Notice: this Wiki will be going read only early in 2024 and edits will no longer be possible. Please see: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Wiki-shutdown-plan for the plan.
Difference between revisions of "HR Directory Access Control Policy"
(→Notes) |
|||
| Line 5: | Line 5: | ||
== Notes == | == Notes == | ||
| − | The above is a | + | The above is a third attempt at modeling this use-case. All outstanding issues have been addressed. |
* A new diagramming style is used--it is more compact at representing the literal attributes of an Entity within a single rectangular box. The entire use case now fits on one diagram (just barely!) | * A new diagramming style is used--it is more compact at representing the literal attributes of an Entity within a single rectangular box. The entire use case now fits on one diagram (just barely!) | ||
* The new ''groupSubject'' higgins:subject sub-attribute is now being used. This "tells" the Context that the subject for this policy is any subject that is a member of the stated Group (or any sub-group). | * The new ''groupSubject'' higgins:subject sub-attribute is now being used. This "tells" the Context that the subject for this policy is any subject that is a member of the stated Group (or any sub-group). | ||
| − | * A new '' | + | * A new ''selfSubject'' boolean is now being used on the Policy to indicate that the implied subject is the Entity that represents the current IdAS consumer. |
* The ''operation'' attribute of the Access Control policy is exclusively concerned with defining the "Entity" resource scope. It may or may not be further restricted to specific attribute types by the use of the ''onAttribute'' (see next bullet). | * The ''operation'' attribute of the Access Control policy is exclusively concerned with defining the "Entity" resource scope. It may or may not be further restricted to specific attribute types by the use of the ''onAttribute'' (see next bullet). | ||
| + | * the "selfModify" higgins:operation sub-attribute is used to scope the resource in question for this policy to be the entity that represents current IdAS consumer. | ||
* A new attribute ''onAttribute'' is now being used. This attribute, if present, restricts the policy to apply only to attribute type(s) explicitly listed as its values. | * A new attribute ''onAttribute'' is now being used. This attribute, if present, restricts the policy to apply only to attribute type(s) explicitly listed as its values. | ||
Revision as of 22:46, 30 July 2008
{{#eclipseproject:technology.higgins}}
Notes
The above is a third attempt at modeling this use-case. All outstanding issues have been addressed.
- A new diagramming style is used--it is more compact at representing the literal attributes of an Entity within a single rectangular box. The entire use case now fits on one diagram (just barely!)
- The new groupSubject higgins:subject sub-attribute is now being used. This "tells" the Context that the subject for this policy is any subject that is a member of the stated Group (or any sub-group).
- A new selfSubject boolean is now being used on the Policy to indicate that the implied subject is the Entity that represents the current IdAS consumer.
- The operation attribute of the Access Control policy is exclusively concerned with defining the "Entity" resource scope. It may or may not be further restricted to specific attribute types by the use of the onAttribute (see next bullet).
- the "selfModify" higgins:operation sub-attribute is used to scope the resource in question for this policy to be the entity that represents current IdAS consumer.
- A new attribute onAttribute is now being used. This attribute, if present, restricts the policy to apply only to attribute type(s) explicitly listed as its values.
- See HOWL Update 1.1.105 and HOWL Update 1.1.104 for related changes to support this use case