Security and Permissions

Security can be applied to Actionflows so that only those with sufficient permissions can run the Actionflow. In addition, if an Actionflow is assigned to a button and the user does not have permission to run the Actionflow, the button will not be displayed on a screen.

Permissions can also be set on form fields, table attributes and screens. For example, if a user does not have permission to view the form fields but runs an Actionflow that uses these fields, the Actionflow will show an error.

Access Permissions

For some items, you can specify a user group, e.g. Managers, or set of user groups, where only users in this group(s) have permission to see the item.

You must have saved the property tab at least once before you can change the permissions.

Access Permissions	Description
All Users Can View Data	Tick to allow all users to view this item. Untick to specify the user groups that can access this item.
User Groups	Available when All Users Can View Data is unticked. The grid contains a list of user groups that have permission to access to this item. To add a user group to the list: Click the icon to list all the user groups in the repository Drag user groups into this list To remove a user group from the list, click the tick box next to the user group then click the icon.

Worked Example

Here's a worked example using the Company Data (available from the Learning Centre).

In this example, we are using:

A Company Merger Pop up screen containing:
- two manual drop down fields of the company name's of the companies to be merged
- two string fields showing the company ID's of the companies to be merged
- a button to initiate the Actionflow - this screen was created using the Tile no Buttons template

If you are completing this chapter as part of the Actionflow course and using a training instance, the data and screens have already been pre-loaded into the Actionflow Advanced Application. For this example, we'll be working on the Company Merger Pop up screen.

Limit Permission to Merge Companies

In this example, we'll limit the users/user groups that can run the Actionflow that merges two companies together.

Prerequisites

For this example, we'll limit permission to run an Actionflow that merges two companies together. This Actionflow was created in 3.02 Bulk Update Action Configuration. If you have not completed this chapter, expand the section below and follow the steps to create the Actionflows.

Alternatively, you can follow the instructions below to limit access to any Actionflow in your application.

Bulk Update Company Acquisition Actionflow

Bulk Update Employees and Orders for Company Acquisition

In this example, a company is being merged into another company and we need to update the employees and orders to reflect the change.

Actionflow Setup

Open the Company Management screen
Click the Merge button to open the Company Merger Pop up screen
Create an Actionflow on the Run Acquisition button
1. Name: RunCompanyAcquisition
On the Actionflow canvas, toggle on Close screen after action completes
1. This ensure the pop up screen closes after the acquisition has been run
Configure the input connection point to the Company Merger form
Map in the two CompanyID fields from the screen, CompanyIDBeingAcquired and CompanyIDDoingAcquiring

Bulk Update Action Setup

A Bulk Update action is required to update the data in each table.

Create two Bulk Update actions: one to update the Employees data and one to update the Orders data
Drag the input onto each action

Update Employees Bulk Update Setup

Map in the required data and set up the action to update the data with the replacement company details.

Map the attribute, CompanyIDDoingAcquiring, onto the CompanyID attribute on the table
Drag across the attribute, CompanyIDBeingAcquired, into the drag and drop space to create an additional mapping
On the Properties for the Employees Bulk Update action, set the Data Retrieval Options to:
1. CompanyID
2. equals
3. in.CompanyIDBeingAcquired

Update Orders Bulk Update Setup

Map in the required data and set up the action to update the data with the replacement company details.

Map the attribute, CompanyIDDoingAcquiring, onto the Customer_ID attribute on the table
Drag across the attribute, CompanyIDBeingAcquired, into the drag and drop space to create an additional mapping
On the Properties for the Orders Bulk Update action, set the Data Retrieval Options to:
1. Customer_ID
2. equals
3. in.CompanyIDBeingAcquired

Why is a Bulk Update action not needed for Order Lines?

The OrderLines data has a direct relationship with the Orders data via the OrderID. The OrderLines data has an indirect relationship with the Companies data via the OrderID, therefore, updating the Orders data is sufficient.

Checkpoint

Create Limited Access User

In the Full Repository, expand the Users section
Click to create a new user who will not have access to run the acquisition
1. Login: limitedaccess
2. First Name: Limited
3. Surname: Access
4. Password: Phixflow123!
5. Enabled:
6. Apply the user
7. In the User Groups section, click the icon
  1. Drag across the User Groups, Actionflow Advanced Application and Users into the User Groups section of the Limited Access user
    1. There will be two Actionflow Advanced Application user groups. Ensure the one ending _Admin is not chosen
8. Apply and Close all tabs

Change Actionflow Permissions

Open the Company Merger Pop up screen and open the Actionflow on the Run Acquisition button
Open the Actionflow Properties
Click on the Security tab
Disable All Users can Run Action
Click the icon and drag across the User Group, Actionflow Advanced Application_Admin into the User Groups section of the Security tab
1. This limits the permission to run this Actionflow to just this User Group

Testing

Log out and login as the user, Limited Access
1. You should not be able to see the Run Acquisition button on the Company Merger Pop up screen

3.08 For Each Action Configuration

3.07 Actionflow Security and Permissions