Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
Next revision Both sides next revision
devel:documentation:security:dev:authorization [2020/04/15 09:04]
tomiskar [Default settings of permissions for an identity profile] 		devel:documentation:security:dev:authorization [2020/04/21 11:22]
tomiskar [Secure identity form (extended) attribute values]
Line 384: Line 384:
     * Identity accounts (AccIdentityAccount) | - | IdentityAccountByAccountEvaluator       **(<- use this only when using acc module)**     * Identity accounts (AccIdentityAccount) | - | IdentityAccountByAccountEvaluator       **(<- use this only when using acc module)**
     * Connected systems | Displaying in autocomplete, selections | BasePermissionEvaluator      * Connected systems | Displaying in autocomplete, selections | BasePermissionEvaluator 
 +    * Scheduler (IdmLongRunningTask) | Read | BasePermissionEvaluator
   * Permission to read automatic role requests in workflow approval: Requests for automatic roles (IdmAutomaticRoleRequest) | Read, Update, Create, Delete | AutomaticRoleRequestByWfInvolvedIdentityEvaluator ( It's good to have autocomplete permission to IdmAutomaticRoleAttribute and IdmRoleTreeNode.). The permission is possibly in wrong place.   * Permission to read automatic role requests in workflow approval: Requests for automatic roles (IdmAutomaticRoleRequest) | Read, Update, Create, Delete | AutomaticRoleRequestByWfInvolvedIdentityEvaluator ( It's good to have autocomplete permission to IdmAutomaticRoleAttribute and IdmRoleTreeNode.). The permission is possibly in wrong place.
   * Permission to autocomplete form definitions (eav attributes on detail for identities, roles, etc): Forms - definitions (IdmFormDefinition) | Displaying in autocomplete, selections | BasePermissionEvaluator   * Permission to autocomplete form definitions (eav attributes on detail for identities, roles, etc): Forms - definitions (IdmFormDefinition) | Displaying in autocomplete, selections | BasePermissionEvaluator
Line 394: Line 395:
  
 If you want to enable the managers of the users to read their subordinates and change their permissions on managed contracts only: If you want to enable the managers of the users to read their subordinates and change their permissions on managed contracts only:
-  * **remove** following **permissions from the userRole**: +  * **remove** following **permissions** from the userRole:
-    * Permission to read the assigned identity roles: Roles assigned to users (IdmIdentityRole)| - | **IdentityRoleByIdentityEvaluator**+
     * Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | - | **IdentityContractByIdentityEvaluator**     * Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | - | **IdentityContractByIdentityEvaluator**
-  * **add** following permissions **to the userRole**: +  * **add** following **permissions** to the userRole: 
-    * Contracts (IdmIdentityContract) | View in select box (autocomplete), Read | **SubordinateContractEvaluator**+    * Users (IdmIdentity) | View in select box (autocomplete), Read | **SubordinatesEvaluator** 
 +    * Contracts (IdmIdentityContract) | View in select box (autocomplete), Read, Change roles | **SubordinateContractEvaluator**
     * Users (IdmIdentity) | - | **IdentityByContractEvaluator**     * Users (IdmIdentity) | - | **IdentityByContractEvaluator**
-    * Users (IdmIdentity) | Change roles | **SubordinatesEvaluator** 
     * Assigned roles (IdmIdentityRole) | - | **IdentityRoleByContractEvaluator**     * Assigned roles (IdmIdentityRole) | - | **IdentityRoleByContractEvaluator**
 +
 +<note tip>This configuration is available from version 10.3.0. If you are using some older version, then no permissions have to be removed and add one permission instead: 
 +  * Users (IdmIdentity) | View in select box (autocomplete), Read, Change roles | **SubordinatesEvaluator**
 +
 +**With this setting manager will see even other contracts, which not manages** (=> all identity contracts) and can assign role to other contract. This is the reason, why new authorization policies and setting was introduced in version 10.3.0. 
 +</note>
  
 ==== Settings of permissions for the Helpdesk role ==== ==== Settings of permissions for the Helpdesk role ====
Line 444: Line 450:
 ==== Secure identity form (extended) attribute values ==== ==== Secure identity form (extended) attribute values ====
  
-If we want to enable for currently logged identity update only for some form attributes (e.g ''phone'') from some form definition (e.g. from main definition) on identity detail (tab more information), the authorization policies can be set as follows: +If we want to enable for currently logged identity read / update only for some form attributes (e.g ''phone'') from some form definition (e.g. from main definition) on identity detail (tab more information), the authorization policies can be set as follows:
-  * Enable authorization policies support for identity form values by [[..:..:application_configuration:dev:backend#identity|configuration]].+
   * Permission to autocomplete main form definition: Forms - definitions (IdmFormDefiniton) | Displaying in autocomplete, selections | UuidEvaluator - enter main definition (for identities) identifier   * Permission to autocomplete main form definition: Forms - definitions (IdmFormDefiniton) | Displaying in autocomplete, selections | UuidEvaluator - enter main definition (for identities) identifier
   * Permission to update ''phone'' attribute: Forms - values (IdmIdentityFormValue) | Read, Update | IdentityFormValueEvaluator - select form definition same as above, enter ''phone'' as attributes   * Permission to update ''phone'' attribute: Forms - values (IdmIdentityFormValue) | Read, Update | IdentityFormValueEvaluator - select form definition same as above, enter ''phone'' as attributes
  • by koulaj