This video shows how to add security to an app in App Engine Studio, UI Builder, and Catalog Builder.
When you build an app in App Engine Studio, or AES, there are several ways you can add security.
First, within AES you can create roles to control access to table records and database operations,...
... as well as workspace and portal experiences.
After access has been granted to a role,...
... all the groups and users assigned to the role receive that access.
Roles can contain other roles, and the higher-level role inherits access granted to any roles it contains.
Second, when you edit these experiences in AES, they open in UI Builder.
There you can add audiences to control which page variant each audience sees,...
... and conditions to control when pages appear.
And finally, you can control access to catalog items you build in AES using the Access controls in Catalog Builder.
Now let’s look at our use case.
In our previous video, we built an app in AES for loaning artwork between offices.
In AES, you create roles to control who has access to your app.
These roles appear in the Security section.
We previously created a new role for artwork requestors.
Let’s edit this role to see if we need to update it.
The first step is to decide which experiences users with this role can access.
Because the workspace is for users fulfilling artwork requests,...
... we want users with the artwork requestor role to access only the portal, so we select the portal.
Now we need to specify which table records and database operations to grant to this role.
In the artwork inventory table, we want requestors to review the records without making any changes,...
... so we leave Read selected and clear the other options.
Requestors need to create records in the Artwork requests table when they submit requests,...
... so here we select Create.
We’re done making changes, so we save the role and close it.
Now let’s add a role for the workspace users.
If we had an existing role that was already assigned to the same set of users we want to target for our application,...
we could use that.
But for our example no such role exists, so we’ll build a new role.
This role is for fulfillers to take care of artwork requests,...
... so we call it “artwork fulfiller” and provide a description.
We want users with this role to manage the artwork requests table,...
... so we select all the access controls.
They also need read access to the source table, in this case, the artwork inventory table...
... to be able to see the fields in the request that come from that table.
And they need access to the workspace experience, so we select it here.
We click Continue, and the role is added to our app.
Finally, we want to add a role for managing the artwork inventory.
Users with this role will have full access to the Artwork inventory table.
And this role needs access to the workspace, where we have an inventory list page set up.
After we submit our application, we’ll need an administrator to assign the roles to groups and users.
Now let’s look at controlling how pages show up for different audiences within an app experience by using the audiences feature.
You specify one or more roles required for an audience to have access to a page variant.
You can also set up multiple audiences and prioritize the order that the page is displayed to each audience.
For our example, we created an inventory list page in the workspace specifically for our inventory managers.
Now let’s edit the audiences for the page.
When we click Add audience, we can select an existing audience, or create a new one.
We’ll create a new audience for users with the artwork inventory managers role we just created.
And we add the audience to our page variant.
So although both fulfillers and inventory managers can access the workspace,...
... only inventory managers can access this page.
We could add more, but this is the only audience we need.
Now let’s look at adding conditions to a page to determine when the page is displayed.
For our example, the page will appear only if there are artwork items available for loan.
If you have multiple page variants with the same conditions,...
... you can specify the priority for the page variants to be displayed by setting the Order field...
... the lower the number, the higher the priority.
So, which page variant will users see?
They’ll see the first variant that the conditions and audience allow.
If you don’t assign an audience to a page variant, then everyone who has access to the Now experience can view it if the conditions are met, sorted by order.
Now let’s see how to control access to catalog items.
Here’s a catalog item we built previously.
On the Access tab, we can select user criteria to grant or deny access to it.
Finally, be sure to test your roles, audiences, and conditions before making your app available to users.
You can do this by setting up fake users and using the impersonate feature.
You can also set up automated testing in the Automated Test Framework, or ATF.
For more information, see our product documentation or knowledge base.
Or ask a question in the ServiceNow Community.