Dynamics CRM 2011

CRM 2011: PrivilegeDepthMask and AccessRight

Recently I had to write a plugin which only runs for users who can’t create or update certain entity type. In my endeavor, I came across this post about PrivilegeDepthMask and AccessRight. Read more on MSCRM King.

PrivilegeDepthMask

Value Scope
1 Basic (User)
2 Local (Business Unit)
4 Deep (Parent: Child)
8 Global (Organisation)

AccessRight

Value Scope
1 Read
2 Write
4 Append
16 AppendTo
32 Create
65536 Delete
262144 Share
524288 Assign

Cheers – Sy

Advertisements

2 thoughts on “CRM 2011: PrivilegeDepthMask and AccessRight

  1. Using FilteredViews, issues performance CRM: errors timeout

    I have SQL with filteredView

    select ….
    FROM Filteredrsg_documentodecampania doc
    INNER JOIN FilteredTeam equipo on equipo.regardingobjectid=doc.rsg_documentodecampaniaid
    INNER JOIN FilteredTeammembership equiposh on equiposh.teamid=equipo.teamid
    INNER JOIN FilteredSystemuser usersyste on usersyste.systemuserid=equiposh.systemuserid
    INNER JOIN Filteredrsg_mediador med on med.rsg_mediadorid=usersyste.rsg_mediador

    Database partners note:

    Generate many inserts (create functions):

    insert into @t (OwnerId)

    select pem.PrincipalId from PrincipalEntityMap pem WITH (NOLOCK)

    join SystemUserPrincipals sup WITH (NOLOCK)
    on pem.PrincipalId = sup.PrincipalId

    join SystemUserManagerMap summ WITH (NOLOCK)
    on sup.SystemUserId = summ.SystemUserId

    where summ.ParentSystemUserId = @userid
    and pem.ObjectTypeCode = @objecttypecode

    in the SQL Session the messages:

    //– TODO andreism: instead of complex queries MaxPrivilegeDepthMask for read privilege should be precomputed and persist in db
    //– another option is merge SystemUserRoles and TeamRoles into one table, but it’s still one query instead of two create function dbo.fn_GetMaxPrivilegeDepthMask(@ObjectTypeCode int) returns @d table(PrivilegeDepthMask int)
    //– It is by design that we return a table with only one row and column as begin declare @UserId uniqueidentifier select @UserId = dbo.fn_FindUserGuid() declare @t table(depth int)
    //– from user roles insert into @t(depth) select
    //–privilege depth mask = 1(basic) 2(local) 4(deep) and 8(global)
    //– 16(inherited read) 32(inherited local) 64(inherited deep) and 128(inherited global)
    //– do an AND with 0x0F ( =15) to get basic/local/deep/global max(rp.PrivilegeDepthMask % 0x0F) as PrivilegeDepthMask from PrivilegeBase priv join RolePrivileges rp on (rp.PrivilegeId = priv.PrivilegeId) join Role r on (rp.RoleId = r.ParentRootRoleId) join SystemUserRoles ur on (r.RoleId = ur.RoleId and ur.SystemUserId = @UserId) join PrivilegeObjectTypeCodes potc on (potc.PrivilegeId = priv.PrivilegeId) where potc.ObjectTypeCode = @ObjectTypeCode and priv.AccessRight & 0x01 = 1
    //– from user’s teams roles insert into @t(depth) select –privilege depth mask = 1(basic) 2(local) 4(deep) and 8(global)
    //– 16(inherited read) 32(inherited local) 64(inherited deep) and 128(inherited global)
    //– do an AND with 0x0F ( =15) to get basic/local/deep/global max(rp.PrivilegeDepthMask % 0x0F) as PrivilegeDepthMask from PrivilegeBase priv join RolePrivileges rp on (rp.PrivilegeId = priv.PrivilegeId) join Role r on (rp.RoleId = r.ParentRootRoleId) join TeamRoles tr on (r.RoleId = tr.RoleId) join SystemUserPrincipals sup on (sup.PrincipalId = tr.TeamId and sup.SystemUserId = @UserId)
    //join PrivilegeObjectTypeCodes potc on (potc.PrivilegeId = priv.PrivilegeId) where potc.ObjectTypeCode = @ObjectTypeCode and priv.AccessRight & 0x01 = 1 insert into @d select max(depth) from @t return end

    any suggestions?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s