Example Dynamic role PEP

Dynamic role Enforcement Point

We want to define a policy to restrict access to the Soffid console user's page (MainMenu > Administration > Resources > Users).

The users who are assigned to the SOFFID_RRHH role (from this point forward: end-users) will have limitations to perform some actions.

The end-users only be able to query the information about the users who belong to the same primary group that them.
The end-users only be able to update the users with internal user type.
The end-users could not delete any user record.

We define a policy set that will apply to end-users with access to a specific resource who has been assigned a specific role.

That policy set has three policies, one for each operation that we want to manage.

We can define a policy for each operation, to permit or deny access. Also, we can define a variable which contains the end-user primary group.

The policy can permit or deny access to end-users to query users depending on the defined rules.

&&TODO&& sustituir la imagen cuando se arregle el label de Attribute selector

That rule allow to the end-users to query users who belong to the same primary group that the end-user.

That rule denies access to end-users to query users.

The policy denies access to end-users to delete users.

That rule denies access to end-users to delete users.

You can download a XML file with the example: policy-TestDynamicPEP.xml