User Roles

In the last chapter we already used the permission setting Roles. Now we will see how role bases permissions work.

Roles

The easiest part of roles are the roles itself. Basically, its just a list of keys.
Go to the Roles node, make a right click and choose "Add Role".
Select "Role1". While Title and Description, like usually, are optional, the important value is the Key.

Roles

Assign Roles To Users

Assigning roles to a user, is done by a GroupReader. You can choose between two standard GroupReader the Active Directory Groups Reader and the Application Model Groups Reader.
NOTE: You also can use a custom group reader.

Active Directory Groups Reader

Active Directory is a Microsoft directory service. If you are using Active Directory, your users are normally already organized into groups, which makes it easy to use it for M4 roles.
All you need to do, is to match the Active Directory groups with M4 roles.

Create Active Directory Groups Reader:

Go to the Application Model root "Model 1".
Select and open the property GroupReader.
Choose Active Directory Groups Reader as SelectedClass.
Select the Template property and click on "Create".
Open the Template.
Select the Dictionary property and click on "...".
Add the roles you need.

Active Directory Groups Reader

Application Model Groups Reader

If you are not using Active Directory, it is also possible to assign roles to groups and users in the Application Model only. This can be done with the Application Model Groups Reader.

Create Application Model Groups Reader:

Go to the Application Model root "Model 1".
Select and open the property GroupReader.
Choose Application Model Groups Reader as SelectedClass.
Select the Template property and click on "Create".
Open the Template.
Select the AppModelGroups property and click on "...".
Add the users you need.
NOTE: The "Login Name" property must match exactly the Windows user name including domain name (e.g. "MyDomain\MyUserName").

Application Model Groups - Add user

Then select the Groups tab and add the groups you need. To assign a role to a group, the "Role Key" must match exactly the key of an M4 role. If you don't want to assign a group to a role, just leave the "Role Key" empty. This can be useful, if you want to use this group as a child group of another group.
Select a group and check "Is Assigned" for the users, you want to add to this group.

Application Model Groups - Assign user to groups

Each group can have child groups and child groups can also have child groups. That way a group tree is created.
A user will get the roles of the groups he is assigned to and the roles of all its parent groups.

Application Model Groups - Add child groups

Setting Roles For Permissions

Setting roles for Roles type permissions is rather easy. It works for all permissions the same way:

Go to the permission you want to set roles for (in this example "Access Model/AddPermission").
Select Roles for the property PermissionType.
Select the PermissionRoles property and click on "...".
Check in the dialog the roles you want to give permission to.

Roles