Role based Security in AX

There is a new pattern introduced in the new version of Dynamics AX (AX6.0/2012), for the security of the forms/tables etc. which is called RBS.

In Microsoft Dynamics AX, role-based security is aligned with the structure of the business. Users are assigned to security roles based on their responsibilities in the organization and their participation in business processes. The administrator grants access to the duties that users in a role perform, not to the program elements that users must use.

                     

Let’s take a looks at the data models of the Security framework

Table	Description	Mapping
SecurityRole	Contains list of roles	(AOTàSecurityàRoles)
SecurityUserRole	Contains the user to role mappings	(System Administration à Users àUser)
SecurityTask	Contains the list of duties and privileges	(AOTàSecurityàPrivileges/Duties)
SecuritySubTask	Contains the duty to privilege mappings	(AOTàSecurityà Dutiesà Privileges)
SecurityRoleTaskGrant	contains the list of role to duty mappings	(AOTàSecurityà RolesàDuties)

Some Examples

///////////////// Code in X++ /////////////////////////////

SecurityRole            securityRole;

SecurityUserRole        securityUserRole;

SecurityTask            securityTask;

SecuritySubTask         securitySubTask;

SecurityRoleTaskGrant   securityRoleTaskGrant;

   

#define.SecurityRole(‘BudgetBudgetManager’)

#define.SecurityTask(BudgetManagerRoleCenterView)

   

// 1. How to the find record ID of the privilege

select firstOnly RecId from securityTask

    where securityTask.AotName  == #SecurityTask

        && securityTask.Type    == SecurityTaskType::Privilege;

   

// 2. How to find the record ID of the security role of the currently logged-in user aving the specified security role

select firstonly RecId from securityRole

    exists join securityUserRole

    where securityRole.RecId     == securityUserRole.SecurityRole

        && securityRole.AotName  == #SecurityRole

        && securityUserRole.User == curUserId();

// 3. How to the find all the duties containing the specified privilege (security Duty)?
select SecurityTask from securitySubTask

    where securitySubTask.SecuritySubTask == securityTask.RecId;

// 4. How to check whether the privilege is directly associated with role

select firstOnly RecId from securityRoleTaskGrant

    where securityRoleTaskGrant.SecurityTask  == securityTask.RecId

        && securityRoleTaskGrant.SecurityRole == securityRole.RecId;

　

// 5. How to check whether the privilege is associated with role through duty

 select RecId from securityRoleTaskGrant

    exists join securitySubTask

    where securityRoleTaskGrant.SecurityTask == securitySubTask.SecurityTask

            && securityRoleTaskGrant.SecurityRole == securityRole.RecId;

   

 ///////////////// Code in X++ /////////////////////////////

For getting List of all Roles

 static void RoleUSerID(Args _args)

{

UserInfo    userInfo;

SecurityUserRole securityUserRole;

SecurityRole       Roles;

while select userInfo

join securityUserRole

where securityUserRole.User == userInfo.Id

join Roles where Roles.RecId  == securityUserRole.SecurityRole

&& Roles.AotName ==”TradeSalesRepresentative”

{

info(userInfo.Id);

}

Topics to cover for "Development, Extensions and Deployment for Microsoft Dynamics 365 for Finance and Operations"", MB-6 894

MB-6 894

Primary areas which can be emphasized on -

• • Configure Visual Studio, so that we can work seamlessly on it.
  • Understand "Application Explorer", ways of managing and organizing the same.
  • Create and manage solutions, projects, elements.
  • Create and manage models.
  • Create and manage packages.
  • Understand "Solution Explorer", "Element Designer", "Properties" window along with other commonly used terminologies.
  • Understand the relation between packages, models, projects and elements.
  • Understand Over-layering and Extensions, reference models.
  • Import and export of projects and packages.
  • Options to synchronize database (project specific as well as generic).
  • Options to manage builds and rebuilds (project specific, solution specific as well as model specific).
  • Understand "Dynamics AX 7" menu and the various options.
  • Understand Application Stack, along with the objects lying in the individual layers of the same.
  • Understand Server Architecture, along with the flow.
  • Understand Cloud Architecture, along with the involved components.
  • Create and manage labels, understanding label versions (language specific) and searching labels.
  • Create and manage resource files, types of files which can be associated.
  • Base enums, element values and their saving in SQL.
  • Primitive data types.
  • Extended data types, understanding which properties can be changed (in case of extending an existing EDT) and which properties cannot be changed.
  • Create and manage Tables.
  • Table indexes, different types of indexes and their usages.
  • Table relations, different types of relations ("OnDelete" property).
  • Table inheritance and properties required to implement the same.
  • "InMemory" and "TempDB" tables, along with their usages.
  • Basic level understanding of the table methods.
  • Creating and managing queries, understanding nesting of data sources, dynamic filters.
  • Creating and managing forms, differnet type of form controls, data sources.
  • Understanding form patterns and sub-patterns.
  • Create and manage different types of menu items.
  • Create and manage menus.
  • Managing and using code editor.
  • X++ language (data types, variable declarations and their usages, statements, loops, basic syntax).
  • Runnable classes and its usage.
  • Classes and objects
  • Class inheritance.
  • Different type of class methods and their executions.
  • Key properties for all the elements.
  • Base practices and advantages for all elements.
  • Basic understanding of debugger and its execution.
  • Basic understanding of comparison tools.
  • TTS blocks.
  • Data manipulation (read, insert, update, delete).
  • Exception handling (Try, Catch, Retry, Finalize).
  • Security architecture - roles, duties, privileges, process cycles, permissions, security properties on key elements.
  • Basic understanding of BI.
  • Basic understanding of OData.
  • Basic understanding of Reporting Services.

Import Model Store

To import the Modelstore in a temporary schema and at the end apply follow steps:

Steps:

1. Open SSMS (SQL Server Management Studio) (Press the Windows Key + R, Run will open Type SSMS and enter)

2. Connect to the SQL Server instance where AX database resides

3. Expand to Databases > MicrosoftDynamicsAX_model > Security > Schemas

4. Right click > New schema

5. Type in the temporary schema name (TempoSchema) and select the schema owner and click "OK"

6. Initialize the temporary schema

For Initialize the temporary schema Use the command below:

Initialize-AXModelStore -AOSAccount "Domain\AccountName" -SchemaName <TempoSchema> -Server <ServerName> -Database <DatabaseName>)

Import model store to temporary schema

Syntax: Import-AXModelStore -File <filename> -TempoSchema

Example:

Import-AXModelStore -File “C:\AX\AX_ModelStores\AXModelStore.axmodelstore” -SchemaName “TempoSchema” –IdConflict overwrite

//-Config MicrosoftDynamicsAX -Details (OPTIONAL FOR CONFIG)

Import-AXModelStore -Apply:TempoSchema -Config MicrosoftDynamicsAX -details

--

SQL Commands for Change tracking system:

TO check what tables in Change LOG:

SELECT s.name AS Schema_name, t.name AS Table_name 
FROM sys.change_tracking_tables ctt
JOIN sys.tables t 
    ON t.object_id = ctt.object_id
JOIN sys.schemas s
    ON s.schema_id = t.schema_id
ORDER BY s.name, t.name

The following script can be used to enable/disable Change Tracking on a particular database.

1 2 3 4 5 6 7 8

-- Enable ALTER DATABASE database_name SET CHANGE_TRACKING = ON  (CHANGE_RETENTION = 2 DAYS, AUTO_CLEANUP = ON)  -- Disable ALTER DATABASE database_name SET CHANGE_TRACKING = OFF

To enable/disable change tracking on individual table(s)

1 2 3 4 5 6 7

-- Enable ALTER TABLE table_name  Enable Change_tracking; -- Disable ALTER TABLE table_name  Disable Change_tracking;

If you wish to enable change tracking on all tables within a database in one go, you can use the following dynamic query to generate “enable change tracking” script.

1 2 3 4

Use database_name; go EXEC sp_MSforeachtable  'PRINT ''ALTER TABLE ? ENABLE Change_tracking;''';

To disable change tracking on tables within a database in one go, use the following query

1 2 3 4 5 6 7 8 9 10 11

Use database; GO DECLARE @SQL NVARCHAR(MAX) = ''; SELECT @SQL = @SQL + 'ALTER TABLE ' + s.name + '.' + t.name +              ' Disable Change_tracking;' + CHAR(10) FROM sys.change_tracking_tables ct JOIN sys.tables t  ON ct.object_id= t.object_id JOIN sys.schemas s  ON t.schema_id= s.schema_id; PRINT @SQL; -- EXEC sp_executesql @SQL;