Configure Additional User Permissions in Microsoft Entra ID and Lasernet Core

Lasernet Core uses “security roles” to manage permissions for users. Lasernet Core security roles are bound to app roles in Microsoft Entra ID through Lasernet Core “external roles”. Microsoft Entra ID users and groups can be assigned any number of app roles (that correspond to external roles), thereby enabling granular permission management directly in Microsoft Entra ID.

Note

For more information about Lasernet Core users, groups, and security roles, see Configure Users, Groups, and Security Roles.

The process of binding users to specific permissions requires the following steps:

1. Add an app role to the app registration in Microsoft Entra ID.

2. Assign users and groups to the app role.

3. Add a corresponding external role in Lasernet Config Server.

4. Add and configure a security role in Lasernet Config Server (if necessary).

5. Add the external role to one or more security roles in Lasernet Config Server.

The following sections describe how to complete each stage of this process. The example described in the following sections involves configuring Lasernet Core and Microsoft Entra ID to allow specific users to only edit forms in Lasernet Developer.

Add a New App Role to the Azure App Registration

Follow these steps:

1. Navigate to the app registration for Lasernet Core by going to Azure Portal > Microsoft Entra ID > App registrations.

2. After selecting the app registration, navigate to the App Roles page and click Create app role.

3. Fill in the information as shown.

   Note

   The name you enter into the Value field must match the name that you enter when you later add an external role in Lasernet Config Server.

4. Click Apply.

Assign Users and Groups to the New App Role

Follow these steps:

1. Navigate to Azure Portal > Microsoft Entra ID > Enterprise applications.

2. Use the search function to locate the Lasernet Core enterprise application.

3. Click the Lasernet Core enterprise application to modify it.

4. Click Manage > Users and groups, then click Add user/group.

5. Select the users and groups that you want to allow to edit forms in Lasernet Core.

6. Select the Form Editors role.

7. Click Assign.

Add a New External Role in Lasernet Config Server

The “external role” in Lasernet Core is the glue that binds Azure app roles to Lasernet Core security roles. Every app role you define in the Azure app registration must have a corresponding external role in Lasernet Core. The binding between an Azure app role and a Lasernet Core external role is done by name, so it is important that the Name field of the external role matches the Value field of the corresponding Azure app role.

An external role can be assigned to one or more security roles.

The steps for adding an external role depend on which tool you are using.

Manage

1. Sign in to Manage.

2. In the User Management menu (see 1 in the image below), click External Roles.

   

3. Click New Role (2).

4. Enter a Name and Description for the external role.

   

   Important

   Ensure that Name matches the Value that you entered when you created the app role.

5. Click Confirm.

Lasernet Config Web App

Add a New Security Role in Lasernet Config Server

A security role defines which permissions are granted to its members. Security roles are separated into areas corresponding to the different Lasernet Core applications.

The steps for adding a security role depend on which tool you are using.

Manage

1. In the User Management menu, click Security Roles.

   

2. Click the Config & Developer tab (see 1 in the image below).

3. Click New Role (2).

   

4. Enter a Name and Description for the security role.

   

5. Click Confirm to create the security role.

Lasernet Config Web App

Configure the New Security Role

In this example, the newly created security role must be configured to only allow access to edit forms. The users assigned this role will be able to edit forms, but will be unable to do any tasks in Manage (or the Lasernet Config web app), and will be unable deploy configurations to environments. They will also be unable to access any part of a configuration in the Lasernet Developer other than the forms (in that configuration).

The steps for configuring a security role depend on which tool you are using.

Manage

1. Click the newly added security role.

2. In the Security area of the role editing pane for the Form Editors role:

   • Remove all items from the Administrative Rights list.

   • Remove all items except Forms from the Lasernet Developer list.

3. In the Deployment area, remove all items from the Environment Deployment Access list.

   

4. In the Members area, add Editor.Form to the Security Role Members list.

   

5. Click Confirm.

The users that you selected when you assigned users and groups to the new app role will now be asked for their Microsoft Entra ID credentials when they start Lasernet Developer. After they sign in, they will be able to edit forms.

Lasernet Config Web App