Dynamics CRM javascript get field level security

Question

In a JS script, with Web Api I am getting the value of a particular Entity field, that has field level security. Then I want to show this value in the web resource. How can I detect if the current user has the rights to read that particular field?

Answer 1

The value will only be returned if the user has the appropriate read access through a field security profile. You do thus not need to explicitly check whether the user has rights to read the field.

From Field level security to control access :

The scope of field level security is organization-wide and applies to all data access requests including the following:

• Data access requests from within a client application, such as web browser, mobile client, or Microsoft Dynamics 365 for Outlook.

• Web service calls using the Dynamics 365 Customer Engagement Web Services (for use in plug-ins, custom workflow activities, and custom code)

• Reporting (using Filtered Views)

Answer 2

You can use getUserPrivilege from v9 onwards ( Edit : Guido pointed out the availability of this method in previous CRM versions too).

getUserPrivilege - Returns an object with three Boolean properties corresponding to privileges indicating if the user can create, read or update data values for an attribute. This function is intended for use when Field Level Security modifies a user's privileges for a particular attribute

formContext.getAttribute(arg).getUserPrivilege()

This returns canRead , canUpdate , canCreate bool values, hence you can decide what to do.

Reference

Answer 3

Well, the cause of the problem was very stupid: a problem of cache. The first time, I connected to CRM as administrator, then I disconnected and logged in with fewer privileges, but due to the "power" of cache I was still able to view the field in the web resource. When viewing the form in a private window, the field level security worked inside the web resource. But the strange thing is that in a normal window the field level security worked in the form (the field value was not visible) but it did not work in the web resource.