# Perspective View Security

**URL:** <https://forum.inductiveautomation.com/t/perspective-view-security/42157>\
**Category:** Ignition\
**Tags:** perspective, ignition80\
**Created:** [January 12, 2021, 12:20pm UTC](https://forum.inductiveautomation.com/t/perspective-view-security/42157 "2021-01-12T12:20:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\
**Post date:** [January 12, 2021, 12:20pm UTC](https://forum.inductiveautomation.com/t/perspective-view-security/42157/1 "2021-01-12T12:20:03Z")

</div>

I haven’t done much with the new Security in v8 yet, but I have some questions:

How would I lock down particular Views based on user role(s) and/or IP address, both disabling access altogether and also providing view-only (no control actions)?

I understand that for filtering by IP I would use Security Zones in order to assign particular client IPs or hostname to a particular zone.  
I also understand that I can disable all access to a View by using the View security permissions (can select user roles and/or security zones here).

What I don’t understand is how I can provide view-only access based on the client Security Zone and the user role? As well as this, what if I also wanted to provide control to certain components only?  
In Vision, each component has its own security settings, but I can’t find a security panel in Perspective. I could bind each active component’s enabled property to the various session auth props, but I don’t know if this is best practice. It’s also a major pain as there’s no expression function that can check if a key is within a dictionary (e.g. like the `containsAny` or `containsAll` expression functions that are available _only_ within the Security Level Rules or User Attribute Mapping [https://docs.inductiveautomation.com/display/DOC80/containsAny](https://docs.inductiveautomation.com/display/DOC80/containsAny). It would be useful if these functions were available outside of these two locations as well)

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![cmallonee](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmallonee/32/6416_2.png) [@cmallonee](https://forum.inductiveautomation.com/u/cmallonee)\
**Post date:** [January 12, 2021, 4:34pm UTC](https://forum.inductiveautomation.com/t/perspective-view-security/42157/2 "2021-01-12T16:34:24Z")

</div>

The View-wide Security is all or none, so you can only specify that users may or may not see a View within View Security Settings. Within the View, you can set security for individual components via bindings on the `enabled` property of inputs, or in the case of Script Actions you can actually select Security Levels which must be met to execute the script.

As a component being disabled does not actually prevent Events from occurring, I recommend using Script Actions anywhere possible. For example: You could disable a button component, but the onClick Event will still occur. The only Event which will not occur if a component is disabled is the onActionPerformed Event.

---

<div class="post-metadata">

**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\
**Post date:** [January 12, 2021, 7:45pm UTC](https://forum.inductiveautomation.com/t/perspective-view-security/42157/3 "2021-01-12T19:45:47Z")

</div>

Cheers, I thought this would be the case. For the enabled expressions, what exactly would you use to check if the client is part of the right security zone? Would you bind to the session auth securityzones property and use a scripting transform to check if the property contains the zone they need? Or is there a way to do it without a script? I haven’t checked yet, hut otherwise, is there a direct scripting function that will check the security zones?

---

<div class="post-metadata">

**Author:** ![cmallonee](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmallonee/32/6416_2.png) [@cmallonee](https://forum.inductiveautomation.com/u/cmallonee)\
**Post date:** [January 12, 2021, 10:37pm UTC](https://forum.inductiveautomation.com/t/perspective-view-security/42157/4 "2021-01-12T22:37:53Z")

</div>

I would make a security level _based off of_ security zones, and use the `isAuthorized` expression:

```auto
isAuthorized(true, "Authenticated/Roles/QA")

```

More [here](https://docs.inductiveautomation.com/display/DOC81/isAuthorized).

---

<div class="post-metadata">

**Author:** ![OscarLucas](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/oscarlucas/32/6417_2.png) [@OscarLucas](https://forum.inductiveautomation.com/u/OscarLucas)\
**Post date:** [March 1, 2021, 7:50am UTC](https://forum.inductiveautomation.com/t/perspective-view-security/42157/5 "2021-03-01T07:50:41Z")

</div>

Hi, I am trying to hide views to certain roles.  
Should i use security zones too?  
Is there a way to do something similar to what I am trying?

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/f/3f79bee4ac478b34b400a52aad92e7e97de5ff9a.png)

---

<div class="post-metadata">

**Author:** ![cmallonee](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmallonee/32/6416_2.png) [@cmallonee](https://forum.inductiveautomation.com/u/cmallonee)\
**Post date:** [March 1, 2021, 3:46pm UTC](https://forum.inductiveautomation.com/t/perspective-view-security/42157/6 "2021-03-01T15:46:48Z")

</div>

If you look at the [documentation](https://docs.inductiveautomation.com/display/DOC81/containsAny) for that expression, it is only available for Security Level Rules and IdP User Attribute Mapping. You could bind against the `session.props.auth.user.roles` property, but you would then need to run i through a transform:

 ![Screen Shot 2021-03-01 at 7.46.28AM](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/6/160bbd53c8a075baa4f8f08ec60e6efada0faedb.png)

---

<div class="post-metadata">

**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\
**Post date:** [March 2, 2021, 8:18am UTC](https://forum.inductiveautomation.com/t/perspective-view-security/42157/7 "2021-03-02T08:18:20Z")

</div>

I would tend to use an expression over a script transform, as I believe they are better for performance. It’s a bit uglier though…  
`try(hasRole('Administrator', {session.props.security.auth.userName}, 'default')) `

That session prop is off the top of my head and could be slightly wrong…

Actually, I changed to using a variation of this and instead defined these all in session params and I just check the value of the relevant session param:

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/a/ea842778f9f099629951a5987869471712b556a5.png)

```auto
try(
	hasRole('Maintenance'
		,{this.props.auth.user.userName}
		,'default')
	,False)

```

Then in a component I use:  
`{session.custom.security.roles.maintenance}`

It would be nice if the session.props roles would present as a dictionary rather than a list…