In case of Active Directory accounts and SSO: When the user starts his computer and opens a windows session, each application opens without displaying VG login window.

In case of UN/PW account: A login window has to be opened to ask the user his credentials. You can use either Visual Guard .Net login window or a login window you have developed on your own.



Visual Guard

This is the initial purpose of VG deployment features:
VG automates the process of updating the permissions and roles coming with each new version of an application.
When deployed into production, this information does not interfere with the data defined by the administrator (User accounts, roles granted to users,...)


Visual Guard

All DotNet controls can be manage by the Permission Editor. You can create properties, and those properties will be visible if you add the interface "VGISecurable" and call the method "SetSecurity" in the class.


Visual Guard .NET

You can define a VG Expression or a regular expression that would:

o Execute a VG action if a condition involving a data is successful
For instance: the permission applies if the customer is American
SalesOrder.Customer.Country == 'USA'

o Apply a value to a property calculated with other data in the form
For instance : button cb_2 is visible when button cb_1 is
cb_2.visible=cb_1.visible

Other examples:

• Permissions with parameters:
You need to set a maximum amount allowed (in a purchase order for instance).
This limit can rely on a property updated with a VG property action.
In the VG permission, you can set a parameter defining this limit.
Thus, administrators can change the limit anytime and grant different limits
from one role to another.

• Multiple criteria:
You want to disable the modification in a sales order form, if the customer is based in the USA and the product is not shipped yet (the field “shipping date”is empty).
You can define the following condition to disable modifications in the form:

SalesOrder.Customer.Country == 'USA' and
SalesOrder.ShippedDate !=System.DateTime.MinValue



Visual Guard .NET

You can define a condition in a VG action to compare a subscription date with the current date.
You can also update a property with an expression like:
cb_save.visible = (limitDate > System.Datetime.Today).

In this case, cb_save remains visible as long as the current date does not exceed limitDate.


Visual Guard .NET

Option 1:
You can build a dynamic query, using a Web Service property to define its “where” clause. You can then dynamically change this where clause with a VG property action.
For instance, you can add a “where” clause to a SelectCommand.SqlDataSource
property like this:

MySqlDataSource.SelectCommand = {CurrentValue} <new where clause>.

If the query may already contain a “where” clause, you will take it into account
with a regular expression like:

#CurrentValue.ToLower.Contains(“ where ”)? string.Format('({0}) and <additional
where clause> ', #CurrentValue):string.Format('({0}) where <new where clause> ',
#CurrentValue)

Option 2:

You can filter data, after the query is executed and the result set retrieved
For instance, VG property actions can dynamically change the following:
Property “RowFilter” of a “DataView”
• Property “Filter” of a “BindingSource”.
• Property “FilterExpression” of a “SqlDataSource”.
• When changing such a filter property, we will check if a filter already exists. If so, we add a new clause, otherwise we will create a new filter.

A VG property action can change the filter property with a regular expression like:

#CurrentValue.Length == 0?'<New filter>':string.Format('({0}) <additional filter>,
#CurrentValue)



Visual Guard .NET

You can build a dynamic Query, using for instance the SQL command “limit”. This limit would rely on a Web Service Property, updated with a VG property action.
Another option may consist in checking the number of rows with a count(*) and executing the query if this count does not exceed a given limit, defined by a
property updated by VG property actions.

Bottom line, such a permission would include a VG property action defining the
number of item displayed in a list.


Visual Guard .NET

Visual Guard supports both options but :

For security reasons, we strongly recommend maximum security
=> You close all doors at development time and open them one by one with permissions

and NOT to develop in minimum security.
( "open all door" at development time and close them one by one with restrictions)

FYI, Microsoft's security patterns include a strict "nothing-allowed-by-default" policy.

The reason is if you forget to close one door with a restriction, it may generate a security/confidentiality breach in the system:
All users can go through that door.
Whereas forgetting one permission is less critical: you just have to add the permission if/when a user request it.

With Visual Guard dynamic permissions, you can add permissions anytime, even when the application is on production (dynamic permissions do not require any access or change in the code)


Visual Guard

You can check in code that the current user has a given permission with the GetPermissionMethod
You can also check the role of the current user, get its list of permissions, etc...

GetPermissionMethod
http://www.visual-guard.com/EN/dotnet-s ... sion_1.htm


Visual Guard .NET

Visual Guard does not act directly on the database.
VG allows creating permissions on applications written in C# or VB.Net.
You can indirectly control access to the database.
Lets take an example:
You have a C# app. This C# app displays some information from your DB in field A.
You can create with VG a permission "right to see field A" and grant this permission to the end users of your choice.
This end user will not have access to other parts of your app, unless you create and give him the corresponding permissions.

Visual Guard .Net also supports access permissions to a file or a web site folder:
You can define in the configuration files of your website which role or user can access a file or folder.
You are then able to manage these roles and users in Visual Guard.

Ultimately, a role will gather permissions like "hide a data" and access to files and folder.


Visual Guard .NET

There are several ways to do that.
I believe the best way consist in defining a permission with a condition:

* This permission will include a property action enabling menu options.
* This property action will include a condition
* The regular expression in this condition is a call to the function that validates the contract ID.
* If this function return "true", then the condition is successful and the property action is executed.
* If this function return "false" then the condition is not successful and menu option will remain disabled

Visual Guard .NET

You can create a permission for an ancestor window. It will be applyed to all of its descendants.


Visual Guard

There are several option to get this result:


1) Run the permission after the change done by the application: you can decide to apply a permission on an event of the application rather than on the initialization of the object.
For example, you can disable (or enable) a control on the event 'EnabledChange' of the control(WinForm application) or on the 'PreRender' event (WebForm)application) or on an event which indicates that the state of the control has to be calculated again.

You are able to test directly in your appliction if the user has a permission and integrate this test in the logic of your application to determine if the control should be enabled or disabled.


If <MYLogic> = true and VGSecurityManager.Principal.HasPermission("MyPermission") then mybutton.Enabled = true



Visual Guard .NET

It is a best practise to develop your application with the “least privilege by default” but this practise has a cost.
It is more difficult for a developer to develop and test in this mode.
I think it is a better practise to determine what is very sensitive in your application. For highly sensitive data or actions, you will use the mode "least privilege by default" during the development and in the other cases you will use the mode "normal".



Visual Guard

When information is hidden (example of the permission “hide personal information”), what can I do to remove the spaces left by the information?

When we hide fields (like in your sample), how can we re-arrange the form so that our customers do not see the blanks in place of the hidden fields?

You have different options to act on the form layout:
You can modify the appropriate property of the remaining components to change their position in your form.
You can use the component TableLayoutPanel (2.0) or FlowLayoutPanel. Admin



Visual Guard

Visual Guard allows the modification of existing controls or the execution of a script. So you can dynamically create a control with a script, but more likely will you hide or show existing controls according to permissions.


Visual Guard

It is possible to add parameters to a permission. In the .NET sample, there is a permission "display only information on a country" with a parameter "country" which specifies the country you want to display.

When this permission is linked to a permission set, you have to indicate the country (for example for the permission set UK HR employee the parameter is UK). This value may also be indicated by the program in run time.


Visual Guard

Yes!

The idea is to identify in your applications every object (form, control, link...) which is related to your "sales" module.
Then you create "hide" or "disable" permissions for all of them.

then, you gather all these permissions in a pemission set (for example "Mechanic permissions")

You create a role "mechanic" and you link it to the permission set "Mechanic permissions"

You create the user accounts for your mechanic guys, and grant them the role of "mechanic".



Visual Guard

Definitely. You can create such a permission and query in the code if a user has been assigned this permission.
It's possible too for a Role.

You can query, in the code, if the user has this particular Role.


Visual Guard

- For Winform applications, Visual Guard .Net will analyze executable files (starting with the main assembly of the application, then all referenced assemblies).

- For Webform projects, Visual Guard .Net compiles the site resources and analyzes the generated assemblies.



Visual Guard

No problem: Visual Guard .Net takes into account the main assembly and the referenced ones. Actually, Visual Guard .Net “sees” all objects involved in the compilation.



Visual Guard

VG provides a deployment tool to deploy security rules from one repository to another.

You can read more at:
http://www.visual-guard.com/EN/net-powerbuilder-application-security-authentication-permission-access-control-rbac/vg-winconsole-deploy-permissions-in-production.html

Deployment Wizard
Each new version of an application may come with new permissions.
You need to deploy this repository, without loosing the data already entered by administrators in the previous repository.

Visual Guard provides a Wizard to deploy new permissions in a production repository.
Visual Guard Deployment Wizard will merge new and previous permission automatically, without losing existing user accounts and roles.



Visual Guard

The Visual Guard .Net Console allows you to create, see and manage several repositories at the same time in a tree view.
You can create one repository per environment.

Could we define different permissions set for different repositories?

Definitely. Permissions sets are created and managed in the Visual Guard Win console per applications. A permission set is created for an application. You can manage several applications in a repository.

Visual Guard .NET

Yes, it is indeed a kind of multiple heritage mechanism.


Visual Guard .NET