Protected graphical user interface for role-based application and data access

A computer program product for controlling access on an endpoint device to at least a portion of an application, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to perform the following steps:

• obtaining a default user interface for said application with one or more widget functions associated with said application enabled;
• generating a mask user interface to update said default user interface using an additional control layer between a user of said application and said default user interface by comparing said one or more widget functions to a privilege configuration for said access wherein said privilege configuration comprises a specification of one or more of said widget functions that have a disabled status for a particular user role;
• combining said default user interface and said mask user interface substantially simultaneously with said access to generate a final user interface such that one or more of the widget functions from said default user interface are modified to a disabled status in said final user interface based on said privilege configuration;
• determining, by an event filter, if one or more user click events generated using said final user interface are associated with a widget function having said disabled status;
• and
• preventing, by said event filter, said user click events having said disabled status from being provided to an operating system for further processing, wherein at least one of said steps is carried out by a computing device.

A system for controlling access on an endpoint device to at least a portion of an application, said system comprising:

• a memory;
• and
• at least one hardware device coupled to the memory and configured for:
• obtaining a default user interface for said application with one or more widget functions associated with said application enabled;
• generating a mask user interface to update said default user interface using an additional control layer between a user of said application and said default user interface by comparing said one or more widget functions to a privilege configuration for said access, wherein said privilege configuration comprises a specification of one or more of said widget functions that have a disabled status for a particular user role;
• combining said default user interface and said mask user interface substantially simultaneously with said access to generate a final user interface such that one or more of the widget functions from said default user interface are modified to a disabled status in said final user interface based on said privilege configuration;
• determining, by an event filter, if one or more user click events generated using said final user interface are associated with a widget function having said disabled status;
• and
• preventing, by said event filter, said user click events having said disabled status from being provided to an operating system for further processing, wherein at least one of said steps is carried out by a computing device.