Role Level Security Determined by Windows Authentication

RBrown
RBrown Member Posts: 8
edited 2011-03-31 in NAV Three Tier
Hello All,

I am developing an application using Silverlight to provide some customized front ends for our NAV system. I'm having a few issues with getting security setup correctly. I have basically 2 user sets. I have users who should be able to look at information (that is, read only access) and users who can lookup information and change it. In that vein we've created a READ user and a MODIFY user.

The READ user has Read and Run Permissions on all of our pages. The MODIFY user currently has full permissions (if a user can modify records, they can also create and delete). The problem is that the READ user is still able to make changes. This leads me to believe that the Run Permission gives a user access to all of the methods exposed by NAV's web services. Is this the case? If it is, is there some other way to restrict permissions to just Read Only access? I originally gave my READ user only read access, and NAV returned a "you do not have permission to Run this page" error.

A related question, is there a way to query NAV for what permissions the role of the current logged in Windows user has? It would be ideal to disable the save, insert, delete, etc. buttons for users who do not have those rights in NAV. So far the only way I've found to do that is to attempt to perform a write action and then handle the "permission denied" error message that NAV returns. This isn't really an ideal situation.

Thanks,

Ryan Brown

Comments

  • deV.ch
    deV.ch Member Posts: 543
    to check if you have permission on a record you can use this two functions:
    Record.READPERMISSION / Record.WRITEPERMISSION
    My Blog
  • RBrown
    RBrown Member Posts: 8
    Are those functions exposed via NAV's web-services at all? If so, are they there by default, or do they need to be activated somehow?
  • matttrax
    matttrax Member Posts: 2,309
    You can write a wrapper function inside of a Codeunit to expose any method you want.
    Matt Traxinger - ArcherPoint
  • RBrown
    RBrown Member Posts: 8
    Ah, so by using a Codeunit to expose the web services instead of a Page I can write my own methods on the NAV side. Is it possible to modify the existing methods (Read, Update, Delete, Create) as well?

    Are there any good resources for how learning to do this? Are there some examples available online somewhere?
  • deV.ch
    deV.ch Member Posts: 543
    You can still use a page as your webservice but you can add web-service functions by adding a Codeunit and connect it to your Page that you exposed as webservice.

    read more here: http://msdn.microsoft.com/en-us/library/dd338962.aspx
    My Blog

Categories