Skip to Content (Press Enter)
Back to Ideas
17
Like
Follow Idea
2016-04-21 20-09-55
J.
 
MVP
Roles - ability to set them "read-only" when setting them public
922Views
11Comments
On our RadarOn our Radar
Backend

When you set roles public every espace is allowed to grant/revoke them.

This is not very handy when you have 2 applications which have the same userprovider yet have different roles alltogether (but need the roles to be public because it's shared over a couple of modules)


So, same as entities you can choose how you want them make public. This way you can force one module to be responsible if the user can be allowed to grant/revoke them to a specific user!



07 Oct 2016
Copy link to comment


Had the same thinking last week, good one!

10 Oct 2016
Copy link to comment

Still no news on this, but it's something I'd really dig. Sometimes, for simpler roles schemes, I even expose my own role checking wrapper actions to the frontends, so that the grant/revokes are hiden. 

22 Aug 2018
Copy link to comment

But can't you still grant (and revoke) the role directly by creating/deleting the relevant entity record(s) (i.e. User_Role, User_Effective_Role)?...

30 Sep 2018
Copy link to comment

That already sounds as a workaround Jorge.

01 Oct 2018
Copy link to comment

What I'm saying is that this feature would need to be powerful enough to stop that kind of workaround (read-only roles should not be modifiable using SQL statements either), otherwise it's not that consistent and useful in restricting control is it?

02 Oct 2018
Copy link to comment
Merged this idea with 'Make public roles read only' (created on 18 May 2020 19:43:56 by Sjoerd Twaalfhoven)
30 Jun 2020
Copy link to comment

Unlike entities, roles cannot be shared read-only. It would be great to be able to expose roles read-only as well. The benefit is we have more controle over security between applications in the same tenant without slowing down development speed.



This comment was:
- originally posted on idea 'Make public roles read only' (created on 18 May 2020 by Sjoerd Twaalfhoven)
- merged to idea 'Roles - ability to set them "read-only" when setting them public' on 30 Jun 2020 12:02:27 by Daniël Kuhlmann
18 May 2020
Copy link to comment

I like the idea for the sake of consistency (and I've hit the "like" button), but I think in an advanced application where you would want this, your role management system is going to be significantly more robust than something calling "GrantAdminRole" or whatever anyways. That said, I think it's an outstanding idea and I am going to incorporate it into my Application Framework which already extends the Role entity for other reasons (like... wanting to have a name for a role that allows a space in it lol).

J.Ja



This comment was:
- originally posted on idea 'Make public roles read only' (created on 18 May 2020 by Sjoerd Twaalfhoven)
- merged to idea 'Roles - ability to set them "read-only" when setting them public' on 30 Jun 2020 12:02:27 by Daniël Kuhlmann
19 May 2020
Copy link to comment

Hi Justin,

Thanks for your feedback and like. The main issue I was walking into is that I wanted to do additional security checks before granting or revoking a role but still want the default behavior for developing with, and checking for, the role.

Also thank you for pointing me at your Application Framework. I am looking into that to find out how it could benefit our development.

Sjoerd



This comment was:
- originally posted on idea 'Make public roles read only' (created on 18 May 2020 by Sjoerd Twaalfhoven)
- merged to idea 'Roles - ability to set them "read-only" when setting them public' on 30 Jun 2020 12:02:27 by Daniël Kuhlmann
20 May 2020
Copy link to comment

It's a shame this hasn't been implemented yet, we have quite a complex set of roles and role definitions for our apps (where often people can be many roles and also items should be visible to many roles), and want to have an app that manages the automatic grant/revoke of roles based on some external data, but is also a front-end for manual requests to be added to a role. This module would then share all it's custom roles with all other apps so those developers don't have to recreate/manage the roles themselves, but we really don't want each developer and app able to edit who is in that role...

19 Jul 2021
Copy link to comment

As a heads up, I implemented something very similar in my Application Framework a while ago (Application Framework - Overview | OutSystems ). My implementation isn't enforced by the underlying code (because we don't have anything like friends/protected scope, I would have no really good way of granting/revoking roles for users unless I had two copies of the actions, one that enforces restrictions and one that doesn't), it's more of a guideline for the UI, and the out of the box role edit widgets use it.

J.Ja

19 Jul 2021
Copy link to comment