Skip to main content
M
Michail1-Visitor
1-Visitor
January 11, 2018
Question

Is it possible to disable SQUEAL for external users?

  • January 11, 2018
  • 13 replies
  • 5650 views

Somebody posted this question previously, however, it is still valid today.

In order to implement a simple 'change your password' feature, a user must have associated visibility under a particular organisational unit which he/she must be a member of. A curious user can modify url to something like 'https://myapp.twx.com/ThingWorx/Users' and see the list of ALL users corresponding to that organisational unit.

I'd be grateful for your help. Thanks.

13 replies

R
rnayak-25-Regular Member
5-Regular Member
January 11, 2018

A User should not be able to see other Users unless you have given the visibility access at the collection level. In your case what might be happening is that the new user is in 'Everyone' Org which has some default visibility set at collection level. Therefore you are able to see all the users. Can you go to Everyone Org and remove 'Users' group from there and try this again !

M
Michail1-VisitorAuthor
1-Visitor
January 12, 2018

Raghu Nayak​, I removed 'Users' user group from 'Everyone' organisation some time ago in order to implement granular visibility as suggested in ThingWorx documentation. There is no associated user or user group in 'Users', 'User Groups' collections. Service invoke is enabled via override.

From the code below, one can conclude that in order to change his/hers password, a user must be 'see' his own user entity. For that to happen, an entity must have a 'Visibility' set to a particular organisational unit. A user must be a member of that organisational unit.

Thus, it is logical to assume that if a user is a member of an organisational unit and other users have visibility set to that organisational unit, he/she would be able to get a list of all users linked to that organisational unit. Surely, there must be a better way.

var params = {
     newPasswordConfirm: newPasswordConfirm /* STRING */,
     oldPassword: oldPassword /* STRING */,
     newPassword: newPassword /* STRING */
};
// no return
Users[userName].ChangePassword(params);
R
rnayak-25-Regular Member
5-Regular Member
January 12, 2018

ok now I understand what you are trying achieve clearly. It is true that for user to take any action in terms running a service or updating property, 1st thing required is visibility which you assign by Organization (group of users or user groups). But you dont have to assign visibility to that same organization unless you have a use case that requires it!

From your example, it looks like you want the user to change his password using a mashup that triggers this password change service correct ? If yes then all you need is create this service on Thing (lets a generic thing that has this password change service) assign the visibility of this Thing to the Org that contains all the Users who will have this password change functionality and then in the 'Runtime Permission' just provide this service execute capability to that user group.

By default each User is owner of his own entity (and user name is one of them). So when the User open this mashup and clicks the button to change the password he should be able to do so as he is changing his own entity. This is possible without having visibility access to Org or User group that he belongs to.  Try the above approach and let me know if it works for you! thanks

P
posipova20-Turquoise
20-Turquoise
January 26, 2018

Can you just upgrade to 8.1 where squeal is no longer existing?

Terms & ConditionsAccessibility statement