![]() |
Copyright © TIBCO Software Inc. All Rights Reserved |
Access is defined using roles. If file-based authentication is used, roles are defined and assigned to users in the password file (by default called users.pwd). If LDAP-based authentication is used, roles are defined and assigned to users in the LDAP directory.
A project’s access control file is an XML file named as follows: RMSProjectName.ac. The ACL file is stored in the directory specified by the RMS.cdd property ws.projects.acl.location.In the access control file resources element, you create resource elements to define groups of resources to suit your needs. You give each resource element an ID. In the entries element, you add one entry element for each user role to define the access permissions for that role, using the resource IDs and action elements. This brief summary is provided so you can understand the following guidelines. For full details. See Structure of the Access Control File.The first resource element defines a resource group consisting of all concept properties in the /Concepts project folder. The second element specifies one property in one concept. (The setup details are explained later in the chapter.)Then you define permissions using those resources. For example, for a role named CallCenter you might set up permissions as follows:<role name="CallCenter"/>With these settings, you give users with the CallCenter role the read permission for all properties in the /Concepts directory except the custID property.
An example of an access control file (CreditCardApplication.ac) giving all permissions available for the credit card application example, is located in the following directory:BE_HOME\rms\config\security
<resources><entries><entry><permissions>
• The entries element contains one entry for each role. For each role, you define one set of permissions. Each permission has of the following attributes
• The resourceref attribute references a resource ID defined in the resources element. It identifies a resource or set of resources.
• The name attribute specifies the project path to the resource or resources. (The name attribute is not used when you specify permissions for an entire resource type.)
• The resource type attribute specifies what types of resources in the specified name attribute project path are included in the permission.
• The action type attribute specifies an action type, for example, create. This attribute determines the kind of action a user has permission to do, for the specified resource or resources.The value of the action element is one of the key words ALLOW or DENY. It determines whether the specified permission is given denied.
DENY is the default value. You only need to set the DENY value explicitly when you have given ALLOW permissions at a higher level, and want to make individual exceptions within that broad scope.
![]() |
Copyright © TIBCO Software Inc. All Rights Reserved |