Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
devel:documentation:security:dev:authorization [2020/04/22 11:31] tomiskar [Settings of permissions of identity basic attributes] |
devel:documentation:security:dev:authorization [2020/05/04 11:43] tomiskar |
||
---|---|---|---|
Line 121: | Line 121: | ||
Gives currently logged user a permission to work with his own identity. | Gives currently logged user a permission to work with his own identity. | ||
+ | |||
+ | ==== IdentityByFormProjectionEvaluator ==== | ||
+ | |||
+ | @since 10.3.0 | ||
+ | |||
+ | A permission for identities by user type. | ||
+ | |||
+ | === Parameters === | ||
+ | * **User type** ('' | ||
==== SubordinatesEvaluator ==== | ==== SubordinatesEvaluator ==== | ||
Line 136: | Line 145: | ||
Gives a permission for industrial relations according to the permission for identity => e.g. if I have a permission to read an identity, I have a permission to read its IR. '' | Gives a permission for industrial relations according to the permission for identity => e.g. if I have a permission to read an identity, I have a permission to read its IR. '' | ||
- | <note warning> | + | <note warning> |
==== IdentityByContractEvaluator ==== | ==== IdentityByContractEvaluator ==== | ||
Line 144: | Line 153: | ||
Gives a permission for identity according to the permission for identity contract => e.g. if I have a permission to read an contract, I have a permission to read its identity. | Gives a permission for identity according to the permission for identity contract => e.g. if I have a permission to read an contract, I have a permission to read its identity. | ||
- | <note warning> | + | <note warning> |
==== ContractGuaranteeByIdentityContractEvaluator ==== | ==== ContractGuaranteeByIdentityContractEvaluator ==== | ||
Line 236: | Line 245: | ||
Gives a permission for code list items according to the permission for the code list => e.g. If I have a permission to read a code list, I have a permission to read its items. | Gives a permission for code list items according to the permission for the code list => e.g. If I have a permission to read a code list, I have a permission to read its items. | ||
+ | |||
+ | ==== CodeListItemByCodeEvaluator ==== | ||
+ | |||
+ | @since 10.3.0 | ||
+ | |||
+ | Gives a permission for code list items according to the permission for the code list and item codes. | ||
+ | |||
+ | === Parameters === | ||
+ | * **Code list** ('' | ||
+ | * **Items** ('' | ||
==== VsRequestByImplementerEvaluator ==== | ==== VsRequestByImplementerEvaluator ==== | ||
Line 395: | Line 414: | ||
* Connected systems | Displaying in autocomplete, | * Connected systems | Displaying in autocomplete, | ||
* Scheduler (IdmLongRunningTask) | Displaying in autocomplete, | * Scheduler (IdmLongRunningTask) | Displaying in autocomplete, | ||
+ | * Code lists (IdmCodeList) | Displaying in autocomplete, | ||
+ | * Code lists - items (IdmCodeListItem) | Displaying in autocomplete, | ||
* Permission to read automatic role requests in workflow approval: Requests for automatic roles (IdmAutomaticRoleRequest) | Read, Update, Create, Delete | AutomaticRoleRequestByWfInvolvedIdentityEvaluator ( It's good to have autocomplete permission to IdmAutomaticRoleAttribute and IdmRoleTreeNode.). The permission is possibly in wrong place. | * Permission to read automatic role requests in workflow approval: Requests for automatic roles (IdmAutomaticRoleRequest) | Read, Update, Create, Delete | AutomaticRoleRequestByWfInvolvedIdentityEvaluator ( It's good to have autocomplete permission to IdmAutomaticRoleAttribute and IdmRoleTreeNode.). The permission is possibly in wrong place. | ||
* Permission to autocomplete form definitions (eav attributes on detail for identities, roles, etc): Forms - definitions (IdmFormDefinition) | Displaying in autocomplete, | * Permission to autocomplete form definitions (eav attributes on detail for identities, roles, etc): Forms - definitions (IdmFormDefinition) | Displaying in autocomplete, | ||
Line 405: | Line 426: | ||
If you want to enable the managers of the users to read their subordinates and change their permissions on managed contracts only: | If you want to enable the managers of the users to read their subordinates and change their permissions on managed contracts only: | ||
- | * **remove** following **permissions** from the userRole: | + | * **change** following **permissions** from the userRole: |
- | * Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | - | **IdentityContractByIdentityEvaluator** | + | * Permission to read contracts according to identity: Industrial relations (IdmIdentityContract) | **Use permissions: |
* **add** following **permissions** to the userRole: | * **add** following **permissions** to the userRole: | ||
* Users (IdmIdentity) | View in select box (autocomplete), | * Users (IdmIdentity) | View in select box (autocomplete), | ||
* Contracts (IdmIdentityContract) | View in select box (autocomplete), | * Contracts (IdmIdentityContract) | View in select box (autocomplete), | ||
- | * Users (IdmIdentity) | - | **IdentityByContractEvaluator** | ||
* Assigned roles (IdmIdentityRole) | - | **IdentityRoleByContractEvaluator** | * Assigned roles (IdmIdentityRole) | - | **IdentityRoleByContractEvaluator** | ||