Skip to content

Row Level Security

Row level security means that the security access rights is not only set on specific windows or specific functions. It means that you can specify what data the user is allowed to view and operate on. The IFS Cloud Platform supports this functionality with a Security Check or Predefined Row Level Security, but in other cases row level security must be constructed in each entity where this is needed.

Add Row Level Security in a Business Component

The data a user can operate on is restricted to the data the user can query from the views. The row level security filter should be built into the views so only the data the user should have access to is returned.

Example 1:

The view adds the restriction that you can only see Quick Reports where you are the owner.

Example 2:

This view adds a restriction to only show data based on a setup made in another entity, in this case UserAllowedSite. The UserAllowedSite entity defines which sites a user should be able to query data from. An administrator with access to the UserAllowedSite registration window can manage what data other users can see in all views where a condition like WHERE site IN (SELECT site FROM user_allowed_site_pub p WHERE p.site = site) is added.

Predefined Row Level Security Filters

In IFS Cloud there are some predefined filters for row level security that can be applied to a view by setting a property in the entity model. The existing row level security filters are listed in the modeling reference documentation DbRowLevelSecurity.

Example 3:

Two row level security filters are added to the base view for the entity.

Security Check Annotation

The @SecurityCheck annotation can be used to enforce security checks related to application business logic. This could be used to verify whether the current user has the rights to modify data related to a particular company or select data from other views than the base view.

Anywhere data should be filtered based on who is querying you should add a where statement in the view, if the Framework services from above could not be used.

Permission Set Filter

An administrator can configure custom row level filters. This is not a development step. Instead you can do this in Solution Manager on a specific permission set. But this only applies to activities which is mainly used in integrations with other applications.

Mark Database Views as Row Level Security Safe

In order to expose the database views through IFS Applications, it is expected that the views are Row Level Security Safe. In other words, if a database view is marked as row level security safe, those views can be exposed through IFS Cloud, especially in areas such as configurations.

To manually mark a view as row level secured, use the codegen property DbViewRowLevelSecurity or the annotation @DbViewRowLevelSecurity accordingly.

  1. When row level security is implemented in a custom manner, those views should be marked explicitly, with the meaning that Row Level Security is handled in a custom way in WHERE clause.

    If it’s a base view use the codegen property DbViewRowLevelSecurity "custom-implemented" in .entity file and if it’s a non-base view use the annotation @DbViewRowLevelSecurity CustomImplemented in .views file as shown below.

    codegenproperties {
      DbViewRowLevelSecurity "custom-implemented";
    }
    


    @DbViewRowLevelSecurity CustomImplemented
    VIEW Operation_History_Cost IS
    
  2. When row level security in not needed or in other words if any user should be able to access the data without any restrictions, those views should be marked explicitly, with the meaning Row Level Security is not needed.

    If it’s a base view use the codegen property DbViewRowLevelSecurity "not-required" in .entity file and if it’s a non-base view use the annotation @DbViewRowLevelSecurity NotRequired in .views file as shown below.

    codegenproperties {
      DbViewRowLevelSecurity "not-required";
    }
    


    @DbViewRowLevelSecurity NotRequired
    VIEW Approval_Type_Authority_ID_Lov IS
    

Row Level Security Safe Views in IFS Dictionary

A Database view is considered as Row Level Security safe in IFS Dictionary for views,

Code generator generates view and column comments for the above listed Row Level Security related codegen properties, filters and annotations. This information is persisted in IFS Dictionary via Dictionary cache refresh.