SecuritySuite - SuiteCRM and CE Teams

Hello Mark, hooking up custom modules takes a bit of work. If using the Premium version, which is for sale on this site, you use the Hookup admin tool found in the Security Suite admin panel on the Admin page. This creates the correct relationship (creating a relationship in Studio does not work for this). If using the free, basic version this needs to be hand coded. How to do this is in this pdf: http://www.sugarforge.org/frs/download.php/6477/SecuritySuite_Documentation_2.1.pdf. Make sure to not copy/paste that code as you may get some junk characters.

This doc tells how to manually create the relationships. I used your "Hookup Module" admin tool instead. Everything else seems to work. When I view the details of my custom module, I can select security groups for the record, and the mass update panel is there on the list view.

But when I view the details of the security group itself, I cannot select any custom modules items for it.

My MetaData.php file looks like this:

pdi_dealerships_securitygroups_1MetaData.php <?php // created: 2013-08-24 11:07:10 $dictionary["pdi_dealerships_securitygroups_1"] = array ( 'true_relationship_type' => 'many-to-many', 'from_studio' => true, 'relationships' => array ( 'pdi_dealerships_securitygroups_1' => array ( 'lhs_module' => 'SecurityGroups', 'lhs_table' => 'securitygroups', 'lhs_key' => 'id', 'rhs_module' => 'PDI_Dealerships', 'rhs_table' => 'pdi_dealerships', 'rhs_key' => 'id', 'relationship_type' => 'many-to-many', 'join_table' => 'securitygroups_records', 'join_key_lhs' => 'securitygroup_id', 'join_key_rhs' => 'record_id', 'relationship_role_column' => 'module', 'relationship_role_column_value' => 'PDI_Dealerships', ), ), );

In the code below $rhs->$rhsLinkName is empty. Should there be a call to load_relationship first?

Also, why does the code call addBean twice?

public function add($lhs, $rhs, $additionalFields = array()) { $lhsLinkName = $this->lhsLink; $rhsLinkName = $this->rhsLink;

    /* BEGIN - SECURITY GROUPS */
    //Need to hijack this as security groups will not contain a link on the module side
    //due to the way the module works. Plus it would remove the relative ease of adding custom module support

    if(get_class($rhs) != 'User' && get_class($rhs) != 'ACLRole' && get_class($lhs) == 'SecurityGroup') {
        $rhs->$rhsLinkName->addBean($lhs);          

This appears to fix it:

    if(get_class($rhs) != 'User' && get_class($rhs) != 'ACLRole' && get_class($lhs) == 'SecurityGroup') {
      //MDR: bug fix
      $rhs->load_relationship($rhsLinkName);
        $rhs->$rhsLinkName->addBean($lhs);          
        $this->callBeforeAdd($rhs, $lhs, $rhsLinkName);

        $dataToInsert = $this->getRowToInsert($lhs, $rhs, $additionalFields);
        $this->addRow($dataToInsert);
        $rhs->$rhsLinkName->addBean($lhs);
        $this->callAfterAdd($lhs, $rhs, $lhsLinkName);
    } else if(get_class($lhs) != 'User' && get_class($lhs) != 'ACLRole' && get_class($rhs) == 'SecurityGroup') {
      //MDR: bug fix
      $lhs->load_relationship($lhsLinkName);
        $lhs->$lhsLinkName->addBean($rhs);          
        $this->callBeforeAdd($lhs, $rhs, $lhsLinkName);

        $dataToInsert = $this->getRowToInsert($lhs, $rhs, $additionalFields);
        $this->addRow($dataToInsert);
        $lhs->$lhsLinkName->addBean($rhs);
        $this->callAfterAdd($rhs, $lhs, $rhsLinkName);
    } else {

This might be refactored a bit better

    $lhsLinkName = $this->lhsLink;
    $rhsLinkName = $this->rhsLink;

    if (empty($lhs->$lhsLinkName) && !$lhs->load_relationship($lhsLinkName))
    {
        $lhsClass = get_class($lhs);
        $GLOBALS['log']->fatal("could not load LHS $lhsLinkName in $lhsClass");
        return false;
    }
    if (empty($rhs->$rhsLinkName) && !$rhs->load_relationship($rhsLinkName))
    {
        $rhsClass = get_class($rhs);
        $GLOBALS['log']->fatal("could not load RHS $rhsLinkName in $rhsClass");
        return false;
    }

    /* BEGIN - SECURITY GROUPS */
    //Need to hijack this as security groups will not contain a link on the module side
    //due to the way the module works. Plus it would remove the relative ease of adding custom module support

    if(get_class($rhs) != 'User' && get_class($rhs) != 'ACLRole' && get_class($lhs) == 'SecurityGroup') {
        $rhs->$rhsLinkName->addBean($lhs);          
        $this->callBeforeAdd($rhs, $lhs, $rhsLinkName);

        $dataToInsert = $this->getRowToInsert($lhs, $rhs, $additionalFields);
        $this->addRow($dataToInsert);
        $rhs->$rhsLinkName->addBean($lhs);
        $this->callAfterAdd($lhs, $rhs, $lhsLinkName);
    } else if(get_class($lhs) != 'User' && get_class($lhs) != 'ACLRole' && get_class($rhs) == 'SecurityGroup') {
        $lhs->$lhsLinkName->addBean($rhs);          
        $this->callBeforeAdd($lhs, $rhs, $lhsLinkName);

        $dataToInsert = $this->getRowToInsert($lhs, $rhs, $additionalFields);
        $this->addRow($dataToInsert);
        $lhs->$lhsLinkName->addBean($rhs);
        $this->callAfterAdd($rhs, $lhs, $rhsLinkName);
    } else {
    /* END - SECURITY GROUPS */


        $lhs->$lhsLinkName->addBean($rhs);
        $rhs->$rhsLinkName->addBean($lhs);

        $this->callBeforeAdd($lhs, $rhs, $lhsLinkName);
        $this->callBeforeAdd($rhs, $lhs, $rhsLinkName);

    //Many to many has no additional logic, so just add a new row to the table and notify the beans.
    $dataToInsert = $this->getRowToInsert($lhs, $rhs, $additionalFields);

    $this->addRow($dataToInsert);

    if ($this->self_referencing)
        $this->addSelfReferencing($lhs, $rhs, $additionalFields);

        $lhs->$lhsLinkName->addBean($rhs);
        $rhs->$rhsLinkName->addBean($lhs);

        $this->callAfterAdd($lhs, $rhs, $lhsLinkName);
        $this->callAfterAdd($rhs, $lhs, $rhsLinkName);

    /* BEGIN - SECURITY GROUPS */
    } //end normal 
    /* END - SECURITY GROUPS */

    return true;

Ok this buys me one free question:

I understand Roles as ways to determine a users access rights to entire modules in mostly a subtractive way. If a user has 2 roles, then they get the most restrictive access to a given module.

I understand Groups as a way to control access to individual objects.

So a User U in Role R and in Groups G can access A an object in module M if both of these are true: 1) R grants access A on module M 2) the object in M belongs to one of the groups in G

Is that right?

Now I have no idea what it means to add a Role to a Group.

Does it mean that every member of the Group is restricted to the role? What happens when we show the detail view of the User, and see his/her roles? Can we delete the role that was implicitly added via the group? Does the role even appear.

Why can we add Roles to Groups? What function does it serve. Sorry to be thick but I just don't get it yet.

Very cool, so I can use groups to manage roles. This may come in very handy for us. We anticipate having lots of users in little fiefdoms. These fiefdoms have sub-fiefdoms in small hierarchies, but the top-level fiefdoms are orthogonal -- unrelated.

This presents a problem for us -- I would like to delegate the administration of roles, groups and users to each top-level fiefdom. But unfortunately, when they try to select which users to add to their groups the selection list will be overwhelmed with users from other fiefdoms that they do not even know, and worse yet, may have similar names.

Have you considered adding "Realms"?