Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
devel:documentation:security:dev:authorization [2020/04/22 11:21] tomiskar |
devel:documentation:security:dev:authorization [2020/07/07 09:10] tomiskar [Base interfaces and classes] |
||
---|---|---|---|
Line 41: | Line 41: | ||
<note important> | <note important> | ||
* '' | * '' | ||
+ | * **'' | ||
+ | * **'' | ||
* '' | * '' | ||
* '' | * '' | ||
- | * '' | + | * '' |
- | * '' | + | |
- | * '' | + | |
- | * '' | + | |
* '' | * '' | ||
* '' | * '' | ||
Line 105: | Line 104: | ||
Serves as a parent for evaluating permissions according to the derived objects - for example, I have a permission for the assigned role if I have a permission for the identity, etc. See the children of this abstract class below ('' | Serves as a parent for evaluating permissions according to the derived objects - for example, I have a permission for the assigned role if I have a permission for the identity, etc. See the children of this abstract class below ('' | ||
+ | |||
+ | === Parameters === | ||
+ | * **Use permissions** ('' | ||
==== BasePermissionEvaluator ==== | ==== BasePermissionEvaluator ==== | ||
Line 121: | Line 123: | ||
Gives currently logged user a permission to work with his own identity. | Gives currently logged user a permission to work with his own identity. | ||
+ | |||
+ | ==== IdentityByFormProjectionEvaluator ==== | ||
+ | |||
+ | @since 10.3.0 | ||
+ | |||
+ | A permission for identities by user type. | ||
+ | |||
+ | === Parameters === | ||
+ | * **User type** ('' | ||
==== SubordinatesEvaluator ==== | ==== SubordinatesEvaluator ==== | ||
Line 136: | Line 147: | ||
Gives a permission for industrial relations according to the permission for identity => e.g. if I have a permission to read an identity, I have a permission to read its IR. '' | Gives a permission for industrial relations according to the permission for identity => e.g. if I have a permission to read an identity, I have a permission to read its IR. '' | ||
- | <note warning> | + | === Parameters === |
+ | * **Use permissions** ('' | ||
+ | |||
+ | <note warning> | ||
==== IdentityByContractEvaluator ==== | ==== IdentityByContractEvaluator ==== | ||
Line 144: | Line 158: | ||
Gives a permission for identity according to the permission for identity contract => e.g. if I have a permission to read an contract, I have a permission to read its identity. | Gives a permission for identity according to the permission for identity contract => e.g. if I have a permission to read an contract, I have a permission to read its identity. | ||
- | <note warning> | + | <note warning> |
==== ContractGuaranteeByIdentityContractEvaluator ==== | ==== ContractGuaranteeByIdentityContractEvaluator ==== | ||
Line 236: | Line 250: | ||
Gives a permission for code list items according to the permission for the code list => e.g. If I have a permission to read a code list, I have a permission to read its items. | Gives a permission for code list items according to the permission for the code list => e.g. If I have a permission to read a code list, I have a permission to read its items. | ||
+ | |||
+ | ==== CodeListItemByCodeEvaluator ==== | ||
+ | |||
+ | @since 10.3.0 | ||
+ | |||
+ | Gives a permission for code list items according to the permission for the code list and item codes. | ||
+ | |||
+ | === Parameters === | ||
+ | * **Code list** ('' | ||
+ | * **Items** ('' | ||
==== VsRequestByImplementerEvaluator ==== | ==== VsRequestByImplementerEvaluator ==== | ||
Line 354: | Line 378: | ||
Permissions to identity roles. User can manipulate with his own roles. With basic settings for user you dont need this, beacause exist evaluator **IdentityRoleByIdentityEvaluator** and every identity can read all roles for identities that can read. | Permissions to identity roles. User can manipulate with his own roles. With basic settings for user you dont need this, beacause exist evaluator **IdentityRoleByIdentityEvaluator** and every identity can read all roles for identities that can read. | ||
+ | ==== SelfContractEvaluator ==== | ||
+ | |||
+ | @since 10.4.0 | ||
+ | |||
+ | Permissions to contracts. User can manipulate with his own contracts. | ||
==== Universal request agenda (IdmRequest - evaluators) ==== | ==== Universal request agenda (IdmRequest - evaluators) ==== | ||
[[devel: | [[devel: | ||
+ | |||
+ | ==== RoleByRoleCatalogueEvaluator ==== | ||
+ | @since 10.3.0 for **LTS version** is available similar evaluator in [[devel: | ||
+ | |||
+ | Documentation for the evaluator is available [[devel: | ||
+ | |||
+ | ==== IdentityByTreeNodeEvaluator ==== | ||
+ | @since 10.3.0 for **LTS version** is available similar evaluator in [[devel: | ||
+ | |||
+ | Documentation for the evaluator is available [[devel: | ||
+ | |||
===== Default policies ===== | ===== Default policies ===== | ||
Line 371: | Line 411: | ||
If we want to read an identity profile including its assigned roles and IR, to enable password change and to request roles, it is possible to set the default role authorization policies as follows: | If we want to read an identity profile including its assigned roles and IR, to enable password change and to request roles, it is possible to set the default role authorization policies as follows: | ||
- | * Permission to read one's own identity: Users (IdmIdentity) | Displaying in autocomplete, | + | * Permission to read one's own identity: Users (IdmIdentity) | Displaying in autocomplete, |
* Permission to read the assigned identity roles: Roles assigned to users (IdmIdentityRole)| - | IdentityRoleByIdentityEvaluator | * Permission to read the assigned identity roles: Roles assigned to users (IdmIdentityRole)| - | IdentityRoleByIdentityEvaluator | ||
- | * Permission to request roles (which can be requested): Role (IdmRole) | Can be requested | RoleCanBeRequestedEvaluator | + | * Permission to request roles (which can be requested): Role (IdmRole) | Can be requested | RoleCanBeRequestedEvaluator |
- | * Permission to request roles by copy them from other identity (which can be requested): Assigned roles (IdmIdentityRole) | Can be requested | RoleCanBeRequestedEvaluator (since the version 9.7.12) | + | * Permission to request roles by copy them from other identity (which can be requested): Assigned roles (IdmIdentityRole) | Can be requested |
* Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | - | IdentityContractByIdentityEvaluator | * Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | - | IdentityContractByIdentityEvaluator | ||
* Permission to read other contract positions according to contract: Other contract positions (IdmContractPosition) | - | ContractPositionByIdentityContractEvaluator | * Permission to read other contract positions according to contract: Other contract positions (IdmContractPosition) | - | ContractPositionByIdentityContractEvaluator | ||
Line 395: | Line 435: | ||
* Connected systems | Displaying in autocomplete, | * Connected systems | Displaying in autocomplete, | ||
* Scheduler (IdmLongRunningTask) | Displaying in autocomplete, | * Scheduler (IdmLongRunningTask) | Displaying in autocomplete, | ||
- | | + | * Code lists (IdmCodeList) | Displaying in autocomplete, |
+ | * Code lists - items (IdmCodeListItem) | Displaying in autocomplete, | ||
+ | | ||
* Permission to autocomplete form definitions (eav attributes on detail for identities, roles, etc): Forms - definitions (IdmFormDefinition) | Displaying in autocomplete, | * Permission to autocomplete form definitions (eav attributes on detail for identities, roles, etc): Forms - definitions (IdmFormDefinition) | Displaying in autocomplete, | ||
+ | * Permission to read and solve one's requests on virtual systems: Requests on virtual systems (VsRequest) | Administration | VsRequestByImplementerEvaluator ([[tutorial: | ||
<note tip>From version 9.7.3 isn't feature manually disabled and manually enabled for user allowed by permission Identity '' | <note tip>From version 9.7.3 isn't feature manually disabled and manually enabled for user allowed by permission Identity '' | ||
Line 405: | Line 448: | ||
If you want to enable the managers of the users to read their subordinates and change their permissions on managed contracts only: | If you want to enable the managers of the users to read their subordinates and change their permissions on managed contracts only: | ||
- | * **remove** following **permissions** from the userRole: | + | * **change** following **permissions** from the userRole: |
- | * Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | - | **IdentityContractByIdentityEvaluator** | + | * Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | **Use permissions: |
* **add** following **permissions** to the userRole: | * **add** following **permissions** to the userRole: | ||
* Users (IdmIdentity) | View in select box (autocomplete), | * Users (IdmIdentity) | View in select box (autocomplete), | ||
* Contracts (IdmIdentityContract) | View in select box (autocomplete), | * Contracts (IdmIdentityContract) | View in select box (autocomplete), | ||
- | * Users (IdmIdentity) | - | **IdentityByContractEvaluator** | ||
* Assigned roles (IdmIdentityRole) | - | **IdentityRoleByContractEvaluator** | * Assigned roles (IdmIdentityRole) | - | **IdentityRoleByContractEvaluator** | ||
Line 460: | Line 502: | ||
==== Settings of permissions of identity basic attributes ==== | ==== Settings of permissions of identity basic attributes ==== | ||
- | If we want to enable for currently logged identity | + | If we want to enable for currently logged identity |
- | * Permission to update identity: Users (IdmIdentity) | Update, Change phone, Change personal number, Change note, Change login, Change user type (projection), | + | * Permission to update identity |
+ | |||
+ | <note tip>Can be combined with [[# | ||
- | < | + | < |
==== Settings of permissions of identity form (extended) attribute values ==== | ==== Settings of permissions of identity form (extended) attribute values ==== | ||
If we want to enable for currently logged identity read / update for some form attributes (e.g '' | If we want to enable for currently logged identity read / update for some form attributes (e.g '' | ||
- | * Permission to autocomplete main form definition: Forms - definitions (IdmFormDefiniton) | Displaying in autocomplete, | + | * Permission to autocomplete main form definition: Forms - definitions (IdmFormDefinition) | Displaying in autocomplete, |
* Permission to update '' | * Permission to update '' | ||
- | * and check logged user only checkbox, if currently logged user can edit just itself. Logged user will don' | + | * and check logged user only checkbox, if currently logged user can edit just itself. Logged user will not get permissions to edit other users. |
==== Settings of permissions of contract form (extended) attribute values ==== | ==== Settings of permissions of contract form (extended) attribute values ==== |