Security Overview

APD provides a comprehensive security framework that controls access to portal features, data, and functionality. This system integrates with Business Central's security model while providing portal-specific access control.

Security Layers

APD security operates at multiple levels:

┌─────────────────────────────────────────────┐
│           Action Security                    │
│    (Which pages can be accessed)            │
├─────────────────────────────────────────────┤
│           Security Profiles                  │
│    (User role-based access)                 │
├─────────────────────────────────────────────┤
│           Security Filters                   │
│    (Row-level data access)                  │
├─────────────────────────────────────────────┤
│           Table Permissions                  │
│    (AJAX operation control)                 │
├─────────────────────────────────────────────┤
│           Field Security                     │
│    (Column-level visibility)                │
└─────────────────────────────────────────────┘

Core Concepts

Authentication

Users log in with credentials stored in APD Users table
Sessions track authenticated state
External authentication (Auth0, Microsoft Entra) supported

Authorization

Security profiles define user roles
Profiles control access to actions and content
Multiple profiles can be assigned to users

Data Security

Security filters limit visible records
Table permissions control AJAX operations
Field-level security controls editable fields

Security Components

1. Security Profiles

Named groups that define access levels:

Profile	Description	Typical Access
ADMIN	Administrators	Full access
MANAGER	Managers	Reports, approvals
SALES	Sales users	Customers, orders
CUSTOMER	External customers	Own data only

See Security Profiles

2. Security Filters

Data-level restrictions based on user context:

Security Filter:
  Table: Sales Header (36)
  Field: Sell-to Customer No. (2)
  Value: %4 (NAV Identification)

This limits customer users to seeing only their own orders.

See Security Filters

3. Table Permissions

Control AJAX operations on tables:

Permission	Description
Allow Ajax Read	Read records via AJAX
Allow Ajax Validate/Modify	Update records via AJAX
Allow Ajax Insert	Create records via AJAX
Allow Ajax Delete	Delete records via AJAX
Allow Ajax Lookup	Open lookup popups
Allow Ajax Insert On Validate	Allow APD_validate to create a new record if none exists

See Security Filters for table permission details.

4. Action Security

Actions can require:

Authentication
Specific security profile
Login action designation

5. Content Security

Content items can be restricted by security profile.

User Types

Portal Users

Stored in APD Users table:

User ID and password
Company assignment
Security profiles
BC entity mapping

User Entity Mapping

Link portal users to BC entities:

User Type	Description
Customer	Maps to Customer table
Vendor	Maps to Vendor table
Contact	Maps to Contact table
Sales Person	Maps to Salesperson/Purchaser

Security in Templates

Profile-Based Content

<?profile(ADMIN)?>
    <a href="<?action(ADMIN)?>">Admin Panel</a>
<?endif?>

Authentication Checks

<?auth?>
    <p>Welcome, <?userid?>!</p>
<?else?>
    <a href="<?action(LOGIN)?>">Login</a>
<?endif?>

Entity-Specific Data

<?filter("Sales Header","Sell-to Customer No.",no())?>

Security Setup Workflow

1. Define Profiles

Create security profiles for each user role:

Open Security Profiles
Create profiles (ADMIN, CUSTOMER, etc.)

2. Configure Filters

Set up data restrictions:

Open Security Setup
Add Security Filter entries
Define table/field/value rules

3. Set Table Permissions

Control AJAX access:

Add Table Permissions entries
Enable appropriate operations
Apply to specific profiles

4. Configure Actions

Set action-level security:

Set Require Authentication
Assign Security Profile
Mark Login Action

5. Create Users

Add portal users:

Open APD Users
Create user accounts
Assign security profiles

Security Best Practices

Defense in Depth

Apply security at multiple levels:

Require authentication on actions
Apply security profiles
Set security filters on data
Control AJAX permissions

Principle of Least Privilege

Start with minimal access
Add permissions as needed
Use specific profiles, not generic

Secure Defaults

New actions require authentication by default
Security filters should be restrictive
AJAX permissions should be explicit

Regular Audits

Review user access periodically
Check security filter effectiveness
Test profile restrictions

External Authentication

APD supports external identity providers:

Auth0

Integrate with Auth0 tenant
SSO capabilities
Social login support

Microsoft Entra ID

Azure AD integration
Enterprise SSO
B2C support

See External Authentication

Security Troubleshooting

User Can't Access Page

Check authentication requirement
Verify user has required profile
Check action security profile setting

User Sees Too Much Data

Review security filters
Check filter value placeholders
Verify profile assignment

AJAX Operations Fail

Check table permissions
Verify profile in table permission
Review action code restrictions