principle illustrated in the image below. Users already belong to certain groups in the user management, and cases have certain case attribute values which is part of the loaded process mining data. Additionally, the linkage between case attribute values (of a certain case attribute) and groups needs to be defined when this security feature is configured. The image below illustrates the chain between users and cases, how certain users are able to see certain cases when viewing analyses from a QPR ProcessAnalyzer model.

CasePermissions.png

Example: There are groups G1, G2 and G3. Case permissions have been set as follows:

  • group G1 can only see cases where (case attribute) Region is Dallas
  • group G2 can only see cases where Region is Austin
  • group G3 can only see cases where Region is either Austin or New York

QPR ProcessAnalyzer model contains the following cases:

Case name Region (case attribute) Groups can see
A Dallas G1
B Dallas G1
C Austin G2, G3
D New York G3
E New York G3
F New York G3

Thus, when viewing analyses, a user see that the model contains the following cases:

  • If the user belongs to group G1 only, the user can see cases A and B (2 cases)
  • If the user belongs to group G2 only, the user can see case C (1 case)
  • If the user belongs to group G3 only, the user can see cases C, D, E and F (4 cases)
  • If the user belongs to groups G1 and G2 only, the user can see cases A, B and C (3 cases)

There is no way for a user to be aware of the existence of cases that the user doesn't have rights to.

Retrieved from "https://wiki.onqpr.com/pa/index.php?title=Case_Level_Permissions&oldid=19560"