Checking User Roles in Dynamics 365: Two Approaches

In Dynamics 365, there are multiple ways to determine if a user has a specific role. This is particularly useful for controlling access to certain features or areas of the system. In this article, we'll explore two primary methods to check user roles:

1. Using Client-Side API (userSettings.roles)
2. Using a Web API FetchXML Query

1. Client-Side API Method (userSettings.roles)

The first approach to check if a user has a specific role is to use the client-side API via Xrm.Utility.getGlobalContext().userSettings.roles. This is a simpler method as it utilizes the roles that are cached on the client-side and can be easily accessed without making additional requests to the server.

Here's a basic example:

function comm_CheckUserHasRole_Client(targetRoleName)
{
    let userHasRole = false;
    Xrm.Utility.getGlobalContext().userSettings.roles.forEach(function(role)
    {
        if (role.name.trim().toLowerCase() === targetRoleName.trim().toLowerCase())
        {
            userHasRole = true;
        }
    });
    return userHasRole;
}

Pros:

• Fast and Efficient: Since roles are cached, no additional network requests are needed, making the process faster.
• Simple to Implement: Requires minimal code to check if a role is present.

Cons:

• Data Accuracy: Since this method relies on cached role data, the information may be outdated during certain situations, such as after recent role updates.
• Limited Use: Not suitable when you need the most up-to-date role information immediately after a role change.

2. Web API FetchXML Query Method

To avoid issues related to stale data, you can use the Web API with a FetchXML query to retrieve the latest roles for the user directly from the server. This ensures that the data is always current.

FetchXML Query Example

Here's an example of how you can use the Web API to check user roles with FetchXML:

async function comm_CheckUserHasRole(targetRoleName)
{
    let userId = Xrm.Utility.getGlobalContext().userSettings.userId.replace(/[{}]/g, "");
    let fetchXml =
        `<fetch>
            <entity name="role">
                <attribute name="name" />
                <link-entity name="systemuserroles" from="roleid" to="roleid" intersect="true">
                    <filter>
                        <condition attribute="systemuserid" operator="eq" value="${userId}" />
                    </filter>
                </link-entity>
            </entity>
        </fetch>`;
    try
    {
        let response = await Xrm.WebApi.retrieveMultipleRecords("role", "?fetchXml=" + encodeURIComponent(fetchXml));
        let userHasRole = response.entities.some(role => role.name.trim().toLowerCase() === targetRoleName.trim().toLowerCase());
        return userHasRole;
    }
    catch (error)
    {
        console.error("Error retrieving user roles: ", error);
        return false;
    }
}


OData Request Example
Another approach is to use an OData request to get the roles for a specific user:
function comm_CheckUserHasRole(targetRoleName) {
    return new Promise((resolve, reject) => {
        // Get current user's roles using the correct relationship
        Xrm.WebApi.retrieveMultipleRecords("systemuser", 
            `?$select=systemuserid&$expand=systemuserroles_association($select=name)&$filter=systemuserid eq ${Xrm.Page.context.getUserId()}`)
            .then(function (result) {
                if (result.entities && result.entities.length > 0) {
                    // Extract role names from the result
                    const userRoles = result.entities[0].systemuserroles_association.map(role => {
                        return role.name.toLowerCase();
                    });
                    
                    // Check if the target role exists in user's roles
                    const hasRole = userRoles.includes(targetRoleName.toLowerCase());
                    
                    // Log roles for debugging
                    console.log("User's security roles:", userRoles);
                    console.log("Checking for role:", targetRoleName);
                    console.log("Role found:", hasRole);
                    
                    resolve({
                        hasRole: hasRole,
                        userRoles: userRoles
                    });
                } else {
                    resolve({
                        hasRole: false,
                        userRoles: []
                    });
                }
            })
            .catch(function (error) {
                console.error("Error checking security role:", error.message);
                reject(error);
            });
    });
}

Pros:

• Accurate Data: This method retrieves data directly from the database, ensuring that the role information is always up-to-date.
• Reliability: Avoids any potential inconsistencies due to caching.

Cons:

• Network Request Overhead: Requires a network call to retrieve roles, which can take more time compared to using the client-side cached roles.
• Complexity: Slightly more complex to implement compared to the client-side approach.

Which Method to Use?

• If you need speed and the latest roles aren't critical (e.g., during form load for existing sessions), the Client-Side API is suitable.
• If you need real-time accuracy (e.g., when roles are updated frequently during a session), the FetchXML Web API method is recommended.

Conclusion

Both approaches have their advantages and disadvantages. The client-side method is faster and easier to implement, but it may provide outdated information. The Web API approach ensures accuracy by fetching live data directly from the server but at the cost of additional network overhead. Choose the method based on the scenario and your requirements for accuracy versus performance.