Tips on Extensible Data Security in AX 2012

Recently, I had chance to work on Extensible Data Security and noticed few things which can be very helpful, they are posted below.

1. XDS can hurt performance sometimes if query is not designed well. In order to design security without hurting the performance, always try to reduce number of joins in your Security Policy Query.
2. If your requirement is complex and needs to add some dynamic filters to the query. In that case you can create a temporary table with type TEMPDB and override its xds() method to fill the table dynamically. This method can be considered for performance improvements as it would reduce query joins. For this, please see xds method on the table MyLegalEntitiesForXDS
3. If you have to disable XDS, consider following 2 methods
1. Create a view and fetch data from that view. View is a different object for XDS framework, thus the security applied on the table will not be considered for view and you will see the data.
2. Second method to disable the security is mentioned here in my other post.

AX 2012 Disable/ByPass extensible data security (XDS) through code

Extensible Data Security or XDS is a framework introduced in AX 2012 to apply security on data. We had RLS or Record Level Security in AX 2009. However, XDS is completely a new framework with more capabilities in order to apply data security. This post is about disabling or bypassing the XDS using code. For more details about XDS, download a whitepaper provided by Microsoft using following link.

http://www.microsoft.com/en-us/download/details.aspx?id=3110

Disabling/Bypassing XDS or Extensible Data Security:

Recently, I had a requirement to restrict users from viewing all the Warehouses available and they must be able to see only the Warehouses they belong to. I designed a new security policy and it started working very easily without much problem. However, the problem was on Inventory Transfer From where we have two fields for Warehouses:

1. From warehouse and
2. To warehouse

Our requirement was to restrict only From warehouse and To warehouse MUST show all the warehouses available so they can issue inventory to any warehouse but should not be allowed to issue inventory from the warehouse they don't belong to. In order to achieve this, I had to disable the XDS on To Warehouse lookup method. I did override the lookup() method on To Warehouse field on the datasource and below is the code which I wrote to disable the XDS.

public void lookup(FormControl _formControl, str _filterStr)

{

    XDSServices                      xXDS = new XDSServices();

    xXDS.setXDSState(0); // Disable XDS

    super(_formControl, _filterStr);

    xXDS.setXDSState(1); // Enable XDS

}