# New Tag Permissions Model based on Security Levels **URL:** \ **Category:** Ignition Early Access\ **Created:** [May 8, 2020, 1:50am UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558 "2020-05-08T01:50:54Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [May 8, 2020, 1:50am UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/1 "2020-05-08T01:50:54Z")
The 5/8/2020 Nightly Release of Ignition 8.0.13 introduces an overhaul to Tag Security. The primary goal of this overhaul was to get the Tag Permissions model to start using Security Levels, a powerful new hierarchical permissions model introduced in Ignition 8 and previously only used in Perspective. This overhaul is also an important step to make as we transition other parts of Ignition to use Identity Providers and Security Levels. Some of the changes you will see: - The Security property set of a tag has 3 options: - A new configuration screen for Read and Write permissions which resembles the Perspective permissions configuration experience: - Any existing Tag Security will be migrated to the functional equivalent in the new model on upgrade. The same goes for tag imports from previous versions. We hope that the changes benefit you and we welcome all feedback. If you do find an issue that you feel needs addressed, please let us know. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [May 8, 2020, 3:59pm UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/2 "2020-05-08T15:59:05Z")
---
**Author:** ![Sanderd17](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sanderd17/32/8735_2.png) [@Sanderd17](https://forum.inductiveautomation.com/u/Sanderd17)\ **Post date:** [June 19, 2020, 12:45pm UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/3 "2020-06-19T12:45:07Z")
I’m trying to port my old function for determining whether a tag is readable or writable to Ignition 8 (see [Role-based tag permission vs client visualisation](http://forum.inductiveautomation.com/t/role-based-tag-permission-vs-client-visualisation/29988)) The permissions model seems a lot more complicated though (deeper nested JSON, or-ed and and-ed together). Would there be an easier way to check if the current user is able to read or write a tag? Or is there something coming to bind enabled/editable/visible/… properties to tag readability? Like a special expression perhaps? It seems like a lot of work to get it right with all special cases, if that functionality could be added in one of the next versions. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [June 19, 2020, 2:15pm UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/4 "2020-06-19T14:15:44Z")
+1 I have same needs. I have converted all my generated udt with the new tag permission format for Ignition 8.0.13+ For checking if write operation is authorized for a tag with scripting, you will had to read the tag properties **writePermissions and readOnly** and use something ugly like that to obtain roles and compare it to the logged user roles... ```auto def getRoleFromTagPermission(permission): """ Example : "writePermissions": { "type": "AnyOf", "securityLevels": [ { "name": "Authenticated", "children": [ { "name": "Roles", "children": [ { "name": "BIL_param", "children": [] }, { "name": "GTC_visu", "children": [] } ] } ] } "readPermissions": { "type": "AnyOf", "securityLevels": [] } """ global strLib strFct="getRoleFromTagPermission" try: result = [] if ((permission != None) and (permission != "")): # #if type(permission)==AnyOfPermissionsConfig: json = permission.toJsonTree() if json != None: if "securityLevels" in json: securityLevels = json["securityLevels"] if securityLevels != None: if len(securityLevels)>0: roles = securityLevels[0]["children"][0]["children"] for role in roles: result.append(role["name"]) except: shared.commun.logger.logERROR(strFct=strFct,strLib=strLib,strLog="GTC_Tag") return result ``` @jspecht If there is a way to obtain the securitylevels of the user, there is an isAuthorized function to check the permission. > [@Reag tag's role and zone (tag with custom AccessRight)](http://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/6): > > Thanks for bringing up the access problem! I’m in the process of republishing the 8.0.13 javadocs, should be fixed within the next 10-15 minutes. Please let me know if you continue to see issues after that. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [June 19, 2020, 6:18pm UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/5 "2020-06-19T18:18:18Z")
This works for me in Perspective: ```auto from com.inductiveautomation.ignition.common import TypeUtilities from com.inductiveautomation.ignition.common.auth.security.level import SecurityLevelConfig from com.inductiveautomation.ignition.common.auth.permissions import PermissionsConfig securityLevelsProp = self.session.props.auth.securityLevels securityLevels = [] for securityLevel in securityLevelsProp: securityLevels.append(SecurityLevelConfig.fromJsonTree(TypeUtilities.pyToGson(securityLevel))) securityLevels = SecurityLevelConfig.merge(securityLevels) print securityLevels readPermissions = system.tag.readBlocking(['[default]LongExprTag.readPermissions'])[0].value writePermissions = system.tag.readBlocking(['[default]LongExprTag.writePermissions'])[0].value isReadOnly = system.tag.readBlocking(['[default]LongExprTag.readOnly'])[0].value print readPermissions print writePermissions print isReadOnly hasReadPermissions = readPermissions.isAuthorized(securityLevels) hasWritePermissions = writePermissions.isAuthorized(securityLevels) print hasReadPermissions print hasWritePermissions ``` output: ```auto INFO | jvm 1 | 2020/06/19 11:20:03 | [{"name":"Authenticated","children":[{"name":"Roles","children":[{"name":"Administrator","children":[]}]}]}, {"name":"SecurityZones","children":[]}] INFO | jvm 1 | 2020/06/19 11:20:03 | {"type":"AllOf","securityLevels":[]} INFO | jvm 1 | 2020/06/19 11:20:03 | {"type":"AllOf","securityLevels":[{"name":"Authenticated","children":[]},{"name":"Foo","children":[{"name":"Bar","children":[{"name":"Baz","children":[]}]}]}]} INFO | jvm 1 | 2020/06/19 11:20:03 | False INFO | jvm 1 | 2020/06/19 11:20:03 | True INFO | jvm 1 | 2020/06/19 11:20:03 | False ``` Granted it’s not very straightforward. I’ll see what we can do to improve this. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [June 19, 2020, 6:29pm UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/6 "2020-06-19T18:29:11Z")
Thanks a lot, but for **Vision** , how to obtain the **securityLevels** of the logged-in user ? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [June 19, 2020, 6:52pm UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/7 "2020-06-19T18:52:27Z")
Assuming you have a list of the current vision user’s roles and zones, you could do something like this: ```auto roles = ["Administrator", "Operator"] zones = ["ZoneA", "ZoneB"] securityLevelPaths = [] for role in roles: securityLevelPaths.append(["Authenticated", "Roles", role]) for zone in zones: securityLevelPaths.append(["SecurityZones", zone]) securityLevels = SecurityLevelConfig.fromPaths(securityLevelPaths) ``` At this point, you have securityLevels, so checking permissions would be like the first example I gave above. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [June 19, 2020, 7:02pm UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/8 "2020-06-19T19:02:18Z")
Perfect 👍 If we don’t use security zones, we can skip ? ```auto securityLevelPaths.append(["SecurityZones", zone]) ``` ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [June 19, 2020, 7:04pm UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/9 "2020-06-19T19:04:09Z")
Yes you can skip the security zones, but if your permissions require a specific security zone, isAuthorized() will return `false`. Edit: if you do not provide a SecurityZones node or if you do provide it but it has no children, we assume the user falls back to the “Default” security zone. So if your permissions does require the “Default” zone then it could return `true` as long as the other security levels are satisfied in the permissions.