Skip to main content

Right now al the Categories and Forms build within Designer can be exposed if the URL is leaked to the Windows Domain users.

 

How can I add a security feature to make sure the applications/forms are only accessible to a certain groups/people ? regardless of the roles they use within the Form ?

 

I guess once the Properties and the URL is there how to secure those URL's without affect the global access..

 

http://k2dev.progressrail.com/Runtime/Runtime/Form/MainForm/
http://k2dev.progressrail.com/Runtime/Runtime/Form/MainForm2/
http://k2dev.progressrail.com/Runtime/Runtime/Form/MainForm3/

http://k2dev.progressrail.com/Runtime/Runtime/View/SomeListView/
http://k2dev.progressrail.com/Runtime/Runtime/View/SomeListView2/
http://k2dev.progressrail.com/Runtime/Runtime/View/SomeListView3/

 

THX DIno.

Hi,
Currently setting security permissions for the category level is not available and it's an upcoming feature as far as I know

I wonder if as workaround will be possible to onload have a rule to check for a list of specific users and if the user is found continue with the form later if is not display a message or redirect to some other public view.


Hi, this is possible and you can use an AD group for this or any other data store. So you put the rule at when the form is initializing or better still if you have a header view or some other view that is reused on your forms, you can put the rule on there so you don't have to rewrite the rule for every form.

 

When the view (or form) is initialzing, execute a smartobject method,

  1. Have a hidden text box with a default value to output data to. Default value can be "Not allowed" or something.
  2. Pass in the useremail or username from the context browser into the access smartobject to check if theis allowed.
  3. Pass the output value into the text box in step 1. 
  4.  Create a rule on step 1 text box, when the value is changed if it contains a specific value "Not allowed" (this means the username is not contained in the smo as the value didn't change from default) then navigate to a URL.
  5. Add another rule on step 1 text box, when the value if changed if it does not contain "Not allowed" or is not null (this means the username was found in the smo) the stop rule execution.

Reply