Field level security in Crm

There are no supported way to enforce field level security in Crm. What is often done is that the field or tab is hidden on the form. This has a number of weaknesses.

• Firstly, when you print the form, all the hidden fields will be printed out too. Now you can simply hide the print button too, but this can be overcome in the same way as the next bullet point.
• Any user with a little bit of javascript knowledge could easily unhide these fields by using a tool such as the IE Dev Toolbar

The second option is to create a child entity that hangs off the entity that the sensitive fields live on and then to move these sensitive fields to this new entity. This will allow you to use the Crm out of the box security on this child entity. This will work fine, but it does mean that each record you create, you'll have to also create a child record, which can be a pain.

The final, and most complicated, way is to do a combination of both the above. Now this is a little hard to explain, so bear with me. Note that for this part I do assume that the user has a reasonable grasp on writing plugins and javascript as well as knowledge of how to do a webservice call to the crmService via javascript.

For this example, I will use the account entity, and assume a new bankaccount field is the sensitive field.

I create the bankaccount field on the account form and show and hide it based on whether the user is in the "Manager" security role (note that determining the security role of a user is covered by other blogs and out of scope for this entry, if anyone needs more information, email me).

Next I create a new entity called bankaccount, and create a 1:N relationship with account. This entity only has one field, "bankaccount". Assign security to this entity so that only users in the "Manager" security role can use it (read, write, create etc) and no one else can see it.

Now, onCreate of an entity, if the bankaccount field is filled in I create a bankaccount record that hangs off the account entity. Also in this plugin I clear the value of the bankaccount field on the account form, so it is essencially empty. Note that you may even put something like "bank account hidden" as the bankaccount in in the plugin.

So now when a user opens this new account and does not have rights to see the bankaccount details, the field is both hidden and empty, so even if they do try and unhide it, it won't show the correct value.

Finally, if a user has rights to see the bank acount, use a crm soap call (also covered on blogs elsewhere, and is similar to retrieving the user role, email me if you need more info) to retrieve the bankaccount from the child record and populate the field accordingly.

Now you could also create an onUpdate plugin to compare the account.bankaccount field with the bankaccount.bankaccount field and update the bankaccount.bankaccount accordingly.

This was rather hard to explain, so feel free to post questions and I'll answer them.

Thanks

Bossie

Showing and hiding fields based on another field

Hi All,

This is not a new topic, but it does creep up in the forums from time to time. I thought it may be easier to write a blog entry on the topic.

So here is the scenario, you have a picklist (or any other field) and you want to show and hide other fields based on this. Let's say your picklist field is called "mypicklist" and you have two other fields, one is a text field called "mytextfield" and one is a lookup called "mylookup". The values in the picklist are "Show Text Field", with a value of 1 and "Show Lookup Field" with a value of 2. You want to show/hide the fields accordingly.

Firstly you need to write the following code in the mypicklist onChange event:

if (crmForm.all.mypicklist.DataValue == 1) //show text field
{
//hide the lookup
crmForm.all.mylookup.style.display = 'none';
crmForm.all.mylookup_c.style.display = 'none'; //note the _c
crmForm.all.mylookup_d.style.display = 'none'; //note the _d, only required for lookups

//show the text field
crmForm.all.mytextfield.style.display = 'inline';
crmForm.all.mytextfield_c.style.display = 'inline'; //note the _c
}
else if (crmForm.all.mypicklist.DataValue == 2) //show loookup
{
//hide the lookup
crmForm.all.mylookup.style.display = 'inline';
crmForm.all.mylookup_c.style.display = 'inline'; //note the _c
crmForm.all.mylookup_d.style.display = 'inline'; //note the _d, only required for lookups

//show the text field
crmForm.all.mytextfield.style.display = 'none';
crmForm.all.mytextfield_c.style.display = 'none'; //note the _c
}
else // hide all
{
//hide the lookup crmForm.all.mylookup.style.display = 'none';
crmForm.all.mylookup_c.style.display = 'none'; //note the _c
crmForm.all.mylookup_d.style.display = 'none'; //note the _d, only required for lookups

//show the text field
crmForm.all.mytextfield.style.display = 'none';
crmForm.all.mytextfield_c.style.display = 'none'; //note the _c
}

As you can see, each field has two (three for lookups) sections that has to be hidden, the first section is identified by the field schema name and represents the textbox area. The second, represented by the fieldname following by an "_c" represents the label area. Lookups also has an additional area, replresented by the fieldname followed by an "_d" which represents the lookup button. Each of these sections needs to be shown/hidden individually.

The second part is ensuring these are hidden/shown after they are saved, so the exact same code above needs to be placed in the form load event too. It may also make your life easier to create a global function in the onload event and then call this function from both within the onload event and the picklist onchange event. Something like:

ShowHideField = function()
{
//all the above code goes in here
}

// then call the above in both the onload and the relevent onchange event
ShowHideField();

The above goes for most field types and you can also show or hide fields based on whether they contain data or not with the following:

if (crmForm.all.mypicklist.DataValue != null) //show text field
{
...
}

Hope this helps

Bossie

Clearing a value from a DynamicEntity object

Hi all,

This was by no means something I discovered myself, Patrick Verbeeten suggested this as a solution to a problem I had in the forums. I thought it would be a good idea to pass on the information though.

Lets say you have a DynamicEntity object and you need to clear one of the values in a plugin, for example the parentid of a contact. Normally, to add an attribute to a DynamicEntity you would use the entity.Properties.Add(...) method, but the problem is that CRM only processes values that has a value.

What I tried initially was to remove the value using the entity.Properties.Remove(attributename) method. This did delete the attribute, but on saving the DynamicEntity, it did not save this attribute to the server but instead left it the way it was.

What Patrick suggested was to use the null value coupled with each crm attribute type, example CrmDateTime.Null or CrmNumber.Null. So what I did was to add the null value to the PropertyBag and set the acctual value to null.

entity.Properties.Add(new CrmDateTimeProperty(CrmDateTime.Null));

What is very important here is that each attribute type has it's own Null value, you cannot interchange CrmDateTime.Null and CrmNumber.Null.

The only exception to this seems to be a string type attribute, you only need to assign the value as an empty string "". Note that you may also be able to use the String.Empty method, I have not tried this yes but would say that this should also work.

Thanks

Paul Reyneke

Decrypting the Soap Exceptions thrown by CRM 4.0

I know this has been covered a million times before, but for those new to CRM, here's how to get around the unhelpful soap exception "Server was unable to process request".

Make sure you catch the soap exception, not just the standard System.Exception, this will open up an object called Details that has a property called InnerText. This will give you some more information surrounding the actual cause of the exception. But make sure you catch the System.Exception too, just in case.

So:

try
{
...
}
catch (System.Web.Services.Protocols.SoapException ex)
{
throw new InvalidPluginExecutionException(ex.Message+", "+ex.Detail.InnerText);
}
catch (System.Exception ex)
{
throw new InvalidPluginExecutionException(ex.Message);
}

Have fun,
Bossie

Steps to isolate why a plugin is not firing

Hi,

This list is more for myself, but other people may benefit from it too. I am compiling a list of steps to go through if a plugin is not firing. This really only covers problems with your assembly being loaded, if the plugin does actually execute some of your code then this will not help you. This list will grow in time as more common pitfalls are uncovered. So check back regularly.

1. Is the assembly signed?

2. Does the assembly reference an external assembly (perhaps an assembly that stores all your common code)? If this is the case, the 2 (or more) assemblies needs to be merged using IL Merge. George wrote an extensive explanation of this here http://crm.georged.id.au/post/2008/02/22/Packaging-plugins.aspx.

3. In the plugin registration tool, did you misspell the step message and entity?

4. Are you trying to reference a pre-image on Create or a post-image on Delete? Neither of these will be accessible and your plugin will fail before it even tries to execute any code.

5. Did you install the assembly to disk? If so you need to make sure you copy the assembly to the assembly\bin directory. The assembly gets loaded from this location every time it is initialized if it is installed to disk.

6. Is this crm server an upgrade form CRM3 to CRM4 or are you still using CRM3 style callouts? It seems that old style callouts get called before plugins, so ensure that there are not any failing callouts in the assembly\bin\callout.config file.

That's it for now, more to follow

Thanks
Bossie

Pre and Post Images

Hi all,

I am probably stating the obvious here, but it does seem to be a recurring theme accross the forums, so I decided to post this.

When the plugin action is a Create then you can only have a Post Image because Pre Image does not exist.

When the plugin action is a Delete then you can only have a Pre Image because the Post Image does not exist.

If you try to use a Pre Image on Create or a Post Image on Delete the plugin will fail before it even reaches your code.

In all the rest you should be able to have both the Pre and Post Images available.

Thanks

Bossie

crmForm.SetFieldReqLevel throws error when label got renamed

Hi All,

I came accross an interesting little problem today that took me a while to figure out. This happens in CRM4, but I am fairly sure the same will happen in CRM3.

I have a lookup field to contact called nzi_clientid with a label of Client, I want to rename it to Contact under certain conditions but leave it as Client under other other conditions.

To rename a field on a form has been documented online as:
crmForm.all.nzi_clientid_c.innerText = "Client";

The problem is that if you rename the field using this method, the well documented way to make a field required (crmForm.SetFieldReqLevel("nzi_clientid", 1)) does not work, and it throws an error, "Object doesn't support this property or method".

I had to delve into the html to see what was happening. It turns out that using the above method to rename the field label overwrites more than the label. Before the rename the innerHTML looks like this:

<TD class=" ms-crm-Field-Normal" id="nzi_clientid_c" title="Client" style="DISPLAY: inline">
<LABEL for="nzi_clientid">
Client<img style="DISPLAY: none" alt="Required" src="http://localhost:5555/_imgs/frm_required.gif" />
</LABEL></TD>

The rename replaces this entire xml section with the new name e.g. "Contact". We don't want this because the crmForm.SetFieldReqLevel cannot find the field any longer because the LABEL node has been overwritten and replaced with "Contact".

<TD class=" ms-crm-Field-Normal" id="nzi_clientid_c" title="Client" style="DISPLAY: inline">
Contact
</TD>

Two ways to fix this is to either to a text replace of the word "Client" in the innerHTML and replace it with "Contact", but this is more than the one or two lines and makes it too complicated.

Second way is to overwrite the firstChild with the new label "Contact". This will mean that the original LABEL node still exists, but the img that shows whether the field is required or not, is gone, even though the field is technically still required. Since I analyse the field right after this and set whether it is required or not, this is not an issue for me.


crmForm.all.nzi_clientid_c.firstChild.innerText = "Client";
if (isRequired)
{
crmForm.SetFieldReqLevel("nzi_clientid", 1)
}
else
{
crmForm.SetFieldReqLevel("nzi_clientid", 0)
}