# Location Based Access Control - v0.1.0 Released **URL:** \ **Category:** Development\ **Tags:** community, gsoc2018\ **Created:** [August 16, 2018, 4:13pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525 "2018-08-16T16:13:53Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![suthagar23](https://talk.openmrs.org/user_avatar/talk.openmrs.org/suthagar23/32/6342_2.png) [@suthagar23](https://talk.openmrs.org/u/suthagar23)\ **Post date:** [August 16, 2018, 4:13pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/1 "2018-08-16T16:13:53Z")
## Location Based Access Control - v0.1.0 Released * * * Hi every one, I am very happy to announce that the first version of the Location Based Access control module has been released!. You can download and install the module from these resources, - AddOns - [OpenMRS Add Ons](https://addons.openmrs.org/show/org.openmrs.module.locationbasedaccess) - Bintray - [Service End for Bintray, JCenter, GoCenter, and ChartCenter | JFrog](https://bintray.com/openmrs/omod/locationbasedaccess/0.1.0) Deployment Steps for the Location based access control module can be found here : [https://wiki.openmrs.org/display/docs/Location+Based+Access+Control+-+Deployment+Steps](https://wiki.openmrs.org/display/docs/Location+Based+Access+Control+-+Deployment+Steps) The tickets information for this release can be found on the JIRA project here: [Jira - OpenMRS Issues](https://issues.openmrs.org/browse/LBAC) I would like to request the community to download and test this module and give your feedback which is the most wanted requirement for now 😄. Please feel free to post your feedback and comments about the module, and any suggestions or ideas to be added into this module. ## What is Location Based Access Control? * * * Currently, OpenMRS has user privileges based access control. So the user needs to have the required privilege to access some of the OpenMRS service. Anyway, OpenMRS doesn’t have any proper location control for their services. Even anyone from any location can access the stored data(eg: Patients information, Encounters, etc)in the OpenMRS. Actually, still, they haven’t concerned about the location management inside the OpenMRS. But we should prepare the OpenMRS to support the access control based on the locations. It will add more value to the data security also and accessibility also. Like the privileges based access control, we decided to implement a Location based Access control system for the OpenMRS. It will manage the access to all services based on the locations. Some implementations want to register the users and patients (the persons also) in certain selected locations. Then access them based on the location that someone has logged in. That way, if someone is logged in a certain location, they should see only those encounters, observations, and patients registered in that location. Anyway, the user who has multiple locations access (like Admin in our privilege based access control system) should be able to see patients in all locations. We can allocate multiple locations access to the System Developer or System administrator. I think you can simply understand the concept by these images, ![Design](https://talk.openmrs.org/uploads/default/original/2X/f/f15dba595dc22a29a07bebefd136dcc6251c87dc.jpg) ![Design (1)](https://talk.openmrs.org/uploads/default/original/2X/e/eaab8c981b3896cb2d64f9ecef418f328af6bb56.png) ## How to use Location Based Access Control module? * * * Major features from this module are, - All Patient, Person, and User objects are restricted by the locations. A user from a location can’t get the patient/person/user information from another location. - Able to assign/edit the locations to the patient during the registration through the patient dashboard. - Able to assign/edit the accessible location to the users through the Manage Account Page (In User section). - Users can log in with only their credentials (username and password). There will be no need to select the locations from the login. - Encounters and Observations are restricted by the locations to see only the information which belongs to the user logged in location. * * * Cc : @dkayiwa ---
**Author:** ![darius](https://talk.openmrs.org/user_avatar/talk.openmrs.org/darius/32/8082_2.png) [@darius](https://talk.openmrs.org/u/darius)\ **Post date:** [August 17, 2018, 12:24am UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/2 "2018-08-17T00:24:50Z")
Exciting! 🙂 Does this work at the API level, or at the UI level? e.g. how thorough is the protection? Can I find patients I’m not supposed to be able to see via REST? Or if someone emails me the URL of the dashboard of a patient I shouldn’t be able to see, can I click the link and see them? What’s the performance implication of using this module once you have 10k or 100k patients? ---
**Author:** ![suthagar23](https://talk.openmrs.org/user_avatar/talk.openmrs.org/suthagar23/32/6342_2.png) [@suthagar23](https://talk.openmrs.org/u/suthagar23)\ **Post date:** [August 17, 2018, 4:16am UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/3 "2018-08-17T04:16:30Z")
> [@darius](#): > > Does this work at the API level, or at the UI level? e.g. how thorough is the protection? Can I find patients I’m not supposed to be able to see via REST? Or if someone emails me the URL of the dashboard of a patient I shouldn’t be able to see, can I click the link and see them? It works on the API level. We implemented this protection using the AOP techniques which track the OpenMRS services in the API level. Eg : If we think about the PatientService, the LBAC module will track each `get*` methods (`getPatient()`, `getPatients()`, …). So when someone tries to access these objects from the API level, it will check the accessible locations of the authenticated user and will restrict by the locations. So, - You can’t get the patients objects which belong to other locations through the Patient Service - Thus you can’t get it through any UI levels or views - Thus you can’t get it through REST services and Data Exports (Reports and Cohorts need some work for the restrictions, and we are waiting for the feedback to start work on those) > Or if someone emails me the URL of the dashboard of a patient I shouldn’t be able to see, can I click the link and see them? You can use that link or patientId to get the patient information from the system, only if you have the access to that location. If you haven’t the access to that location, then you can’t 🙂 > What’s the performance implication of using this module once you have 10k or 100k patients? Still we haven’t estimated the performance for these scanerios. We will do it in the next phase and add improvements to the module as well 🙂 ---
**Author:** ![nourudeen](https://talk.openmrs.org/letter_avatar/nourudeen/32/5_5575768a8748004e209b776fc1b2916d.png) [@nourudeen](https://talk.openmrs.org/u/nourudeen)\ **Post date:** [December 19, 2018, 7:40am UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/4 "2018-12-19T07:40:10Z")
Have successfully installed the module but I can’t see any location tab in the manage account dash. Using refapp 2.8. How do I use it? ---
**Author:** ![dkayiwa](https://talk.openmrs.org/user_avatar/talk.openmrs.org/dkayiwa/32/179_2.png) [@dkayiwa](https://talk.openmrs.org/u/dkayiwa)\ **Post date:** [December 19, 2018, 9:33am UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/5 "2018-12-19T09:33:04Z")
@nourudeen are you following the instructions here? [https://wiki.openmrs.org/display/docs/Location+Based+Access+Control+-+Deployment+Steps](https://wiki.openmrs.org/display/docs/Location+Based+Access+Control+-+Deployment+Steps) cc @suthagar23 ---
**Author:** ![nourudeen](https://talk.openmrs.org/letter_avatar/nourudeen/32/5_5575768a8748004e209b776fc1b2916d.png) [@nourudeen](https://talk.openmrs.org/u/nourudeen)\ **Post date:** [December 19, 2018, 3:53pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/6 "2018-12-19T15:53:22Z")
Yes. Probably its because I did not upgrade the refapp module to 2.9. Just built it and will retry again. ---
**Author:** ![nourudeen](https://talk.openmrs.org/letter_avatar/nourudeen/32/5_5575768a8748004e209b776fc1b2916d.png) [@nourudeen](https://talk.openmrs.org/u/nourudeen)\ **Post date:** [December 19, 2018, 4:01pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/7 "2018-12-19T16:01:45Z")
Used the latest of all the needed modules. But now experiencing a new issue. At login, there is no location selector but then I put my credentials, instead of logging in, it shows the username and password again but with the location selector. In user accounts, still no option of location. ---
**Author:** ![suthagar23](https://talk.openmrs.org/user_avatar/talk.openmrs.org/suthagar23/32/6342_2.png) [@suthagar23](https://talk.openmrs.org/u/suthagar23)\ **Post date:** [December 19, 2018, 11:52pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/8 "2018-12-19T23:52:07Z")
Have you check this - [https://addons.openmrs.org/show/org.openmrs.module.uiframework](https://addons.openmrs.org/show/org.openmrs.module.uiframework) . Or you can use **Manage modules** feature in the Ref Application to search and download the modules (Check [here](https://demo.openmrs.org/openmrs/owa/SystemAdministration/index.html#/view-search-module-details/org.openmrs.module.uiframework)). I think, you have missed to update the modules required by this module. Please make sure about the required versions and configuration steps. ---
**Author:** ![nourudeen](https://talk.openmrs.org/letter_avatar/nourudeen/32/5_5575768a8748004e209b776fc1b2916d.png) [@nourudeen](https://talk.openmrs.org/u/nourudeen)\ **Post date:** [December 20, 2018, 8:16am UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/9 "2018-12-20T08:16:17Z")
@dkayiwa I am having trouble with a particular step. After copying the custom definition, the step 6 is confusing. Which UUID you referring to? ---
**Author:** ![suthagar23](https://talk.openmrs.org/user_avatar/talk.openmrs.org/suthagar23/32/6342_2.png) [@suthagar23](https://talk.openmrs.org/u/suthagar23)\ **Post date:** [December 20, 2018, 8:42am UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/10 "2018-12-20T08:42:44Z")
That is the uuid of the person attribute which is used to for location property. You can follow that path(in step6) to get this uuid from your system. ---
**Author:** ![nourudeen](https://talk.openmrs.org/letter_avatar/nourudeen/32/5_5575768a8748004e209b776fc1b2916d.png) [@nourudeen](https://talk.openmrs.org/u/nourudeen)\ **Post date:** [December 20, 2018, 3:31pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/11 "2018-12-20T15:31:20Z")
Let me get this right…if I choose any person attribute eg mothers name, copy the UUID of the attribute, I am to replace the UUID of locationAttribute I created earlier which also has its own UUID? Whats the use of this person attribute in location selector? Am very confused. ---
**Author:** ![nourudeen](https://talk.openmrs.org/letter_avatar/nourudeen/32/5_5575768a8748004e209b776fc1b2916d.png) [@nourudeen](https://talk.openmrs.org/u/nourudeen)\ **Post date:** [December 20, 2018, 4:14pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/12 "2018-12-20T16:14:18Z")
Thank you guys. I finally did it. It works. Though I see I cannot assign location to an already existing user only for new user. But well it works. Thanks again @suthagar and dkayiwa ---
**Author:** ![suthagar23](https://talk.openmrs.org/user_avatar/talk.openmrs.org/suthagar23/32/6342_2.png) [@suthagar23](https://talk.openmrs.org/u/suthagar23)\ **Post date:** [December 20, 2018, 6:29pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/13 "2018-12-20T18:29:43Z")
Why don’t you assign location to existing users? Did you try to edit the user(through the edit section, you can assign location for existing user)? We have implemented and tested this feature. ---
**Author:** ![mksrom](https://talk.openmrs.org/user_avatar/talk.openmrs.org/mksrom/32/20221_2.png) [@mksrom](https://talk.openmrs.org/u/mksrom)\ **Post date:** [January 23, 2019, 1:49pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/14 "2019-01-23T13:49:41Z")
@suthagar23, that looks promising 👍 > [@suthagar23](#): > > Still we haven’t estimated the performance for these scanerios. We will do it in the next phase and add improvements to the module as well 🙂 Is there a roadmap or list of the next phase and improvements? I understand that the restrictions are made on the API level. Then how much of this module is dependent on the Ref App? ---
**Author:** ![jesplana](https://talk.openmrs.org/letter_avatar/jesplana/32/5_5575768a8748004e209b776fc1b2916d.png) [@jesplana](https://talk.openmrs.org/u/jesplana)\ **Post date:** [January 23, 2019, 5:07pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/15 "2019-01-23T17:07:26Z")
Can you assign location to existing patients? I asking this because when I click on edit on the patient header, it takes me to a page that only allows me to edit the patient name, gender and DOB. I probably will need to edit this functionality so it points to the full patient registration page rather than a subset of it. (unless you have a way to do this easily?) ---
**Author:** ![suthagar23](https://talk.openmrs.org/user_avatar/talk.openmrs.org/suthagar23/32/6342_2.png) [@suthagar23](https://talk.openmrs.org/u/suthagar23)\ **Post date:** [January 23, 2019, 5:19pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/16 "2019-01-23T17:19:25Z")
Hi @mksrom, I and @dkayiwa is waiting for some suggestions from implementers to finalize the next steps for this module. Anyhow we have some steps which can lead this module to next phase. Those are, - Automating the LABC module installation, need to reduce the workload at the beginning of a user - Create a dashboard for LBAC module. I prefer to go for a react OWA, So we need some rest endpoints inside our module. - Create a REST endpoint to show/edit the configurations of LBAC (Create Person Attributes for LBAC, Global Property attribute for LBAC, Check and show about the required module’s versions to use a feature from LBAC, Login Screen managements, LBAC On/OFF feature). Then create an OWA page to show/edit the configurations of LBAC through the REST endpoint. - Create a REST endpoint to migrate a patient from one location to another location quickly, then create a page in OWA with required functions for patient migrations. - Enable encounter access based on multiple admitted/channeled locations. - Add location restrictions to Reporting-REST, and Reference metadata modules. > I understand that the restrictions are made on the API level. Then how much of this module is dependent on the Ref App? It’s a separate module which depends on App UI, Admin UI, UI Framework, and Core 2.0.5. Take a look into here : [https://wiki.openmrs.org/display/docs/Location+Based+Access+Control+-+Deployment+Steps](https://wiki.openmrs.org/display/docs/Location+Based+Access+Control+-+Deployment+Steps) Thanks ---
**Author:** ![suthagar23](https://talk.openmrs.org/user_avatar/talk.openmrs.org/suthagar23/32/6342_2.png) [@suthagar23](https://talk.openmrs.org/u/suthagar23)\ **Post date:** [January 23, 2019, 5:22pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/17 "2019-01-23T17:22:31Z")
Hi @jesplana Have you followed this steps carefully : [https://wiki.openmrs.org/display/docs/Location+Based+Access+Control+-+Deployment+Steps](https://wiki.openmrs.org/display/docs/Location+Based+Access+Control+-+Deployment+Steps)? There should be a link as “Edit Patient Location” which will point to edit locations for existing patients. See here : [https://medium.com/@suthagar23/allow-users-to-edit-the-patient-location-through-the-patient-dashboard-fd79feb3aba2](https://medium.com/@suthagar23/allow-users-to-edit-the-patient-location-through-the-patient-dashboard-fd79feb3aba2) Please check and let me know, if you have any issues. Thanks ---
**Author:** ![mksrom](https://talk.openmrs.org/user_avatar/talk.openmrs.org/mksrom/32/20221_2.png) [@mksrom](https://talk.openmrs.org/u/mksrom)\ **Post date:** [January 23, 2019, 10:23pm UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/18 "2019-01-23T22:23:42Z")
Thanks for the roadmap. > [@suthagar23](#): > > It’s a separate module which depends on App UI, Admin UI, UI Framework, and Core 2.0.5 What I am trying to assess here is how much it leverages on Ref App UI specific modules and how big of a deal would that be to use it in Bahmni. Would it be a possible scenario to split UI and API components in 2 modules so any OpenMRS distribution could depend on it? ---
**Author:** ![suthagar23](https://talk.openmrs.org/user_avatar/talk.openmrs.org/suthagar23/32/6342_2.png) [@suthagar23](https://talk.openmrs.org/u/suthagar23)\ **Post date:** [January 24, 2019, 3:43am UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/19 "2019-01-24T03:43:59Z")
Actually, we wrapped OpenMRS core APIs through Spring AOP concept and implemented some UI Fragments (See [here](https://github.com/openmrs/openmrs-module-locationbasedaccess/tree/master/omod/src/main/webapp/fragments)) which are specifically needed for this module (it will integrate with AppUI and AdminUI modules to add required fragments) > Would it be a possible scenario to split UI and API components in 2 modules so any OpenMRS distribution could depend on it? Still, we don’t have any separate UI for this module. It designed to work completely in the background as a wrapper module for OpenMRS Core APIs. I don’t know, how to use this module for Bahmni since I haven’t any idea about that architecture. @dkayiwa Do you have any idea about How to make this for Bahmni? ---
**Author:** ![gschmidt](https://talk.openmrs.org/user_avatar/talk.openmrs.org/gschmidt/32/8213_2.png) [@gschmidt](https://talk.openmrs.org/u/gschmidt)\ **Post date:** [January 24, 2019, 8:58am UTC](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525/20 "2019-01-24T08:58:21Z")
Hi - @mksrom - at AMPATH we are interested in building on the user role provisioning functionality of OpenMRS core, and expand it to be able to track audit trails of providers accessing patient charts. There may be overlap with location based access control. We’d like to build this in such a way that it integrates into core, but doesn’t require the ref app. This would hopefully work both for Bahmni, AMPATH, and ref app applications. Do you have any documentation from the Bahmni perspective outlining what functionality you’re looking for? @suthagar23, do you think there is a way to disconnect part of this module from the Ref app? cc @jdick [Next page](https://talk.openmrs.org/t/location-based-access-control-v0-1-0-released/19525.md?page=2)