locked
modify filtered view to add custom security logic RRS feed

  • Question

  •  

    Hi

    I need to customize the data access in MS CRM. Out of the box, MS CRM will diplay data through filtered views based on the security settings of the logged user. I would like to hook to that logic and add some additional checks and filters..

    I need to filter data based on sales area whihc will be a new entity and each user can be assigned to one or more sales areas.

     

    Can I change the criteria of the available views to sort of add the additional filters based on the assigned sales area? or do I need to use plug in on onload event? what is the best way to proceed?

    Friday, September 5, 2008 1:23 PM

Answers

  • You need to register a plugin on the Execute message to handle the Fetch. You could use either a pre-stage (if you write code to modify the FetchXml query), or a post-stage (for code that modifies the results of a query).

     

    Plugins are not executed when users run reports

    Wednesday, October 29, 2008 9:58 PM
    Moderator

All replies

  • First of all, FilteredViews are only used when accessing data via reports, and not used when users access data via the CRM applications.

     

    You could potentially use plugins on the Fetch (used in views), Retrieve and RetrieveMultiple messages to filter what is displayed.

     

    An alternative option would be to give users minimal permissions, and add additional permissions via sharing - you could use a plug-in to automate this process.

     

    Friday, September 5, 2008 4:51 PM
    Moderator
  • Thanks for your answer.

     

    When MS CRM  diplayes the list of accounts for example throught views, doesn't it retrieves the data through filtered views whihc is basically a sort of a report ?  How does it otherwise  filter the list of records to diplay based on the user credential?

     

    when the user clicks on CRM-->account , on the right panel frame a list of records is diplayed , based on the default view criteria. All the  view's  criteria are (I guess ) applied on an already filtered records, based on user role something like : 

     

    1) All accounts records in CRM

     

    2) Filter based on user credential and CRM security settings

    --------------------------------------------------------------------------------------

     

    3) additional Filters from views coming from CRM application (either custom or defaults)

     

    I need to add some logic between 2) and 3) so all the view will work on my modified base view with my security incorporated..

    The same additional security logic will need to be applied in all the look ups that show acconts..

     

    Now you suggest to use plug in with Retrieve or RetrievMultiple ...can you point me to an example please?

     

     

    regards

     

     

     

     

     

    Thursday, October 16, 2008 8:49 AM
  •  

    You have two options:

    1. Access filrered views using integrate security (SSPI) to displayed the records that the user have permission


    2. Use RetrieveMultiple and Retrieve as David said. This is most recommended by Microsoft.

    Using RetrieveMultiple
      Add reference Microsoft.Crm.Sdk and Microsoft.Crm.SdkTypeProxy
     

    // Set up the CRM Service.
    CrmAuthenticationToken token = new CrmAuthenticationToken();
    // You can use enums.cs from the SDK\Helpers folder to get the enumeration for Active Directory authentication.
    token.AuthenticationType = 0;
    token.OrganizationName = "AdventureWorksCycle";
     
    CrmService service = new CrmService();
    service.Url = "http://<servername>:<port>/mscrmservices/2007/crmservice.asmx";
    service.CrmAuthenticationTokenValue = token;
    service.Credentials = System.Net.CredentialCache.DefaultCredentials;

    // Create the ColumnSet that indicates the properties to be retrieved.
    ColumnSet cols = new ColumnSet();

    // Set the properties of the ColumnSet.
    cols.Attributes = new string [] {"fullname", "contactid"};

    // Create the ConditionExpression.
    ConditionExpression condition = new ConditionExpression();

    // Set the condition for the retrieval to be when the contact's address' city is Sammamish.
    condition.AttributeName = "address1_city";
    condition.Operator = ConditionOperator.Like;
    condition.Values = new string [] {"Sammamish"};

    // Create the FilterExpression.
    FilterExpression filter = new FilterExpression();

    // Set the properties of the filter.
    filter.FilterOperator = LogicalOperator.And;
    filter.Conditions = new ConditionExpression[] {condition};

    // Create the QueryExpression object.
    QueryExpression query = new QueryExpression();

    // Set the properties of the QueryExpression object.
    query.EntityName = EntityName.contact.ToString();
    query.ColumnSet = cols;
    query.Criteria = filter;

    // Retrieve the contacts.
    BusinessEntityCollection contacts = service.RetrieveMultiple(query);

     

     

    Download the SDK in http://www.microsoft.com/downloads/details.aspx?FamilyID=82e632a7-faf9-41e0-8ec1-a2662aae9dfb

     

    []s

    Saturday, October 18, 2008 11:55 PM
  •  

    Hi  thanks for the code example.

     

    I still don't understand what David means by using a plug in  for fetch ..

    can anyone give some more details on it?

     

    I guess I would have to use that code in a plug in, but on what event should ? would it be on a  pre stage pipeline?

     

    Also will that type of plug be executed also when the user is creating a report in CRM  before retrieving the data?

     

    Katja

     

    Wednesday, October 29, 2008 4:14 PM
  • You need to register a plugin on the Execute message to handle the Fetch. You could use either a pre-stage (if you write code to modify the FetchXml query), or a post-stage (for code that modifies the results of a query).

     

    Plugins are not executed when users run reports

    Wednesday, October 29, 2008 9:58 PM
    Moderator