Documentation:Access groups

Access groups are described in several places :

• AccessGroups, InterestGroups and ViewModel-Enable
• Part 9 MDriven Turnkey: cloud tools and access groups
• Turnkey session 5: How to access the logged in user. AccessGroups
• Access_control_system_in_MDriven
• AccessExpression

The main purpose of Access Groups is to control what is visible and/or enabled for a user in a certain role or situation.

An access group (ag) can be set as an Interest group (ig). An Interest group acts the same way as an Access group but with these key differences:

1. An Interest group only controls the visibility of actions - but access groups control enable and visibility for both actions and ViewModels.
2. An Interest group is only evaluated if access groups are either missing or evaluating to visibility true.

The rationale for Interest groups is to segment a large set of actions into different user-chosen interests so that actions can be filtered away from the UI and thus, have users find their way easily.

The use of ClassActions can be very productive from a design perspective, but can also bloat UI's with actions that are not really needed in a certain use-case. Prior to interest groups, we needed to opt-out these actions on a view-by-view basis. The interest groups make it possible to filter away such actions based on some other criteria - for example, a user-chosen focus.

Overview of Access Groups

You probably have different users in your system and these users are associated with an access group somehow (ActiveDirectory or something in your application).

You will want to allow and disallow user groups to execute actions.

This could be done as enable expressions on the Actions – but that would not be beneficial since it would kidnap the use of enable from the normal things we use enable for (check data state). Also, if a user is never allowed to execute “TheAdminInterface” it might be best to hide that action from view altogether.

To facilitate this, Modlr has a new concept called AccessGroups:

Clicking on the AccessGroup dialog shows you this:

Here, you can add groups and define the EnableExpression and VisibleExpression for the AccessGroups.

An AccessGroup contains actions - you can add and remove associations.

If an action is a member of multiple AccessGroups, the result will be:

(Group1.IsEnable OR Group2.IsEnable OR Group3.IsEnable) AND action.IsEnable

And to make the result visible:

(Group1.IsVisible OR Group2.IsVisible OR Group3.IsVisible) AND action.OptInInContext