HR Directory Access Control Policy

{{#eclipseproject:technology.higgins|eclipse_custom_style.css}}

Here is an example of the proposed Higgins/IdAS Access Control Policy for the "HR Directory" use case.

Notes

The above is a third attempt at modeling this use-case. All outstanding issues have been addressed.

• A new diagramming style is used--it is more compact at representing the literal attributes of an Entity within a single rectangular box. The entire use case now fits on one diagram (just barely!)
• The new groupSubject higgins:subject sub-attribute is now being used. This "tells" the Context that the subject for this policy is any subject that is a member of the stated Group (or any sub-group).
• A new selfSubject boolean is now being used on the Policy to indicate that the implied subject is the Entity that represents the current IdAS consumer.
• The operation attribute of the Access Control policy is exclusively concerned with defining the "Entity" resource scope. It may or may not be further restricted to specific attribute types by the use of the onAttribute (see next bullet).
• The new "selfModify" higgins:operation sub-attribute is used to scope the resource in question for this policy to be the entity that represents current IdAS consumer.
• A new attribute onAttribute is now being used. This attribute, if present, restricts the policy to apply only to attribute type(s) explicitly listed as its values.

• See HOWL Update 1.1.105 and HOWL Update 1.1.104 for related changes to support this use case

See Also

• (this) HR Directory use case
• all Access Control Use Cases