Dear support,
In our application we want to implement the integrated security (by returning SecuredObjectSpaceProvider in CreateDefaultObjectSpaceProvider).
We get an exception while trying to save an object of type Auditing:
Saving the 'Auditing.AuditingState' property is prohibited by validation rules" .
The write permissions for Auditing are set up like that:
- No type permissions
- object permissions that grant write permission based on the AuditingState property
Its the same issue that a user had here (that ticket also has a sample project…):
Other support ticket
The solution there was to add a memberpermission:
"To solve this problem, add a member permission that grants Write access to the Topic.Replies property."
I have two issues with this solution:
- If I grant write permission to the member then that property will (obviously) not be write protected in the view afterwards.
- If I want to check permissions in code like that:
C#SecuritySystem.IsGranted(new ClientPermissionRequest(typeof(Auditing), null, ObjectSpace.GetObjectHandle(theObject), "Write"))
it always evaluates to true because of this code in ServerPermissionRequestProcessor.cs:
C#if(IsOperationGrantedByObjectPermissions(permissionRequest.TargetObject, permissionRequest.ExpressionEvaluatorProvider, permissionRequest.Operation)) {
return true;
}
if(IsAnyMemberPermissionGranted(targetType, permissionRequest.Operation)) {
return true; // PROBLEM
}
Is there any solution for this issue?
Thank you!
Hello Bernd,
It seems that you have configured permissions incorrectly. Would you please send us a simple sample where this issue is reproducible? We will be happy to help you.
>>If I grant write permission to the member then that property will (obviously) not be write protected in the view afterwards.
If you specify criteria in this permission, then this member will be written as protected.
>>2. If I want to check permissions in code like that:
SecuritySystem.IsGranted(new ClientPermissionRequest(typeof(Auditing), null, ObjectSpace.GetObjectHandle(theObject), "Write"))
This method returns information for the whole object. You need to specify the member as a second parameter to return the correct result.
Hello Alexey, thank you for your answer.
I attached a sample project that shows the issue. Please log in with the user "TestUser". Then create an object of type BusinessObject1 and set IsProtected to true. Then save it.
The business case behind this is that I want to have an object that is write protected based on one of its properties. But that property needs to be changed by the user in order to make that object write protected. And afterwards the user should no longer be able to change the object or the specific property.
So step by step it would be: