Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
Next revision Both sides next revision
devel:documentation:security:dev:authorization [2020/08/25 10:44]
tomiskar [Default policies] 		devel:documentation:security:dev:authorization [2021/06/11 06:29]
127.0.0.1 external edit
Line 86: Line 86:
  
   * ''CANBEREQUESTED'' - role, which can be requested. Used in role request and bulk actions for assign role.   * ''CANBEREQUESTED'' - role, which can be requested. Used in role request and bulk actions for assign role.
 +  * ''CHANGEPERMISSION'' - @since 11.1.0 - create role request for changing identity permissions on related role - usable for role guarantees.
  
 ==== Identity role==== ==== Identity role====
Line 95: Line 95:
  
   * ''CHANGEPERMISSION'' - permission is evaluated, when identity's permissions is changed => ''CHANGEPERMISSION'' on contract gives permissions ''READ'', ''CREATE'', ''UPDATE'', ''DELETE'' to identity's role requests.   * ''CHANGEPERMISSION'' - permission is evaluated, when identity's permissions is changed => ''CHANGEPERMISSION'' on contract gives permissions ''READ'', ''CREATE'', ''UPDATE'', ''DELETE'' to identity's role requests.
 +  * ''CANBEREQUESTED'' - @since 11.1.0 create role request for changing (ADD only) identity permissions on related contract.
  
 ===== Cache ===== ===== Cache =====
Line 464: Line 465:
 **With this setting manager will see even other contracts, which not manages** (=> all identity contracts) and can assign role to other contract. This is the reason, why new authorization policies and setting was introduced in version 10.3.0.  **With this setting manager will see even other contracts, which not manages** (=> all identity contracts) and can assign role to other contract. This is the reason, why new authorization policies and setting was introduced in version 10.3.0. 
 </note> </note>
 +
 +==== Default settings of permissions for delegations ====
 +
 +Default settings of permissions for delegations are defined in the role '**Delegation (delegationRole)**'.
 +
 +<note tip>You can see a detailed configuration of evaluators with comments here:
 +[[https://github.com/bcvsolutions/CzechIdMng/blob/develop/Realization/backend/core/core-impl/src/main/java/eu/bcvsolutions/idm/core/model/event/processor/module/InitDelegationRoleProcessor.java#L106-L202
 +|InitDelegationRoleProcessor]]</note>
  
 ==== Settings of permissions for the Helpdesk role ==== ==== Settings of permissions for the Helpdesk role ====
  • by koulaj