Can we access data from multiple Datatables for ABAC condition?
We have to implement Attribute based access control based on one property (Say Prop1) which is in a multiple datatables as a associated data and has master table to identify its unique values.
Based on Prop1 we have to show the workobjects,data, reports etc specific to a user who matches with a unique value of Prop1 from other datatables.
I have done a POC on ABAC on work table using access control policy and access control policy condition rules, however in the condition I can only specify a property that is exposed in its applied to class whilst my property Prop1 comes from a different data table which has to be further filtered using joins with other data tables.
Is is possible that ABAC can support this complexity? If yes, then please let me know how. Any article would be helpful.
ABAC supports data pages on the RHS side of the policy conditions. Create a data page on your data class to load the Prop1 values that can be accessed by the user. This data page should fetch the unique identifiers that link work and data.
Now you can use this data page on the RHS side of Policy condition to filter the results based on the unique identifier value present in data page.
As you mentioned, you have unique identifiers that link your work and data records. You can use that on LHS of the work class.
If I understood your requirement correctly, you have a work class that reference a data class property ex. CustomerId. This is present as a column in work table. You have a separate data table which has customer ID, CustomerRegion and other columns on it and you want to filter out the results based on columns in this table ex: CustomerRegion . Write a data page to load the customer IDs by filtering out invalid regions. Here you can use policy on Data class to get allowed results. Then you will have only CustomerIDs that you can access. No write your ABAC condition on work class based on the customer ID column which is present in your work class.