SmartBox Data Access Overview

To use SmartBox Data Access in your environment the following is required:

• Microsoft SQL Server 2016 Service Pack 1 or Microsoft SQL Azure.
• To create, enable, disable and delete policies, you must be a member of the Security Administrators role in Roles section of K2 Management. The Security Administrators role is a built-in system role that manages SmartBox Data Access policies.

A Data Access policy provides access at the database level so when a user, group or role is a member of a policy, they can view the data of a SmartBox SmartObject in a K2 application such as a form at runtime.

When creating a policy on a SmartBox SmartObject in K2 Management, two options are available:

• Full Data Access: Users, groups and roles can access all data of SmartBox SmartObjects. See the Understanding Full Data Access topic for more information.
• Limited Data Access: Users, groups and roles can access a subset of the data in a SmartBox SmartObject, based on what values they are assigned. See the Understanding Limited Data Access topic for more information.

Full Data Access

The Full Data Access option allows users, groups and roles to have access to all data in a SmartBox SmartObject at runtime. To a create policy with Full Data Access see the Data Access topic for more information.

For the purpose of an example, the Global Human Resources Director must have access to view data on all regions and countries in which their employees reside. Dennis, the Global Human Resources Director needs to be able to view all data from the Region and Country SmartBox SmartObjects at runtime. To achieve this, Dennis needs to part of a Data Access Policy which has Full Data Access on the Region and Country SmartBox SmartObjects.

Adding Dennis to Full Data Access sections in the policies for Region and Country SmartBox SmartObjects allows him to see all data contained in the Region and Country SmartBox SmartObjects.

Limited Data Access

The Limited Data Access option allows users, groups and roles to access a subset of data in SmartBox SmartObjects. To a create policy with Limited Data Access see the Data Access topic for more information.

There are two options available in the Limited Access section:

• Default: Select this option to restrict access to properties of the current SmartBox SmartObject. Select a SmartBox SmartObject and then a Primary display property. You can also set a Secondary display property. Display properties are only used in the Limited Access policy dialogs to make it easier for you to understand clearly which record you are assigning permissions on.
• Choose SmartBox object: Select this option to populate a list of associated SmartBox SmartObjects. Select a SmartBox SmartObject and then a Primary and or Secondary property(ies).
• The properties you choose on the associated SmartObject must be a key or a number. Text-based properties are allowed but can lead to errors. See the Considerations section below for more information

After you choose an option, in this case Choose SmartBox object and the Region association, you must specify at least a primary property to populate the Limited Access section, and you can click the Display Properties... link to change your selection after you click Select on this dialog.

You can add users, groups and roles to the selected SmartBox SmartObject properties. Once users, groups and roles are added to properties, only those users, roles and groups can see the data of the assigned property values.

As shown above, Bob is added to the record in the Region SmartBox SmartObject that has the name of Americas. This means that only Bob can see countries in the Americas region.

Use the following information and guidance to determine how to use Data Access on SmartBox SmartObjects. Also see the Considerations section below for more details and known issues.

• The SmartObject is open until you add data access security, and then the data can only be accessed by those who are part of the policy.
• You must include the K2 Package and Deployment role, which is added by default, to every SmartObject you secure if you want to be able to create packages that include the data in those SmartObjects as part of the deployment.
• The Everyone role is added by default, but typically you want to remove this role immediately and add another role (such as this custom one, Headquarters) as shown in the following image:
  
• If you do not remove the Everyone role, configuring limited data access has no effect because all authenticated users receive access to all data.
• If you do not have Full Access and you are trying to configure Limited Access, you will see a No Data Found message as in the following image:
  
• If you need to limit records to a particular item contained in an association, such as limiting the list of Countries to a particular Region, configure limited data access security on the Country SmartObject by choosing the Region SmartObject. A Country can have only one Region, but a Region can have many Countries.
• If you further wanted to limit the list of regions by user, group or role, you would configure limited data access on the Region SmartObject (Default: Region) and typically configure the same users, groups and roles for particular regions that you did for your Country SmartObject.
• To remove a limited data access policy, click None and confirm to delete it. Alternatively, you can disable the policy if you want to remove it temporarily.
• You must create a policy and enable it for it to take effect. Any changes to a policy are applied immediately.

• If you are a member of the Data Administrators role you have full access to all data, irrespective of the settings in SmartBox Data Access policies.
• You can only apply a SmartBox Data Access policy to basic SmartBox SmartObjects.
• You can not apply a policy to Composite and Advanced SmartBox SmartObjects.
• You can apply only one policy per SmartBox SmartObject.
• You can apply a Limited Access policy to SmartBoxes with One to Many or Many to One associations, but not Many to Many.
• If a SmartObject has a limited data access policy defined, and someone tries to save data for a record that they do not have access rights to, they receive an error “Violation of PRIMARY KEY Constraint [name]. Cannot insert duplicate key in object [ObjectName]…”. While the error message does not clearly describe the cause of the error, this is expected behavior since users should not be able to save data for records that they do not have access to.
• When someone tries to delete a record that is being used to secure data in another record, they receive an error “The DELETE statement conflicted with the REFERENCE constraint [ConstraintName]. The conflict occurred in database “K2”…”. To address the issue, you must remove the Data Access Policy entry for SmartBox record that is being used by the policy, and then delete the record.
• You may not be able to create a Data Access Policy on a SmartBox object that has two or more key properties. When you attempt to define a policy on a SmartBox SmartObject with two or more key properties, you may encounter an error “Error executing compiled Sql from Policy Compiler GenerateSetSecuredBy method”.
• When you attempt delete a SmartBox object that has a policy, you may encounter an error “SmartObject Server Exception: Error: The SmartBox Object [SmartObjectName] is part of an existing policy”. This error occurs when a data access policy is applied to a SmartBox SmartObject and someone tries to delete the SmartObject. To delete the SmartObject, you must disable the policy first, and then delete the SmartObject.
• If someone is viewing data for a SmartBox Object in a list view, and you implement a policy that prevents them from seeing the data while they still have the view open, they get an error when they re-load the list view for the first time. The error says “Binding for the non-schema bound security predicate on object [ObjectName] failed with one or more errors…”. This issue only happens in a Microsoft SQL Server 2016 environment where SQL Server Service Pack 1 or later is not installed. You can either ignore the error and refresh the list, or you can install the service pack to avoid this error message.
• When you attempt to setup a policy on SmartBox Objects that have associations with non-unique keys, you receive the error: Error converting data type nvarchar to bigint. Error converting data type nvarchar to bigint. To resolve this issue, bind the SmartObject association to a property that is a number or unique key.