You can create/read/update/delete roles with the VG WinConsole and/or the VG WebConsole, or creating your own role management system using VG API.
In the VG WinConsole and the VG WebConsole, you have the possibility to grant permission sets to roles.
You also have the possibility to grant a role to a user or to a group.
If you grant a role to a group, all the users and groups inside this group will have the permissions related to this role.

By default if you do not enable the user to select one of his roles, the permissions of the 2 roles will be merged
To avoid conflicts between your role Clerk and your role Manager, here are some solutions:
1 - By default you will not enable users to see the SSN field. You will grant the permission to see it to the role Manager. As a consequence, when the 2 roles will merge, the user will be able to see the SSN field
2 - In Visual Guard, you will list a permission ‘Show SSN field’ but not create the technical action. In your application, you will codify the following ‘Does my user has the permission ‘Show SSN field’ If he does, show the SSN field.



Visual Guard

Visual Guard offers the possibility to define a “default role” for each application (auto-provisioning).
This role is automatically granted to new user accounts.
You can set up this option when you declare a new application in the console. The application creation wizard includes a step where you are able to activate the « default role » option.
You can set up this option at anytime. The default role is declared as a property of the secured applications. In the VG Win console, you can access this property and enable it manually.



Visual Guard

Based on your scenario, we do confirm that:

· When xxx\Alice logs in to the application, VGPrincipal.IsInRole will return true for "xxx\CRM-ApplicationUser" in addition to "VG-CRM-ApplicationUserRole".

· Any other Windows account added by the AD administrator to the Windows Group xxx\CRM-ApplicationUser will automatically be related to the role VG-CRM-ApplicationUserRole, although Visual Guard does not know these other Windows accounts.

· This is under the condition that the VG Property "IncludeWindowsGroups" is true. You can read more about this property at:

http://www.visual-guard.com/EN/dotnet-security-user-role-permission/support/dotnet-API-how-to-documentation/html/P_Novalys_VisualGuard_Security_VGSecurityManager_IncludeWindowsGroups.htm

Visual Guard

Option 1:
You can create two roles. One would be "normal" and the other "emergency".
You can create all the permissions (or restrictions) linked to the everyday work of the staff, and gather them in the "normal" role.
You can gather in the "emergency" role the permissions (or restrictions) adapted to emergencies.

Each member of staff will be granted both roles and will be able to choose one the other role depending on the situation.

Then, you will be able to decide which actions are logged or not (thanks to the audit features of Visual Guard).
You can log every actions, or only actions performed with the "emergency" role.

Option 2:
You can use permissions with conditions.
In Visual Guard, you can define a condition to decide in which case a permission should apply.
In your context, when needed, the application goes in "emergency mode", then:
- Some actions will be allowed (for example see the file of patients from an other department)
- Some actions will be logged ( for example modification of the file of the patient)

* This solutions allow to avoid the "change role" step (maybe you or your customers prefer to avoid this)
* You do not have to maintain two roles. The " emergency" permissions are granted to the user (nurse or doctor) anyway. The fact the permissions are applied / or not depends on the condition, and not on the role.
* Your application will manage as usual the starting and stopping the "emergency" mode (what you call "blue button")


Visual Guard

* Create a Windows Group for each application's role
* Declare Windows Groups in the VG repository
* Grant a single role to each Windows Group
* Bottom line, you manage a 1-to-1 relationship between Windows Groups and VG Role
and you do not manage a long list of user accounts

Please note that the property "VGSecurityManager.IncludeWindowsGroups" should be true
(you define this property when you generate VG configuration files)
If so, when a user logs in to the application, VG finds his Windows Group and load the corresponding VG Role.



Visual Guard

Yes he can.
He can manage the shared roles from the console. If you do not want to use the console, Visual Guard provides an API that enables to manage users and roles and to assign roles to users. Therefore a user’s management feature can be integrated to the application.



Visual Guard

A user may have different roles.
You can define which role a user will be allowed to use in application 1 or application 2.
Visual Guard .Net allows you to define specific roles for each application.
The user may access application 1 with role x and then access application 2 with role y with the same log in.

Visual Guard .Net offers also the possibility to :
- Create shared roles (available for all the applications declared in a given repository). It means when the same role is shared by several applications, this role needs to be granted to a user once for all these applications.
- Let the user select a role in a list (see example in our Sample with user Jsmith).

Visual Guard

2nd question : And is it possible grant several roles to the same user without using a pop-up form to select the roles?

By default, this is what happens in Visual Guard. If a user has several roles, he is given the corresponding permissions when he enters the application. The permissions of all his roles will be applied to him.
You may also define by program the roles to be used in the application (for example if the user has both “administrator” and “salesman” roles, then the program can decide to activate the administrator role).
if you want you can grant several roles to the same user, and have him choose between them when entering the application. ( this is what we do in the sample application)



Visual Guard

There are different ways to achieve this result:

- Visual Guard .Net is compatible with the LoginViews (for ASP.Net applications). You can define a LoginView in your welcome page. It would display a view adapted to the user’s role.

- You can test in the code of your application whether a user has a role and redirect the user to a given page according to its role.



Visual Guard