User Access Controlling — GSoC 2021 Week 6
Confidentiality is one of the main things that have to be considered when developing applications. Basically, it means controlling access based on the needs to know. In OpenMRS, we use privileges and roles to control access to data within the system. Privileges define what can or cannot be done in the system, while roles are used to group privileges into more manageable groupings. To make the system easier to manage, roles can contain other roles as well as privileges. Roles inherit all the privileges of their parent roles.
We wanted to add a better user access controlling system to the DHIS Connector Module. Previously In my project proposal, I suggested using 3 privileges for the module. Those were View_Data, Push_Data, and Import_Export. But after few discussions, I thought it’ll be better to have a privilege called Manage_Metadata instead of Import_Export privilege.
But later I recognized that most of the OpenMRS modules use privileges for each simple operation in the module. That method helps to create customized roles with any combination of the privileges. So I decided to use that method and proposed the following privileges.
* View Connection — Viewing DHIS2 Connection
* Manage Connection — Edit DHIS2 Connection
* View Location Mappings — View location-orgunit mappings
* Manage Location Mappings — Edit/Delete location-orgunit mappings
* View Automation — View scheduled mappings
* Run Automation — Run scheduled mappings
* Manage Automation — Add/Edit/Delete scheduled mappings
* Run Reports — Base privilege for running the reports
* Run failed data — Base privilege for pushing the failed data
* Manage Mappings — Create/Edit Mappings
* Import and Export — Import and export mappings and DHIS2 APIAfter creating the privileges, we can update the pages and options of the module to display according to the user privileges. Also, the backend endpoints can be updated to work according to the privileges. Then we can create roles with the combinations of these privileges.
Basics of using privileges in OpenMRS
In openmrs modules, privileges can be created by simply adding them to the config.xml of the module.
<privilege>
<name>View Connection</name>
<description>
Ability to view configured DHIS2 connection
</description>
</privilege>Then page content can be displayed according to the privileges by using <openmrs:hasPrivilege> tag.
<openmrs:hasPrivilege privilege="View Hidden Text">
Lorem Ipsum - This will be only show to the users with
"View Hidden Text" Privilege
</openmrs:hasPrivilege>When it comes to APIs, @Authorized Annotation can be used to restrict access to the service methods and endpoints.
@Authorized ({"View Users"})
public void getUsersByName(String name); More details and use cases can be found in this documentation.
I created issues for this user access control system and started implementing the feature. And tested the thing which can be done using those privileges. In Addition, the Pull requests for upgraded run reports UI and supporting some period types were merged during the week. We had our first evaluation too and I was able to pass the evaluation. That’s how the 6th week of GSoC coding period went. Next week I want to continue working on the user access control system, as well as the final part of the location mapping feature.
