security filter and flowfield

Belias · 2012-06-25

Hi everyone,
I have a problem about a flowfield and security filters (example below):
- I have balance field from an item card that sums up the "item ledger entry".quantity field.
- This flowfield is flowfiltered by "location filter"
- My security filter permission says that the user cannot read item ledger entries with location = 'XXX'
So far, so good...but when the user tries to access the item card, he receives the well known permission error on the item ledger entry.

I found this hotfix
https://mbs2.microsoft.com/Knowledgebase/KBDisplay.aspx?scid=kb;EN-US;2695145
but it states that the client gets disconnected, which is not my case, because we just receive an error.

NAV2009R2 build 33154

kine · 2012-06-25

I think that this is biggest problem of security filters. You need to try to add security filter to Item table, which will filter "Location Filter" to same locations as you have on the Item Ledger Entries. I think that FlowFields are not automatically filtering the base table to security filters and you need to do that.

Good news is, that Security filters are refactored in NAV 2013 and it looks like they are beginning to be usable...

Belias · 2012-06-25

nah, it doesn't work unfortunately.
I also tried to simplify the case, by removing the flowfilter, but it errors out, no matter what.

E.g.:
My tableA has flowfield on TableB.Quantity where TableA.Field1 = TableB.Field1 and TableA.Field2 = TableB.Field2
Nor Field1 and Field2 are fields in a security filter

CJakobsen_[MSFT] · 2012-06-26

Hi,
A possible solution/workaround is to use indirect permissions. You will have to be aware though that this will sum up all the items in the related table ignoring the security filter.

In your example it could be done by letting TableA give indirect read permissions to TableB and create a role giving indirect read permissions to TableB and then assign that role to the restricted user. It can also be done on a form that is based on TableA, that form could give indirect read permission to TableB.

This behavior is changed in NAV 2013 where flowfields will adhere to security filters. In a setup where you have a page based on TableA the restricted user will be able to launch the page and the calculated sum will be only on the related items that the user has access to.

Regards

Claus Jakobsen
Senior Software Developer
Dynamics NAV Server
Microsoft

This posting is provided "AS IS" with no warranties, and confers no rights.

iceborg · 2012-06-29

Have you tried to add another Role to the User that contains indirect read permission to Item ledger Entry table? - It should work.

Howdy, Stranger!

Quick Links

Categories

security filter and flowfield

Comments