# Reag tag's role and zone (tag with custom AccessRight)

**URL:** <https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192>\
**Category:** Ignition\
**Created:** [October 16, 2018, 5:22pm UTC](https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192 "2018-10-16T17:22:36Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [October 16, 2018, 5:22pm UTC](https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/1 "2018-10-16T17:22:36Z")

</div>

Can we read with some script function the tag’s role and zone (tag with custom AccessRight) ?

- with Ignition 7.9.9 ?
- with Ignition 8.0 ?

---

<div class="post-metadata">

**Author:** ![KathyApplebaum](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kathyapplebaum/32/7261_2.png) [@KathyApplebaum](https://forum.inductiveautomation.com/u/KathyApplebaum)\
**Post date:** [October 16, 2018, 7:58pm UTC](https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/2 "2018-10-16T19:58:46Z")

</div>

I don’t happen to have 7.9 code open, but in 8 there’s a couple of common tag props that will get you what you need, `AccessRights` and `PermissionModel`.

If `AccessRights` is `AccessRightsType.Custom` then the PermissionModel is used. `TagPermissionsModel.getAccessMap()` returns `Map<ZoneRole, Boolean>`. False indicates read-only access for that ZoneRole, True indicates read-write access.

---

<div class="post-metadata">

**Author:** ![Loizel87](https://avatars.discourse-cdn.com/v4/letter/l/91b2a8/32.png) [@Loizel87](https://forum.inductiveautomation.com/u/Loizel87)\
**Post date:** [November 29, 2019, 12:18am UTC](https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/3 "2019-11-29T00:18:23Z")

</div>

I have been able to execute the Tag.AccessRights value of “Custom” however how could can I get the second part of the TagPermissionModel using and expression or is this possible?

Thanks,  
Ign8.0 (Perspective)

---

<div class="post-metadata">

**Author:** ![Sanderd17](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sanderd17/32/8735_2.png) [@Sanderd17](https://forum.inductiveautomation.com/u/Sanderd17)\
**Post date:** [November 29, 2019, 7:06am UTC](https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/4 "2019-11-29T07:06:51Z")

</div>

This is code we use to read the access rights in 7.9 (we don’t use zones, so it only matches the roles).

Note that it is rather slow (we’ve had up to 50 ms per tag). If you want to use it for UI purposes, you should call it async.

```auto
def getTagConfig(tagPath):
	t = system.tag.browseConfiguration(tagPath, False)
	tagConfig = system.util.jsonDecode(t.toJSON())
	
	if len(tagConfig) == 0:
		raise "Cannot read tag %s" % tagPath
	
	return tagConfig[0]

def canWrite(tagPath):
	userRoles = system.security.getRoles()
	try:
		tagConfig = getTagConfig(tagPath)
	except:
		return False
	if "accessRights" not in tagConfig:
		return True # default value in Ignition
	if tagConfig["accessRights"] == "Read_Only":
		return False 
	if "permissionModel" not in tagConfig:
		return False # no permissions defined in custom mode?
	
	permissionModel = tagConfig["permissionModel"]
	for conf in permissionModel:
		if conf["role"] in userRoles and conf["writeAccess"]:
			return True
			
	return False

def canRead(tagPath):
	userRoles = system.security.getRoles()
	try:
		tagConfig = getTagConfig(tagPath)
	except:
		return False
	if "accessRights" not in tagConfig:
		return True # default value in Ignition
	if tagConfig["accessRights"] == "Read_Only":
		return True 
	if "permissionModel" not in tagConfig:
		return False # no permissions defined in custom mode?
	
	permissionModel = tagConfig["permissionModel"]
	for conf in permissionModel:
		if conf["role"] in userRoles:
			return True
			
	return False

```

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [June 10, 2020, 7:21am UTC](https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/5 "2020-06-10T07:21:02Z")

</div>

@KathyApplebaum,

we try to upgrade from **Ignition 8.0.12 to Ignition 8.0.13.**  
TagPermissionsModel is deprecated in 8.0.13…and we have to switch to the new SecurityLevel.

**Pre-8.0.13** , we used some functions to check tag’s permission as for example:

```auto
@KeywordArgs(names = {"tagPath","roles","zones"}, types = {String.class,List.class,List.class})
@ScriptFunction(docBundlePrefix = Constantes.BUNDLE_PREFIX_PERMISSIONS)
public boolean hasReadPermission(PyObject[] pyArgs, String[] keywords) {
	boolean result = false;
	try {
		PyArgumentMap args = PyArgumentMap.interpretPyArgs(pyArgs, keywords, ClientScriptModulePermissions.class, "hasReadPermission");
		String tagPath = (String) args.getArg("tagPath", null);

		List<String> roles = convertToLstString((PyObject)args.getArg("roles",null));
		List<String> zones = convertToLstString((PyObject)args.getArg("zones",null));

		if ((tagPath == null) || (roles == null) || (zones == null)) {
			logger.error("hasReadPermission(): You must provide a tagPath / list of role / list of zone.");
			return false;
		} else {

			TagPath tagPathObj = TagPathParser.parseSafe("default", tagPath);

			List<Property> props = new ArrayList<>();
			props.add(WellKnownTagProps.AccessRights);
			props.add(WellKnownTagProps.PermissionModel);

			List<Object> propsValue = this.tagUtils.readBlockingProps(tagPathObj,props);

			AccessRightsType accessRightsType = (AccessRightsType) propsValue.get(0);
			TagPermissionsModel tagPermissionsModel = (TagPermissionsModel) propsValue.get(1);

			if (accessRightsType == null){
				logger.warn("hasReadPermission(): getTagConfigsAsync returned null for tagPath={}", tagPath);
				return false;
			} else {
				if (accessRightsType == AccessRightsType.Read_Only) {
					result = true;
				} else if (accessRightsType == AccessRightsType.Read_Write) {
					result = true;
				} else if (accessRightsType == AccessRightsType.Custom) {
					TagPermissionsModel.PermissionResult pResult = tagPermissionsModel.hasReadAccess(roles, zones);
					logger.trace("hasReadPermission(): permission [{}:{}] roles: {},zones: {}", tagPath, pResult.toString(), roles, zones);
					if (pResult.equals(TagPermissionsModel.PermissionResult.OK)) {
						result = true;
					} else {
						logger.trace("hasReadPermission(): permission NOK [{}:{}]", tagPath, pResult.toString());
						result = false;
					}
				}
			}
		}
	} catch (Exception e) {
		logger.error("hasReadPermission error : {}", e);
		result = false;
	}
	return result;
}

```

**In 8.0.13** , I suppose we have to use:

```auto
WellKnownTagProps.WritePermissions
WellKnownTagProps.ReadOnly
WellKnownTagProps.ReadPermissions
and com.inductiveautomation.ignition.common.auth.permissions.PermissionsConfig

```

but the I can’t acces to the javadoc with the link:

[http://files.inductiveautomation.com/sdk/javadoc/ignition80/8.0.13/com/inductiveautomation/ignition/common/auth/permissions/PermissionsConfig.html](http://files.inductiveautomation.com/sdk/javadoc/ignition80/8.0.13/com/inductiveautomation/ignition/common/auth/permissions/PermissionsConfig.html)

return:

```auto
<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>02BC0B3B6C7FFCD0</RequestId>
<HostId>RtaupwH4SCG6uOD+pPWU3DvoWq/AXXjnhrfr3PyRpCeVPApphXJY691wlydPDJ1akmjsIRPzIXk=</HostId>
</Error>

```

---

<div class="post-metadata">

**Author:** ![PerryAJ](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/perryaj/32/3281_2.png) [@PerryAJ](https://forum.inductiveautomation.com/u/PerryAJ)\
**Post date:** [June 10, 2020, 5:10pm UTC](https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/6 "2020-06-10T17:10:17Z")

</div>

Thanks for bringing up the access problem! I’m in the process of republishing the 8.0.13 javadocs, should be fixed within the next 10-15 minutes. Please let me know if you continue to see issues after that.

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [June 11, 2020, 11:40am UTC](https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/7 "2020-06-11T11:40:28Z")

</div>

👍 javadoc is ok now.I will be able to dive into the new tag permission api. 🔐

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [June 11, 2020, 12:27pm UTC](https://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/8 "2020-06-11T12:27:09Z")

</div>

@PerryAJ, @KathyApplebaum, @mgross

In a **vision scoped script** , I try to check the tag permission with **Ignition 8.0.13** and the new API

How to use **isAuthorized ???** to check the tag permission against the permission of the client ?  
I suppose I need to obtain the client permission and pass it to Authorized() ???

```auto
from com.inductiveautomation.ignition.common.auth.permissions import PermissionsConfig

path = "[default]path/to/tag.writePermissions"

permission = system.tag.readBlocking([path])[0].value
print permission.isAuthorized()
print type(permission.getSecurityLevels())  

```

```auto
Traceback (most recent call last):
  File "<input>", line 9, in <module>
TypeError: isAuthorized(): expected 1 args; got 0

```