Example Dynamic role PEP

Dynamic role Enforcement Point

Use case example

We want to define a policy to restrict access to the Soffid console user's page.page (MainMenu > Administration > Resources > Users).

The users who are assigned to the SOFFID_RRHH role,role (from this point forward: end-users) will have limitations to perform some actions.

• The RRHH end-users only be able to query the information about the users who belong to the same primary group that them. 
• The RRHH end-users only be able to update the users with internal user type.
• The RRHH end-users could not delete any user record.

Policy set

We define a policy set that will apply to end-users with access to a specific resource who havehas been assigned a specific role. 

That policy set has three policies, one for each operation that we want to manage.

Policies

We can define a policy for each operation, to permit or deny access. AlsoAlso, we can define a variable which containcontains the end-user  primary group.

Policy1

The policy can permit or deny access to end-userusers to query users depending on the defined rules.

Rules

&&TODO&& sustituir la imagen cuando se arregle el label de Attribute selector

That rule allow to the end-userusers to query users who belong to the same primary group that the end-user.

That rule denies access to end-users to query usersusers.

Policy 2

The policy denies access to end-user users to delete users.

Rules

That rule denies access to end-users to delete usersusers.

Download XML

You can download a XML file with the example: policy-TestDynamicPEP.xml