Does anyone know if there is a way to delete Dynamics365 systemuser via API?
If I look at: https://learn.microsoft.com/en-us/powerapps/developer/common-data-service/reference/entities/systemuser - I don't see delete action described.
Also, if I run api/data/v9.1/systemusers(11111111-1111-1111-111-111111111111) - PATCH works fine and changes user properties, but if I use DELETE, it says:
The 'Delete' method does not support entities of type 'systemuser'.
Is there a way to delete systemuser via API?
Thanks in advance
The idea behind this is that user record is so important that D365 disallows anybody to delete them. And this approach has reasons. For example what would be with audit records, modified by or created by lookups, etc.
The most sensible substitute of delete would be to reassign all records from user, remove all roles and disable user (set isdisabled).
If you are using on-premise and brave enough, you can delete it directly from DB. But I wouldn't ever do it.
Related
I'm fairly new to Amplify and been playing around with it for a couple of weeks now. I've been incorporating it into Next.js, which is pretty nice.
I originally created a new User table/record using lambda function: after a user signs up and confirms their email, it should automatically create a new record in the User table with some information. I only did this because I thought Amplify only provided a few attributes, but until recently I found out that you can pretty much create custom attributes.
So, because of this, would there be an argument to create another User table? I would like to know how people are handling User information in big applications.
I guess one thing I can think of is making relationships with other tables. I haven't gone too far into figuring this out, but is it possible to still make connections if I don't have User table in my graphql schema?
Yes I have the same issue and was thinking to have a Users table where I enable owner authorization. This Owner-based authorization allows you to tie a data record to a user. Owners can read, create, update, and delete the record.
Allow the owner to perform these operations on their own records:
Create
Read
Update
Delete
We have two types of accounts in our company. One user type (type1) are the one that we create manually via an internal UI. Now we want to give the possibility to clients to register themselves from a public UI (type2).
We would like to activate the registration process for users of "type2" and disable it for users of "type1". Is it possible to control it somehow?
Thanks!
Edit:
I've discovered this REST API function:
https://host/parse/verificationEmailRequest
But unfortunately, it does not work for my use case. Any other idea?
So it seems that there is no such option on parse-server but as #Davi Macedo posted it's possible to hook on the beforeSave trigger of the user and sent the verified flag to true. What I did, instead, is to check on the email adapter what kind of user request to send email and block when the user is of "type1". Maybe the solution from #Davi Macedo is more elegant but also the second one was working fine for me for now. Thanks a lot for helping out!
I am trying to use the ServiceNow API for the first time and I need to get a list of all the users in the sys_user table with all of their available fields/attributes like date created, updated etc.
I tried GET request to this URI:
https://myinstance.service-now.com/api/now/table/sys_user
But the response only returns the Users and some of their attributes but not all of the ones I can see in the portal.
What is the correct URI to make the REST call to get all users and their fields/attributes?
I'm assuming you want to access SN API from another application? Cause if you want to do that from within SN, there is the GlideRecord server API you can use.
Now when you access the table API from external source, you do that through a registered user - depending on this user and their roles, you might see all or only some of the user attributes. Also, if you add specific Query Parameters to your request like sysparm_query or sysparm_fields, this will limit what you get.
ACLs (Access Control Lists) is the mechanism in ServiceNow restricting access to Table API. So I would encourage you to check there. Perhaps you will need to create a technical user with sufficient roles to access the data you need.
Also the REST API Explorer which is found in SN Navigator can be of help to quickly test your table queries.
Hope that helps a bit!
In general table api returns all the columns associated to the table unless until if you have specified the specific column list in sysparam_fields, can you please try in post man or try the same api call from rest api explorer in Servicenow to understand the behavior. H
Ok, so imagine a bank has a call-centre filled with low-trust staff. The staff need to provide basic service to customers over the phone. The call centre staff take calls from a customer, ask them certain security questions, and then service the accounts in some way.
Now, from the customer's point of view, the bank is verifying who they are by asking the security questions. This is subtly different from the bank's point of view: It is verifying that the call centre employee is talking to the customer.
Why is this difference important? The bank wants to restrict these low trust staff, so they cannot view any details of the accounts until the customer calls them. So a call centre employee can't browse account details of customers that haven't just contacted him and asked for service.
So the question is:
Is this sort of setup possible in Dynamics CRM 2011? How would one go about implementing it? Some level of customization would be OK, but a bespoke application driven from the CRM data is not.
I'm thinking that maybe it's possible to create a custom component that temporarily modifies the user's permissions to a record (and all its children) after answering some security questions. However, I'm not even sure that record-based security (beyond Ownership) is supported in CRM...? I guess one could temporarily assign ownership to the user. Is that wise?
Please note: Simply hiding views & find buttons from the GUI isn't the sort of level of security we're looking for here. We're looking to literally restrict the user from accesing the records in question.
I can see a couple of options:
Working within the permissions model. This could work. You could have access restricted by default, and then have another entity where you'd enter in the account details, a plugin would run and verify the details, and then share the record to the current user. I'd be a little concerned, however, on how the unsharing would work. What would trigger it? Would there be a process that just runs outside of CRM and unshares records periodically. What if that process fails? We've also had performance issues in the past with this type of model... CRM seems to do a lot of work under the hood every time an individual record's permissions are changed like this.
Reassigning the owner, as you suggest. Would multiple users ever need to look at the same data? Does the owner of the record need to be maintained for any other reason (e.g. This is Joe's account because he's the owner).
Working exclusively with plugins. You could have a plugin registered on Retrieve and RetrieveMultiple of a record. This plugin could filter out all the details you want to hide from the end user. When the user needs to view the rest of the data, they fill out a form or dialog or something with the data. This data is then included in the Retrieve call for the record. The plugin checks for the hidden data, verifies that it's there and correct, then strips it out and lets the request continue, only this time it retrieves all attributes, and the form populates as expected.
Disclaimer: this answer is based on plenty of CRM 4.0 experience and reading the release notes for 2011.
Short answer: no.
Long answer: yes, but the customisation would be major. The 'easiest' option that springs to mind, is that the authentication process is carried out as a bespoke asp.net page that either a) uses a service account to re-assign an entity to an individual and then returns them to the relevant CRM form, then a plug in that re-assigns it back on saving changes
or
b) has it's own set of forms to that update and retrieve information as a service account, and only do so after answering the security questions.
As an aside, any kind of 'scripted' form is almost impossible in CRM 4.0. I believe 2011 slightly improves on that, but what I've seen is still not encouraging. Using CRM in a contact centre for us has meant investing in a piece of third party form building software and creating bespoke forms that can be launched from CRM and return data via the web services (which are impressively flexible). We only use the CRM interface for viewing historic requests - even most updates trigger one of the bespoke forms.
If I was to implement such a scenario I would create a customer access record (new_custaccess) that is linked to the customer record (new_customer). For this example - keeping it simple - I'm going to assume that the customer has a simple access code they must provide before the bank employee (Operator) can access the record. The access code is stored on new_custaccess in a field (new_secretcode).
Security is that the Operator has no privileges to new_customer and read/update privileges to new_custaccess.
There is a single field (new_secretcodeoperator) on new_custaccess that the operator can update. All other fields are restricted from update (and, if appropriate, read) to the Operator.
When the Customer calls and the Operator searches for the appropriate new_custaccess record. Once they locate the record they enter the Customer provided secret code into the field new_secretcode and do a save.
A Pre-Update query executes on new_custaccess in the context of a user with full privileges (call it MASTER, for fun here.) That plug-in checks to see if the provided code matches the secret code. If it doesn't it throws an error and the Operator can retry. If it does match the plug-in strips the field new_secretcodeoperator from the record, to keep it from saving the value. It also shares appropriate permission on the record new_customer to the appropriate operator.
The Operator now has access to the Customer record (you'll have to decide whether to cascade permissions or share on each record - that decision is beyond this discussion.)
We now need to deal with rescinding permission on the Customer record. I would handle this by having an entity new_customeraccess that is generated by the previous plug-in whenever access is granted to a Customer record. A workflow should be triggered on Create of new_customeraccess that cause new_customeraccess to be updated every 20 minutes (or whatever time the client prefers.)
A plugin is registered on Update of new_customeraccess that fires when the field updated by the workflow is modified. This plug-in will determine - via whatever criteria is decided on by the business - whether to continue sharing or revoke sharing.
I would also create some javascript/html based pop-up from the new_customer ribbon to end sharing by updating a field on new_customeraccess. Provide the Operator with limited Update privs on new_customeraccess via field level security.
This should accomplish what you want without going outside the standard CRM customization model. Not exactly sure of where you draw the line on bespoke but this is probably as close as you'll get to OOTB. A few plug-ins are all the C# you'll need. And the only JavaScript will be for usability, not functionality.
Let me know if you have questions.
Let us say I have multiple users. They all have items linked to their account. They can CRUD those items.
What is the best way to prevent users from manipulating items from each other.
At first I thought the antiforgerytoken would help. But it does not because when the users look at their control panel they get a valid token. So they could just open firebug and do some post requests to delete items.
While writing this I think I know what I should do. I guess I should just check on the server if the user is deleting his items.
Did I forget anything which would still make it possible to adjust each other's items?
The only way to be sure is to check on the server that the current user has permission to "do action"
You can use the "Roles" mechanizm (this feature ships with asp.net) to check whether a user can delete other accounts.