Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
devel:documentation:security:dev:authorization [2019/07/30 15:39] kopro [Default settings of permissions for an identity profile] typo |
devel:documentation:security:dev:authorization [2020/03/30 12:51] tomiskar [Identity] |
||
---|---|---|---|
Line 1: | Line 1: | ||
===== Authorization policies ===== | ===== Authorization policies ===== | ||
- | {{tag> security authorization role policy }} | + | {{tag> security authorization role policy |
An authorization policy determines which permissions a user in CzechIdM has. | An authorization policy determines which permissions a user in CzechIdM has. | ||
Line 20: | Line 20: | ||
**Real life example**: | **Real life example**: | ||
- | Let there be an agenda of roles. **To be able to select from the roles dial** (e.g. when requesting roles) **we need to be assigned a permission for an agenda of autocomplete for roles** '' | + | Let there be an agenda of identities. **To be able to select from the identity |
</ | </ | ||
Line 73: | Line 73: | ||
* '' | * '' | ||
* '' | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | |||
+ | ==== Role==== | ||
+ | |||
+ | * '' | ||
+ | |||
+ | |||
+ | ==== Identity role==== | ||
+ | |||
+ | * '' | ||
===== Base authorization evaluators ===== | ===== Base authorization evaluators ===== | ||
Line 115: | Line 127: | ||
Gives a permission for assigned roles according to the permission for the identity => e.g. If I have a permission to read an identity, I have a permission to read its assigned roles. '' | Gives a permission for assigned roles according to the permission for the identity => e.g. If I have a permission to read an identity, I have a permission to read its assigned roles. '' | ||
+ | |||
+ | ==== IdentityRoleByRoleEvaluator ==== | ||
+ | |||
+ | @since 9.7.12 | ||
+ | |||
+ | Gives a permission for assigned roles according to the permission for the role definition => e.g. If I have a permission to read an role, I have a permission to read its assigned roles. '' | ||
+ | It's usable mainly with can be requested permission - enables copying assigned roles from other identity. | ||
+ | |||
+ | === Parameters === | ||
+ | * **Can be requested only** ('' | ||
+ | |||
+ | <note tip>If you want to enable copying all assigned roles (the same behavior < @9.7.12), then configure '' | ||
Line 215: | Line 239: | ||
* **By permission to update user** ('' | * **By permission to update user** ('' | ||
* **By permission to read user** ('' | * **By permission to read user** ('' | ||
+ | |||
+ | ==== IdentityContractFormValueEvaluator ==== | ||
+ | |||
+ | @since 10.2.0 | ||
+ | |||
+ | <note tip> | ||
+ | |||
+ | <note important> | ||
+ | |||
+ | Permissions to contract form attribute values. By definition (main if not specified) and attrinute codes (all if not specified). | ||
+ | Configure permissions for form definitions together with this evaluator - '' | ||
+ | |||
+ | === Parameters === | ||
+ | * **Form definition** ('' | ||
+ | * **Attributes** ('' | ||
+ | * **By permission to update contract** ('' | ||
+ | * **By permission to read contract** ('' | ||
+ | |||
==== RoleCatalogueRoleByRoleEvaluator ==== | ==== RoleCatalogueRoleByRoleEvaluator ==== | ||
Line 299: | Line 341: | ||
* Permission to read one's own identity: Users (IdmIdentity) | Displaying in autocomplete, | * Permission to read one's own identity: Users (IdmIdentity) | Displaying in autocomplete, | ||
* Permission to read the assigned identity roles: Roles assigned to users (IdmIdentityRole)| - | IdentityRoleByIdentityEvaluator | * Permission to read the assigned identity roles: Roles assigned to users (IdmIdentityRole)| - | IdentityRoleByIdentityEvaluator | ||
+ | * Permission to request roles (which can be requested): Role (IdmRole) | Can be requested | RoleCanBeRequestedEvaluator | ||
+ | * Permission to request roles by copy them from other identity (which can be requested): Assigned roles (IdmIdentityRole) | Can be requested | RoleCanBeRequestedEvaluator (since the version 9.7.12) | ||
* Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | - | IdentityContractByIdentityEvaluator | * Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | - | IdentityContractByIdentityEvaluator | ||
* Permission to read other contract positions according to contract: Other contract positions (IdmContractPosition) | - | ContractPositionByIdentityContractEvaluator | * Permission to read other contract positions according to contract: Other contract positions (IdmContractPosition) | - | ContractPositionByIdentityContractEvaluator | ||
Line 310: | Line 354: | ||
* User profile (picture) (IdmProfile) | Displaying in autocomplete, | * User profile (picture) (IdmProfile) | Displaying in autocomplete, | ||
* Users (IdmIdentity) | Displaying in autocomplete, | * Users (IdmIdentity) | Displaying in autocomplete, | ||
- | * Role (IdmRole) | Displaying in autocomplete, | + | * Role (IdmRole) | Displaying in autocomplete, |
* Role catalog (IdmRoleCatalogue) | Displaying in autocomplete, | * Role catalog (IdmRoleCatalogue) | Displaying in autocomplete, | ||
* Industrial relations (IdmIdentityContract) | Displaying in autocomplete, | * Industrial relations (IdmIdentityContract) | Displaying in autocomplete, | ||
Line 323: | Line 367: | ||
If you want to enable the managers of the users to read their subordinates and change their permissions, | If you want to enable the managers of the users to read their subordinates and change their permissions, | ||
* Users (IdmIdentity) | Manage authorizations, | * Users (IdmIdentity) | Manage authorizations, | ||
+ | |||
+ | <note tip>From version 9.7.3 isn't feature manually disabled and manually enabled for user allowed by permission Identity '' | ||
+ | |||
+ | <note tip>From version 9.7.12 it's required '' | ||
==== Settings of permissions for the Helpdesk role ==== | ==== Settings of permissions for the Helpdesk role ==== | ||
Line 365: | Line 413: | ||
==== Secure identity form (extended) attribute values ==== | ==== Secure identity form (extended) attribute values ==== | ||
- | If we want to enable for currently logged identity update only for some form attributes (e.g phone) from some form definition (e.g. from main definition) on identity detail (tab more information), | + | If we want to enable for currently logged identity update only for some form attributes (e.g '' |
* Enable authorization policies support for identity form values by [[..: | * Enable authorization policies support for identity form values by [[..: | ||
* Permission to autocomplete main form definition: Forms - definitions (IdmFormDefiniton) | Displaying in autocomplete, | * Permission to autocomplete main form definition: Forms - definitions (IdmFormDefiniton) | Displaying in autocomplete, | ||
- | * Permission to update phone attribute: Forms - values (IdmIdentityFormValue) | Read, Update | IdentityFormValueEvaluator - select form definition, enter ' | + | * Permission to update |
+ | * and check logged user only checkbox, if currently logged user can edit just itself. Logged user will don't get permissions to edit other users. | ||
+ | |||
+ | ==== Secure contract form (extended) attribute values ==== | ||
+ | |||
+ | If we want to enable for currently logged identity update only for some contract form attributes (e.g. '' | ||
+ | * Permission to autocomplete main form definition: Forms - definitions (IdmFormDefiniton) | Displaying in autocomplete, | ||
+ | * Permission to update '' | ||
+ | |||
+ | |||
+ | ==== Settings which enable skipping of the role approvement ==== | ||
+ | |||
+ | Assignment of roles is normally approved by the standard [[devel: | ||
+ | * Permission to directly execute role requests: Role requests (IdmRoleRequest) | Execute | BasePermissionEvaluator | ||
===== Employing policies for a new domain type - entity ===== | ===== Employing policies for a new domain type - entity ===== |