XDS Examples?

(0) Share

Report

Posted on by bankk

6,609

Good morning.

I was curious if there are some good examples out there on how to work with XDS. I've run across some walkthroughs and samples but a few are a bit complicated for me right now while others don't quite have the context in which I would use XDS. For example, I'd like to restrict user access to Sales orders by the user's siteId. Any examples out there that utilize a user's context in developing XDS policies? Thanks very much!

*This post is locked for comments

I have the same question (0)

All responses (9)

Answers (1)

Verified answer

KCDeVoe 1,450 on at

Like (0)

Report

I've actually done this same thing with XDS. Here's the thread where I got assistance with it. community.dynamics.com/.../234893.aspx

If you need anything more specific, please let me know. I can do some screen grabs or anything else that may help you along.

Was this reply helpful? Yes No
Suggested answer

André Arnaud de Cal... 300,911 Super User 2025 Season 2 on at

Like (0)

Report

Hi Kbanh,

The link provided by KCDEVOE mentions how to link a worker to a site dynamically. Very good for your understanding.

Lately I reviewed the settings done with XDS on another thread. This one was also restricting based on the site. There is interesting information on constaining which tables and which not in my last reply.

community.dynamics.com/.../121958.aspx

And just another random example which has nothing to do with the site and/or sales orders:

www.kaya-consulting.com/.../restricting-legal-entities-based-on-assigned-organizations-ax-2012

Was this reply helpful? Yes No
bankk 6,609 on at

Like (0)

Report

Big thanks KCDEVOE. I read over the threads and am I to understand you used a role as the context? I recall seeing an example where a method currentUserId() was called as the context string but the example didn't delve into how it worked. Anyway, I'll try a few things and ping you back if assistance is needed. Thanks for the support!

Was this reply helpful? Yes No
bankk 6,609 on at

Like (0)

Report

Thank you Andre!

Was this reply helpful? Yes No
bankk 6,609 on at

Like (0)

Report

I've gone through a first iteration of XDS security policies in my test environment and wanted to bounce off a couple of issues/curiosities I've seen.

Background: Our environment will constitutes about 6-8 sites once we're fully implemented. I've setup testing with 2 sites and only to the VendTable so far. Each site has a query and policy set. What I've attempted to do is setup a user group for each site, and I hardcode the siteId in the group name. In the queries I'm working from UserGroupList --> UserGroupInfo --> to InventSite. InventSite then of course is the Primary Table in my security policies. My only constrained table is VendTable. I've setup ContextType to RoleName and I'm using SystemUser.

1. With the Security Policies' UseNotExistJoin property set to "no" (default), I find that all my test users are not able to see any vendors as the policies seem to cancel each other out. Setting UseNotExistJoin to "yes", I'm now able to see all other sites except for the one I originally wanted to see. This is a troublesome and tedious approach but may work.

2. Related to #1 above, there is a group of users that should have full access to all site data. I believe I'll need to build a new role which I will use for my RoleName. And any 'power users' will not have this role so they'll bypass all the security policies.

3. Though admittedly a bit shortsighted right now, I think my security policy/query pairs will allow me to simply keep adding constrained tables (e.g., InventTable, CustTable, etc) as long as they contain siteId.

I would appreciate any feedback you all can offer. There are likely better ways of setting this up and I look forward to your comments. Thank you very much!

Was this reply helpful? Yes No
Suggested answer

KCDeVoe 1,450 on at

Like (0)

Report

I'll tell you how I did it and if that helps then it helps. Because it looks like you may be taking a slightly different route than I did.

1) I created a new field in SysUserInfo to take a comma separated list of sites. I did this because we have users who need access to multiple sites.

2) I mandated the Site field on the constrained tables (PurchTable and SalesTable the ReqPO and ProdTable through InventDimin my case)

3) Create the Query with InventSite and InventDim. This was done because ReqPO and ProdTable were constrained tables for us as well.

4) Add range to the query for SiteId. Created a method in SysQueryRangeUtil for retrieving the list setup in #1

Was this reply helpful? Yes No
bankk 6,609 on at

Like (0)

Report

Thanks for sharing how you did it KCDEVOE. Definitely worth seeing alternatives to solve an issue. I'm going to continue down my path and see where it takes me. At the very least it is a good exercise in walking through this process.

Was this reply helpful? Yes No
André Arnaud de Cal... 300,911 Super User 2025 Season 2 on at

Like (0)

Report

Very nice to see the results! I'm trying to help a bit, but you both have good solutions. I did not have this requirement myself. I think I would had created a date effective table containing the link between User and Site. Then also create a 'MySitesForXDS' temporary table and handle the results in an XDS method. Here you can have some switches to e.g. include all sites when no sites are specified or people do have a certain role or other attributes.

You can have a look at e.g. the MyLegalEntities table for an example how to use the XDS method.

@Kbanh, I hope the System user is temporary... This role is standard created for every user. If you add another policy to another role and this role has also still your current policy, it will not overwrite the one from system user.

Was this reply helpful? Yes No
bankk 6,609 on at

Like (0)

Report

Thanks Andre, I appreciate the additional comments. And yes, the use of System user is for testing purposes only.

Was this reply helpful? Yes No