How to: Implement Custom Security Objects (Users, Roles, Operation Permissions)

Feb 24, 2022
12 minutes to read

This example illustrates how to create custom security objects such as permissions, roles, and users. You can implement a permission an administrator uses to allow or deny users to export data in an XAF application. Each role exposes the CanExport property (a custom role object is implemented for this purpose). When the corresponding checkbox is checked, users associated with this role have access to the ExportController.ExportAction Action.

Mobile applications do not support the ExportAction. However, you can implement the approach described in this topic to secure other operations.

Note

This example applies to XPO applications only. You should modify the code snippets in this topic to use it in EF applications:

Use the DevExpress.Persistent.BaseImpl.EF.PermissionPolicy namespace’s classes instead of the DevExpress.Persistent.BaseImpl.PermissionPolicy‘s;
The properties’ setter and getter should not call the SetPropertyValue and GetPropertyValue methods;
Do no use the AssociationAttribute;
EF collections are IList<T> type, not XPCollection<T>.

Refer to the Business Model Design with Entity Framework topic for more information about the EF data model design.

Tip

A complete sample project is available in the DevExpress Code Examples database at https://supportcenter.devexpress.com/ticket/details/e3794/how-to-implement-custom-permission-role-and-user-objects.

Implement Custom Role and User Objects

Extend the PermissionPolicyRole class with an additional CanExport property. This indicates that a role has ExportPermission.

C#
VB.NET

using DevExpress.Persistent.BaseImpl.PermissionPolicy;
// ...
[DefaultClassOptions, ImageName("BO_Role")]
public class ExtendedSecurityRole : PermissionPolicyRole {
    public ExtendedSecurityRole(Session session) : base(session) { }
    public bool CanExport {
        get { return GetPropertyValue<bool>("CanExport"); }
        set { SetPropertyValue<bool>("CanExport", value); }
    }
}

Imports DevExpress.Persistent.BaseImpl.PermissionPolicy
' ...
<DefaultClassOptions, ImageName("BO_Role")> _
Public Class ExtendedSecurityRole
    Inherits PermissionPolicyRole
    Public Sub New(ByVal session As Session)
        MyBase.New(session)
    End Sub
    Public Property CanExport() As Boolean
        Get
            Return GetPropertyValue(Of Boolean)("CanExport")
        End Get
        Set(ByVal value As Boolean)
            SetPropertyValue(Of Boolean)("CanExport", value)
        End Set
    End Property
End Class

Place the Can Export item on the ExtendedSecurityRole Detail View layout (see View Items Layout Customization).

The code snippet below demonstrates the custom User object’s implementation. You can execute this additional task to make this example more realistic. However, customizing the User‘s implementation to support the ExportPermission is not required.

C#
VB.NET

using DevExpress.Persistent.BaseImpl.PermissionPolicy;
// ...
[DefaultClassOptions, ImageName("BO_Employee")]
public class Employee : PermissionPolicyUser {
    public Employee(Session session)
        : base(session) { }
    [Association("Employee-Task")]
    public XPCollection<Task> Tasks {
        get { return GetCollection<Task>("Tasks");  }
    }
}
[DefaultClassOptions, ImageName("BO_Task")]
public class Task : BaseObject {
    public Task(Session session)
        : base(session) { }
    private string subject;
    public string Subject {
        get { return subject; }
        set { SetPropertyValue("Subject", ref subject, value); }
    }
    private DateTime dueDate;
    public DateTime DueDate {
        get { return dueDate; }
        set { SetPropertyValue("DueDate", ref dueDate, value); }
    }
    private Employee assignedTo;
    [Association("Employee-Task")]
    public Employee AssignedTo {
        get { return assignedTo; }
        set { SetPropertyValue("AssignedTo", ref assignedTo, value); }
    }
}

Imports DevExpress.Persistent.BaseImpl.PermissionPolicy
' ...
<DefaultClassOptions, ImageName("BO_Employee")> _
Public Class Employee
    Inherits PermissionPolicyUser
    Public Sub New(ByVal session As Session)
        MyBase.New(session)
    End Sub
    <Association("Employee-Task")> _
    Public ReadOnly Property Tasks() As XPCollection(Of Task)
        Get
            Return GetCollection(Of Task)("Tasks")
        End Get
    End Property
End Class
<DefaultClassOptions, ImageName("BO_Task")> _
Public Class Task
    Inherits BaseObject
    Public Sub New(ByVal session As Session)
        MyBase.New(session)
    End Sub
    Private _subject As String
    Public Property Subject() As String
        Get
            Return _subject
        End Get
        Set(ByVal value As String)
            SetPropertyValue("Subject", _subject, value)
        End Set
    End Property
    Private _dueDate As DateTime
    Public Property DueDate() As DateTime
        Get
            Return _dueDate
        End Get
        Set(ByVal value As DateTime)
            SetPropertyValue("DueDate", _dueDate, value)
        End Set
    End Property
    Private _assignedTo As Employee
    <Association("Employee-Task")> _
    Public Property AssignedTo() As Employee
        Get
            Return _assignedTo
        End Get
        Set(ByVal value As Employee)
            SetPropertyValue("AssignedTo", _assignedTo, value)
        End Set
    End Property
End Class

Invoke the Application Designer and drag the SecurityStrategyComplex and AuthenticationStandard components from the Toolbox onto the Security pane. Modify the SecurityStrategyComplex.RoleType and SecurityStrategy.UserType values in the Properties window to use the implemented ExtendedSecurityRole and Employee objects instead of the default PermissionPolicyUser and PermissionPolicyRole.

Implement Custom Operation Permission and Permission Request

Add a class that supports the IOperationPermission interface to implement a custom Operation Permission.

C#
VB.NET

using DevExpress.ExpressApp.Security;
// ...
public class ExportPermission : IOperationPermission {
    public string Operation { 
        get { return "Export"; }
    }
}

Imports DevExpress.ExpressApp.Security
' ...
Public Class ExportPermission
    Implements IOperationPermission
    Public ReadOnly Property Operation() As String
        Get
            Return "Export"
        End Get
    End Property
End Class

The Security System uses Permission Requests to determine whether permission is granted. To add a Permission Request for the ExportPermission, implement the IPermissionRequest interface as follows:

C#
VB.NET

public class ExportPermissionRequest : IPermissionRequest {
    public object GetHashObject() {
        return this.GetType().FullName;
    }
}

Public Class ExportPermissionRequest
    Implements IPermissionRequest
    Public Function GetHashObject() As Object
        return this.GetType().FullName;
    End Function
End Class

Implement the Permission Request Processor and Register it within the Security Strategy

All Permission Requests should have an appropriate Permission Request Processor registered in the Security Strategy. Inherit the PermissionRequestProcessorBase<ProcessorPermissionRequestType> class and pass the Permission Request type as the ancestor class’ generic parameter to implement a class as a processor.

C#
VB.NET

public class ExportPermissionRequestProcessor : 
    PermissionRequestProcessorBase<ExportPermissionRequest> {
    private IPermissionDictionary permissions;
    public ExportPermissionRequestProcessor(IPermissionDictionary permissions) {
        this.permissions = permissions;
    }
    public override bool IsGranted(ExportPermissionRequest permissionRequest) {
        return (permissions.FindFirst<ExportPermission>() != null);
    }
}

Public Class ExportPermissionRequestProcessor
    Inherits PermissionRequestProcessorBase(Of ExportPermissionRequest)
    Private permissions As IPermissionDictionary
    Public Sub New(ByVal permissions As IPermissionDictionary)
        Me.permissions = permissions
    End Sub
    Public Overrides Function IsGranted( _
    ByVal permissionRequest As ExportPermissionRequest) As Boolean
        Return (permissions.FindFirst(Of ExportPermission)() IsNot Nothing)
    End Function
End Class

Handle the SecurityStrategy.CustomizeRequestProcessors event in the Program.cs (Program.vb) file from the WinForms application project and in the Global.asax.cs (Global.asax.vb) file from the ASP.NET application project to register the ExportPermissionRequestProcessor. Subscribe to this event before the XafApplication.Setup method is called. There is no need to handle this event on the client side when the Middle Tier application server is in use. Instead, subscribe to this event in the server’s Program.cs (Program.vb) file. In the event handler, pass the ExportPermission object to the PermissionDictionary.

Windows Forms

C#
VB.NET

((SecurityStrategy)winApplication.Security).CustomizeRequestProcessors +=
    delegate(object sender, CustomizeRequestProcessorsEventArgs e) {
        List<IOperationPermission> result = new List<IOperationPermission>();
        SecurityStrategyComplex security = sender as SecurityStrategyComplex;
        if (security != null) {
            Employee user = security.User as Employee;
            if (user != null) {
                foreach (ExtendedSecurityRole role in user.Roles) {
                    if (role.CanExport) {
                        result.Add(new ExportPermission());
                    }
                }
            }
        }
        IPermissionDictionary permissionDictionary = new PermissionDictionary((IEnumerable<IOperationPermission>)result);
        e.Processors.Add(typeof(ExportPermissionRequest), new ExportPermissionRequestProcessor(permissionDictionary));
    }; 
winApplication.Setup();
winApplication.Start();

AddHandler CType(winApplication.Security, SecurityStrategy).CustomizeRequestProcessors, _
    Sub(sender As Object, e As CustomizeRequestProcessorsEventArgs)
    Dim result As New List(Of IOperationPermission)()
    Dim security As SecurityStrategyComplex = TryCast(sender, SecurityStrategyComplex)
    If security IsNot Nothing Then
        Dim user As Employee = TryCast(security.User, Employee)
        If user IsNot Nothing Then
            For Each role As ExtendedSecurityRole In user.Roles
                If role.CanExport Then
                    result.Add(New ExportPermission())
                End If
            Next role
        End If
    End If
    Dim permissionDictionary As IPermissionDictionary = New PermissionDictionary(CType(result, IEnumerable(Of IOperationPermission)))
    e.Processors.Add(GetType(ExportPermissionRequest), New ExportPermissionRequestProcessor(permissionDictionary))
End Sub
_application.Setup()
_application.Start()

ASP.NET

C#
VB.NET

((SecurityStrategy)WebApplication.Instance.Security).CustomizeRequestProcessors +=
    delegate(object s, CustomizeRequestProcessorsEventArgs args) {
        List<IOperationPermission> result = new List<IOperationPermission>();
        SecurityStrategyComplex security = s as SecurityStrategyComplex;
        if (security != null) {
            Employee user = security.User as Employee;
            if (user != null) {
                foreach (ExtendedSecurityRole role in user.Roles) {
                    if (role.CanExport) {
                        result.Add(new ExportPermission());
                    }
                }
            }
        }
        IPermissionDictionary permissionDictionary = new PermissionDictionary((IEnumerable<IOperationPermission>)result);
        args.Processors.Add(typeof(ExportPermissionRequest), new ExportPermissionRequestProcessor(permissionDictionary));
    };
WebApplication.Instance.Setup();
WebApplication.Instance.Start();

AddHandler CType(WebApplication.Instance.Security, SecurityStrategy).CustomizeRequestProcessors, Sub(s As Object, args As CustomizeRequestProcessorsEventArgs)
    Dim result As New List(Of IOperationPermission)()
    Dim security As SecurityStrategyComplex = TryCast(s, SecurityStrategyComplex)
    If security IsNot Nothing Then
        Dim _user As Employee = TryCast(security.User, Employee)
        If _user IsNot Nothing Then
            For Each role As ExtendedSecurityRole In _user.Roles
                If role.CanExport Then
                    result.Add(New ExportPermission())
                End If
            Next role
        End If
    End If
    Dim permissionDictionary As IPermissionDictionary = New PermissionDictionary(CType(result, IEnumerable(Of IOperationPermission)))
    args.Processors.Add(GetType(ExportPermissionRequest), New ExportPermissionRequestProcessor(permissionDictionary))
End Sub
_application.Instance.Setup()
_application.Instance.Start()

Application Server

C#
VB.NET

static void Main(string[] args) {
    // ...
    Func<IDataServerSecurity> dataServerSecurityProvider = () => {
        SecurityStrategyComplex security = new SecurityStrategyComplex(
            typeof(Employee), typeof(ExtendedSecurityRole), new AuthenticationStandard());
        security.CustomizeRequestProcessors +=
            delegate(object sender, CustomizeRequestProcessorsEventArgs e) {
                List<IOperationPermission> result = new List<IOperationPermission>();
                if (security != null) {
                    Employee user = security.User as Employee;
                    if (user != null) {
                        foreach (ExtendedSecurityRole role in user.Roles) {
                            if (role.CanExport) {
                                result.Add(new ExportPermission());
                            }
                        }
                    }
                }
                IPermissionDictionary permissionDictionary = new PermissionDictionary((IEnumerable<IOperationPermission>)result);
                e.Processors.Add(typeof(ExportPermissionRequest), new ExportPermissionRequestProcessor(permissionDictionary));
            }; 
        return security;
    };
    // ...
}

Dim dataServerSecurityProvider As Func(Of IDataServerSecurity) = Function()
    Dim security As New SecurityStrategyComplex(GetType(Employee), GetType(ExtendedSecurityRole), New AuthenticationStandard())
    AddHandler security.CustomizeRequestProcessors, Sub(sender As Object, e As CustomizeRequestProcessorsEventArgs)
            Dim result As New List(Of IOperationPermission)()
            If security IsNot Nothing Then
                Dim user As Employee = TryCast(security.User, Employee)
                If user IsNot Nothing Then
                    For Each role As ExtendedSecurityRole In user.Roles
                        If role.CanExport Then
                            result.Add(New ExportPermission())
                        End If
                    Next role
                End If
            End If
            Dim permissionDictionary As IPermissionDictionary = New PermissionDictionary(CType(result, IEnumerable(Of IOperationPermission)))
            e.Processors.Add(GetType(ExportPermissionRequest), New ExportPermissionRequestProcessor(permissionDictionary))
    End Sub
    Return security
End Function

In the Middle Tier Security - WCF Service scenario, you should additionally use the static WcfDataServerHelper.AddKnownType method to register your custom permission request. Call this method in the application server and client application code before the data server and client application are initialized.

C#
VB.NET

WcfDataServerHelper.AddKnownType(typeof(ExportPermissionRequest));

WcfDataServerHelper.AddKnownType(GetType(ExportPermissionRequest))

Take the Custom Permission into Account in the ExportController Controller

Add the following View Controller to inform the ExportController controller about the ExportPermission permission:

C#
VB.NET

public class SecuredExportController : ViewController {
    protected override void OnActivated() {
        base.OnActivated();
        ExportController controller = Frame.GetController<ExportController>();
        if (controller != null) {
            controller.ExportAction.Executing += ExportAction_Executing;
            if(SecuritySystem.Instance is IRequestSecurity) {
                controller.Active.SetItemValue("Security", 
                    SecuritySystem.IsGranted(new ExportPermissionRequest()));
            }
        }
    }
    void ExportAction_Executing(object sender, System.ComponentModel.CancelEventArgs e) {
        SecuritySystem.Demand(new ExportPermissionRequest());
    }
}

Public Class SecuredExportController
    Inherits ViewController
    Protected Overrides Sub OnActivated()
        MyBase.OnActivated()
        Dim controller As ExportController = Frame.GetController(Of ExportController)()
        If controller IsNot Nothing Then
            AddHandler controller.ExportAction.Executing, AddressOf ExportAction_Executing
            If TypeOf SecuritySystem.Instance Is IRequestSecurity Then
                controller.Active.SetItemValue("Security", SecuritySystem.IsGranted(New ExportPermissionRequest()))
            End If
        End If
    End Sub
    Private Sub ExportAction_Executing(ByVal sender As Object, ByVal e As System.ComponentModel.CancelEventArgs)
        SecuritySystem.Demand(New ExportPermissionRequest())
    End Sub
End Class

The code above deactivates the controller for users who are not allowed to export data. The ActionBase.Executing event handler demonstrates how to throw an exception when a user attempts to perform a prohibited operation.

Add Demo Data

Add the predefined User and Role objects (see Client-Side Security (2-Tier Architecture)) in the ModuleUpdater.UpdateDatabaseAfterUpdateSchema method as shown below.

C#
VB.NET

public class Updater : ModuleUpdater {
    public Updater(IObjectSpace objectSpace, Version currentDBVersion) : 
        base(objectSpace, currentDBVersion) { }
    public override void UpdateDatabaseAfterUpdateSchema() {
        base.UpdateDatabaseAfterUpdateSchema();
        ExtendedSecurityRole defaultRole = CreateUserRole();
        ExtendedSecurityRole administratorRole = CreateAdministratorRole();
        ExtendedSecurityRole exporterRole = CreateExporterRole();
        Employee userAdmin = ObjectSpace.FindObject<Employee>(new BinaryOperator("UserName", "Admin"));
        if (userAdmin == null) {
            userAdmin = ObjectSpace.CreateObject<Employee>();
            userAdmin.UserName = "Admin";
            userAdmin.IsActive = true;
            userAdmin.SetPassword("");
            userAdmin.Roles.Add(administratorRole);
        }
        Employee userSam = ObjectSpace.FindObject<Employee>(new BinaryOperator("UserName", "Sam"));
        if (userSam == null) {
            userSam = ObjectSpace.CreateObject<Employee>();
            userSam.UserName = "Sam";
            userSam.IsActive = true;
            userSam.SetPassword("");
            userSam.Roles.Add(exporterRole);
            userSam.Roles.Add(defaultRole);
        }
        Employee userJohn = ObjectSpace.FindObject<Employee>(new BinaryOperator("UserName", "John"));
        if (userJohn == null) {
            userJohn = ObjectSpace.CreateObject<Employee>();
            userJohn.UserName = "John";
            userJohn.IsActive = true;
            userJohn.Roles.Add(defaultRole);
            for (int i = 1; i <= 10; i++) {
                string subject = string.Format("Task {0}",i);
                Task task = ObjectSpace.FindObject<Task>(new BinaryOperator("Subject", subject));
                if (task == null) {
                    task = ObjectSpace.CreateObject<Task>();
                    task.Subject = subject;
                    task.DueDate = DateTime.Today;
                    task.Save();
                    userJohn.Tasks.Add(task);
                }
            }
        }
        ObjectSpace.CommitChanges();
    }
    private ExtendedSecurityRole CreateAdministratorRole() {
        ExtendedSecurityRole administratorRole = ObjectSpace.FindObject<ExtendedSecurityRole>(
            new BinaryOperator("Name", SecurityStrategyComplex.AdministratorRoleName));
        if (administratorRole == null) {
            administratorRole = ObjectSpace.CreateObject<ExtendedSecurityRole>();
            administratorRole.Name = SecurityStrategyComplex.AdministratorRoleName;
            administratorRole.IsAdministrative = true;
        }
        return administratorRole;
    }
    private ExtendedSecurityRole CreateExporterRole() {
        ExtendedSecurityRole exporterRole = ObjectSpace.FindObject<ExtendedSecurityRole>(
            new BinaryOperator("Name", "Exporter"));
        if (exporterRole == null) {
            exporterRole = ObjectSpace.CreateObject<ExtendedSecurityRole>();
            exporterRole.Name = "Exporter";
            exporterRole.CanExport = true;
        }
        return exporterRole;
    }
    private ExtendedSecurityRole CreateUserRole() {
        ExtendedSecurityRole userRole = ObjectSpace.FindObject<ExtendedSecurityRole>(
            new BinaryOperator("Name", "Default"));
        if (userRole == null) {
            userRole = ObjectSpace.CreateObject<ExtendedSecurityRole>();
            userRole.Name = "Default";
            userRole.SetTypePermission<Task>(SecurityOperations.FullAccess, SecurityPermissionState.Allow);
            userRole.SetTypePermission<Employee>(SecurityOperations.ReadOnlyAccess, SecurityPermissionState.Allow);
            userRole.AddObjectPermission<PermissionPolicyUser>(SecurityOperations.ReadOnlyAccess,
                 "[Oid] = CurrentUserId()", SecurityPermissionState.Allow);
        }
        return userRole;
    }
}

Public Class Updater
    Inherits ModuleUpdater
    Public Sub New(ByVal objectSpace As IObjectSpace, ByVal currentDBVersion As Version)
        MyBase.New(objectSpace, currentDBVersion)
    End Sub
    Public Overrides Sub UpdateDatabaseAfterUpdateSchema()
        MyBase.UpdateDatabaseAfterUpdateSchema()
        Dim defaultRole As ExtendedSecurityRole = CreateUserRole()
        Dim administratorRole As ExtendedSecurityRole = CreateAdministratorRole()
        Dim exporterRole As ExtendedSecurityRole = CreateExporterRole()
        Dim userAdmin As Employee = ObjectSpace.FindObject(Of Employee)( _
        New BinaryOperator("UserName", "Admin"))
        If userAdmin Is Nothing Then
            userAdmin = ObjectSpace.CreateObject(Of Employee)()
            userAdmin.UserName = "Admin"
            userAdmin.IsActive = True
            userAdmin.SetPassword("")
            userAdmin.Roles.Add(administratorRole)
        End If
        Dim userSam As Employee = ObjectSpace.FindObject(Of Employee)( _
        New BinaryOperator("UserName", "Sam"))
        If userSam Is Nothing Then
            userSam = ObjectSpace.CreateObject(Of Employee)()
            userSam.UserName = "Sam"
            userSam.IsActive = True
            userSam.SetPassword("")
            userSam.Roles.Add(exporterRole)
            userSam.Roles.Add(defaultRole)
        End If
        Dim userJohn As Employee = ObjectSpace.FindObject(Of Employee)( _
        New BinaryOperator("UserName", "John"))
        If userJohn Is Nothing Then
            userJohn = ObjectSpace.CreateObject(Of Employee)()
            userJohn.UserName = "John"
            userJohn.IsActive = True
            userJohn.Roles.Add(defaultRole)
            For i As Integer = 1 To 10
                Dim subject As String = String.Format("Task {0}",i)
                Dim task As Task = ObjectSpace.FindObject(Of Task)(New BinaryOperator("Subject", subject))
                If task Is Nothing Then
                    task = ObjectSpace.CreateObject(Of Task)()
                    task.Subject = subject
                    task.DueDate = Date.Today
                    task.Save()
                    userJohn.Tasks.Add(task)
                End If
            Next i
        End If
        ObjectSpace.CommitChanges()
    End Sub
    Private Function CreateAdministratorRole() As ExtendedSecurityRole
        Dim administratorRole As ExtendedSecurityRole = ObjectSpace.FindObject(Of ExtendedSecurityRole)( _
        New BinaryOperator("Name", SecurityStrategyComplex.AdministratorRoleName))
        If administratorRole Is Nothing Then
            administratorRole = ObjectSpace.CreateObject(Of ExtendedSecurityRole)()
            administratorRole.Name = SecurityStrategyComplex.AdministratorRoleName
            administratorRole.IsAdministrative = True
        End If
        Return administratorRole
    End Function
    Private Function CreateExporterRole() As ExtendedSecurityRole
        Dim exporterRole As ExtendedSecurityRole = ObjectSpace.FindObject(Of ExtendedSecurityRole)( _
        New BinaryOperator("Name", "Exporter"))
        If exporterRole Is Nothing Then
            exporterRole = ObjectSpace.CreateObject(Of ExtendedSecurityRole)()
            exporterRole.Name = "Exporter"
            exporterRole.CanExport = True
        End If
        Return exporterRole
    End Function
    Private Function CreateUserRole() As ExtendedSecurityRole
        Dim userRole As ExtendedSecurityRole = ObjectSpace.FindObject(Of ExtendedSecurityRole)( _
        New BinaryOperator("Name", "Default"))
        If userRole Is Nothing Then
            userRole = ObjectSpace.CreateObject(Of ExtendedSecurityRole)()
            userRole.Name = "Default"
            userRole.SetTypePermission(Of Task)(SecurityOperations.FullAccess, SecurityPermissionState.Allow)
            userRole.SetTypePermission(Of Employee)(SecurityOperations.ReadOnlyAccess, SecurityPermissionState.Allow)
            userRole.AddObjectPermission(Of PermissionPolicyUser)(SecurityOperations.ReadOnlyAccess, _
            "[Oid] = CurrentUserId()", SecurityPermissionState.Allow)
        End If
        Return userRole
    End Function
End Class

Confirm that the Application UI Changes based on Role

Run the WinForms or ASP.NET application, and login as “Admin”. Open the Extended Security Role object’s Detail View. The Can Export checkbox is checked for the “Exporter” role.

CustomPermission_CanExport

Login again as “Sam”, who is in the “Exporter” role. Ensure that the Export action is available for this user. If you login as “John”, the Export action is unavailable.

CustomPermission_ExportAction

Tip

In most cases you do not need an option to create base user and base role objects (PermissionPolicyUser and PermissionPolicyRole) in the UI when the custom user and role (Employee and ExtendedSecurityRole) are available. To hide the base user’s and base role’s items, use the NewObjectViewController.NewObjectActionItemListMode property or other options listed in the How to remove or hide the base class from the New Action’s items list article.

Note

The Export action is available for the “Admin” user even though the “Can Export” option is not checked for the “Administrator” role. The “Is Administrative” option overrides all other permissions (built-in and custom) and grants full access to all operations.

Controls

Tools

Controls and Extensions

Tools

Maintenance Mode

Controls

Tools

Controls and Extensions

Tools

Maintenance Mode

Implement Custom Role and User Objects

Implement Custom Operation Permission and Permission Request

Implement the Permission Request Processor and Register it within the Security Strategy

Take the Custom Permission into Account in the ExportController Controller

Add Demo Data

Confirm that the Application UI Changes based on Role