Odd hasRole behavior firing off more than expected in a client tag?

Ignition
1

Using 8.1.47.

Had a situation where I setup client tags like isAdmin isOperator isViewer where I made expressions like

//in designer
{[System]Client/System/SystemsFlag=1 || 
//or actual check
(hasRole({[.]rolesPrefix}+'admin', {[System]Client/User/Username}), {[System]Client/System/UserSource}) && {[.]../EffectiveUserName}!='')

where rolesPrefix is just a string constant used since this is relating to a AD User source and this project will be on different plants with differnet prefixes. [.]../EffectiveUserName is just checking if the username matches the autologin user (via a client tag that is a hardcoded string) by if({[.]isLoggedIn, {[System]Client/User/Username}, '') where isLogged in is just the comparison to the string constant tag.

When we were developing this initially we had issues with some slowness and the hasRole and I fixed that by changing the AD Connection referral policy to ignore and that was sufficient then.

Now the computers on site and it is suffering the same issues with the same policy still in place so its a legitimate connection latency issue. What I don't understand is its happening while users are still logged in, or even if the auto user is just logged in. I would have expected hasRole to only execute on any user change but i was getting WatchDogEDT's every 2-3 minutes and some really bad freezing.

I fixed by changing hasRole({[.]rolesPrefix}+'admin', {[System]Client/User/Username}) to indexOf({[System]Client/User/RolesString, {[.]rolesPrefix}+'admin')>-1 and the issue is completely gone now.

I am just confused. Why was the hasRole constantly executing outside of user login/logouts? This expected behvaior to check if roles changed ont he AD side? Though then why doesn't the RolesString method suffer from the same issue.

2

I've never had that issue, but did have an issue with the AD logins causing the EDT watchdog error so I changed over to using an asynchronous login now and that problem went away.

For hasRole I use the short version with just the role name. I do like your idea of the prefix and may try it out today to simplify setting that up per site. The only thing I do to trigger the tag to re-evaluate is check if the username is not blank after an && so that it always evaluates as true but triggers on every login.

3

Yea this was my second idea to try I was just trying to avoid scripting if I didn't need it. Right I just don't get why my expression was re-triggering so often. I guess maybe some other part of it is causing this, and hasRole reaches out to the AD directly while indexOf / RolesString is only updated on login. But I don't see why. I can't imagine the SystemFlag is changing at all within the vision client, and my other parts of the expression just string comparing the current username to hardcoded autoloign username. I guess I could write a tag change script to log any changes and I could probably figure it out but its working now and is on site so I don't want to go through that.

This isn't an ongoing problem so nothing urgent but I do dislike not understanding why it was not working as expected before.

4

Amusingly, I thought I remembered something like this but it was the exact inverse problem; hasRole not firing often enough:

Nothing code-wise has changed in between, especially not in 8.1, so I can't really explain it. If you send a report in to support they'd probably investigate further.

5

I did see that post and it was where I got the indexOf solution. I too also have a user source with a failover, though my primary is the AD and the failover is a database one. Yea I will send some information over. Thanks!