Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
tutorial:adm:codeable_permission [2019/05/20 06:52] kopro add image |
tutorial:adm:codeable_permission [2019/05/20 09:01] fiserp proofreading |
||
---|---|---|---|
Line 1: | Line 1: | ||
====== Create evaluator with restrictions on one entity ===== | ====== Create evaluator with restrictions on one entity ===== | ||
- | {{tag> evaluator evaluators restrictions restrict codeable }} | ||
- | Codeable | + | {{tag> |
- | In this tutorial | + | Codeable evaluator |
+ | |||
+ | This tutorial describes how admin can create a new evaluator | ||
===== Define evaluator with restriction for one identity (user) ===== | ===== Define evaluator with restriction for one identity (user) ===== | ||
- | There is describes how to create evaluator that restrict | + | This section |
==== Step 1. - Get username of user ==== | ==== Step 1. - Get username of user ==== | ||
Line 15: | Line 16: | ||
==== Step 2. - Create codeable evaluator for role ==== | ==== Step 2. - Create codeable evaluator for role ==== | ||
- | For next step must exists | + | For this step a role must exist so we can hook a new evaluator |
{{ : | {{ : | ||
==== Step 3. - Define new evaluator ==== | ==== Step 3. - Define new evaluator ==== | ||
- | On modal window select | + | On a modal window, select: |
+ | * Entity | ||
+ | * Evaluator type: **CodeableEvaluator** | ||
+ | |||
+ | Then, application | ||
{{ : | {{ : | ||
- | And after save new evaluator | + | Save the new evaluator. If the action was successful, you can verify |
{{ : | {{ : | ||
Line 29: | Line 34: | ||
==== Step 4. - Add role to user ==== | ==== Step 4. - Add role to user ==== | ||
- | Add newly create | + | Choose some other user (the user you want to give the permission to) and add him the role you configured. This user now obtains |
+ | |||
+ | {{ : | ||
{{ : | {{ : | ||
==== Step 5. - Result ==== | ==== Step 5. - Result ==== | ||
+ | Final result. We assigned a role to the **richard.roe**. This user now can see the **john.doe** identity in IdM. | ||
{{ : | {{ : | ||
===== Define evaluator with restriction for access to one certification authority ===== | ===== Define evaluator with restriction for access to one certification authority ===== | ||
+ | This tutorial is similar to the first one. Instead of an identity, we grant user a permission to work with some certificate authority. For example, this restriction can be used for adding permissions to request certificates only from particular certificate authority authority. If you have multiple CAs defined, you can create one role for each of your CAs an then assign those roles to users as necessary. | ||
==== Step 1. - Get code of certification authority ==== | ==== Step 1. - Get code of certification authority ==== | ||
- | In first step we must get code of certification authority. | + | Get the **code** of certification authority. |
- | <note important> | + | <note important> |
{{ : | {{ : | ||
==== Step 2. - Create codeable evaluator for role ==== | ==== Step 2. - Create codeable evaluator for role ==== | ||
- | For next step must exists | + | For this step you have to have a role created |
{{ : | {{ : | ||
==== Step 3. - Define new evaluator ==== | ==== Step 3. - Define new evaluator ==== | ||
- | On modal window select | + | On modal window, select: |
+ | * Entity | ||
+ | * Evaluator type: **CodeableEvaluator**. | ||
+ | |||
+ | Application | ||
{{ : | {{ : | ||
- | And after save new evaluator | + | Save new evaluator. If everything is ok, you can see it in the list of existing |
{{ : | {{ : | ||
==== Step 4. - Add role to user ==== | ==== Step 4. - Add role to user ==== | ||
- | Add newly create | + | Add a role to some user. This user will now obtain a permission |
{{ : | {{ : | ||
Line 69: | Line 82: | ||
==== Step 5. - Result ==== | ==== Step 5. - Result ==== | ||
- | After this role will be added to user. User will saw only this certification authority. | + | Final result - user can see only the certification authority |
{{ : | {{ : | ||
- | |||
- | This restriction of certification authority can be used for add permission for request certificates only by one authority. |