CAP: Instance-based Authorization based on user attribute

former_member869401 — Tue, 25 Jul 2023 08:39:40 GMT

Hello experts,

in the last days I tried to implement the instance-based authorization into our CAP application by following this Capire information: Instance-Based Authorization

Our users have multiple attributes, by which the access is restricted.

Attributes defined in the xs-security.json file:

"attributes": [
    {
        "name": "Application",
        "description": "Application",
        "valueType": "string"
    },
    {
        "name": "CompanyCode",
        "description": "CompanyCode",
        "valueType": "string"
    },
    {
        "name": "RecordType",
        "description": "RecordType",
        "valueType": "string"
    }
]

Our entity is restricted as follows:

annotate srv.Application with @(restrict: [
    {
        grant: 'READ',
        to: ['Display'],
        where: 'application = $user.Application'
    }
]);

This restriction works fine. The users can only read the applications contained in the users Application attribute.

Now we have a new requirement: There should be a way for a user to be configured to get access to all applications. To do this, the Application attribute will get a special value (e.g. "ALL"). If a user has this value inside of their Application attribute, he should be able to see all applications.

To achieve this, we tried the following restriction:

annotate srv.Application with @(restrict: [<br>   {<br>       grant: 'READ',<br>       to: ['Display'],<br>       where: 'application = $user.Application or $user.Application = ALL'<br>   }<br>]);<br>

Unfortunatly, this did not work and produce the following error message upon reading the entity:

No CXN expression found for where condition 'application = $user.Application or $user.Application = ALL' used for instance-based authorization of entity 'srv.Application'<br>

We already looked at alternative ways of doing this:

Unrestricted user attributes: This is not suitable, because this way, every user who has not yet set their Application attribute would have access by default. We want to restrict access by default and explicitly allow the access via the ALL value

Separate roles for unrestricted access, like an "ApplicationALL" role: This does also not seem suitable, since this would be required for every attribute (currently we are at 3, but there might be more in the future) and make the restrict annotations very clustered and hard to manage.

Is there any way to achieve our goal using the posted restriction annotation? If not, what would be the best way to tackle this?

Thank you for your input.

Kind regards,
Philipp

Re: CAP: Instance-based Authorization based on user attribute

former_member227670 — Tue, 25 Jul 2023 11:13:44 GMT

Constant values need quotes. Please retest with

[...]
where: 'application = $user.Application or $user.Application = `ALL`'

Re: CAP: Instance-based Authorization based on user attribute

former_member869401 — Tue, 25 Jul 2023 12:48:06 GMT

Thank you Matthias!

The quotes did the trick.

Kind regards,
Philipp

Question Re: CAP: Instance-based Authorization based on user attribute in Technology Q&A

CAP: Instance-based Authorization based on user attribute

Re: CAP: Instance-based Authorization based on user attribute

Re: CAP: Instance-based Authorization based on user attribute