What am I missing in setting up a simple XDS security policy in Dynamics 365 for Operations?

(1) Share

Report

Posted on by DD-19021315-0

230

We have a requirement to filter some information (e.g. Purchase Orders) visible to certain users by an internal attribute - Depots. A user may have access to multiple depots, so I have created a custom table, UserDepot, which contains fields UserId and Depot, and have populated this via a Data Entity using a Logic Apps. I have checked the contents using the .../Data/UserDepots URL.

Ignoring for the moment the issues of selecting Depots by Userid (I am thinking of creating a 'temp' table MyDepots in the same way MyLegalEntities and MyDepartments are created at login) and the current requirement that a user with no Depots listed should have access to all Depots, as an initial test I created a query to link PurchTable to UserDepot and then created a Security Policy to apply this query to constrain both PurchTable and PurchLines.

The query looks like this:

5340.Capture1.PNG

8054.Capture2.PNG 7416.Capture3.PNG 7416.Capture4.PNG 1121.Capture5.PNG

And the security policy is:

4744.Capture6.PNG

3286.Capture7.PNG 6811.Capture8.PNG

The DepotAccess model references ApplicationFoundation, ApplicationPlatform and ApplicationSuite.

To test, I'm using the workspace Purchase Order Preparation (mi=PurchOrderMaintainWorkspace) which, I believe uses view PurchOrderApprovedView which is based on table PurchTable and hence, I beleive, should be constrained as a result of the constraint on PurchTable.

The problem is that it doesn't work. With only 1 valid Depot in the UserDepot table a user with limited access (i.e. not System Admin) can still see all Purchase Orders.

I've tried linking the Security Policy to Role SystemUser (change Context Type to RoleName and insert SystyemUser in the Role Name on the security policy properties) and also tried synchronising the database, all to no effect.

Unless I've seriously misunderstood how XDS works, I can't see why this shouldn't work, but can't see what I've failed to configure or where my test doesn't work.

What am I missing?

*This post is locked for comments

I have the same question (0)

All responses (16)

Answers (1)

Suggested answer

Jonathancm 416 on at

Like (0)

Report

The constrained table in your case should be the PurchTable and not the PurchLine - you want to filter the header. The purchLines will be filtered as a consequence of this.

Also check the constrained table properties, selecting "Yes" in the "ConstrainedTable" property.

Was this reply helpful? Yes No
DD-19021315-0 230 on at

Like (0)

Report

I thought that PurchTable was already constrained by the fact that it's the PrimaryTable and Constrained Table is set to Yes.

I agree that I've not set the Constrained Table property on the added entry, but if I change the Constrained Table to:

I get the error:

It's not clear what to put in as a relation of a table to itself!

I also tried simply removing the additional Constrained Table completely, but the header lines still aren't filtered, so I still don't know what the problem is.

Was this reply helpful? Yes No
Verified answer

DD-19021315-0 230 on at

Like (0)

Report

After further testing, it seems the policy is working, but not on the Purchase Order Preparation workspace page!

If I open this in my test user I see...

Note that although the list shows 4 approved orders, the count on the Approved tile is 1.

Clicking on the Approved tile shows:

And if I click either on this or the same line from the workspace page, I get:

While if I click on any of the other headers on the workspace page I get:

Which shows that the policy is blocking the user from seeing the details, but the workspace page itself is bypassing the restriction!

So I've wasted 2 days chasing the wrong problem! Now I just need to work out what the page is doing to get information which XDS should be restricting!

Was this reply helpful? Yes No
Suggested answer

André Arnaud de Cal... 301,075 Super User 2025 Season 2 on at

Like (0)

Report

Hi Derek,

The view PurchOrderApprovedView is based on the table PurchTable, but is for XDS a complete different table. You have to also include this view as constrained table in your policy. In your query I don't see a reference to the MyDepots table. Is this something not finished yet?

You are correct that the PurchTable is constrained on the top level, so adding the same table as contrained node again is not required and even not possible.

Was this reply helpful? Yes No
DD-19021315-0 230 on at

Like (0)

Report

Thanks Andre.

As you noticed, the MyDepots table doesn't exist yet. I doing baby steps so I can demonstrate the principle to people before writing too much code. As you probably guessed, the current implementation simply restricts all non-admins to viewing the same set of Depots as there's no user link. That the next step.

Regards

Derek.

Was this reply helpful? Yes No
DD-19021315-0 230 on at

Like (0)

Report

Unfortunately, trying to put PurchOrderApprovedView as a constrained table with relation either

PurchOrderApprovedView.RecId == PurchTable.RecId

or

PurchTable.RecId == PurchOrderApprovedView.RecId

gives the error

Path: [AxSecurityPolicy/DepotAccessForPurchTable/ConstrainedTables/PurchOrderApprovedView/Name]:

Table 'PurchOrderApprovedView' does not exist.

The view is in model Application Suite, which I'm already referencing. How do I constrain it?

Was this reply helpful? Yes No
DD-19021315-0 230 on at

Like (0)

Report

Relation "PurchOrderApprovedView.PurchId == PurchTable.PurchId" doesn't work either so it's not that the view doesn't expose RedId.

Was this reply helpful? Yes No
André Arnaud de Cal... 301,075 Super User 2025 Season 2 on at

Like (0)

Report

Hi Derek,

Did you use the option to include a new table based on Constrained Expression like mentioned in your other question?

Was this reply helpful? Yes No
DD-19021315-0 230 on at

Like (0)

Report

No. That fixes the error, but the list still opens without applying the constraint. I've now implemented the MyDepots temp table (and tested it works) so set a breakpoint in the method. This is when it first gets hit.

As you can see, it's a ready displayed the list. I presume it's using a different view?

Was this reply helpful? Yes No
André Arnaud de Cal... 301,075 Super User 2025 Season 2 on at

Like (0)

Report

Hi Derek,

Indeed, it may be a different view. I assumed you did lookup the correct one. If you right click on the form, you can choose in the pop-up menu Form information > Form name: ..... Then on the slider window open the Administration fast tab for datasource information.

Or the link may not be recognized correctly

Was this reply helpful? Yes No