Example Dynamic role PEP

Dynamic role Enforcement Point

Use case example

We want to define a policy to restrict access to the Soffid console user's page (MainMenu > Administration > Resources > Users).

The users who are assigned to the SOFFID_RRHH role (from this point forward: end-users) will have limitations to perform some actions.actions:

1. The end-users only be able to query the information about the users who belong to the same primary group that them. 
2. The end-users only be able to update the users with internal user type.
3. The end-users could not delete any user record.

Policy set

WeFirst of all, we define a policy setset. We need to define the subject, in that willcase apply to end-users with accessSOFFID_RRHH torole a specific resource who has been assigned a specific role. assigned.

ThatThen, policywe setcan hascreate the policies, in that case, we can create three policies, one for each operation that we want to manage.

Policies

We can define a policy for each operation, to permit or deny access.

Also, we can define a variable whichthat contains the end-user  primary group.group in order to use it when we define the conditions.

Policy1

The policy can permit or deny access to end-users only be able to query usersthe dependinginformation onabout the definedusers rules.who belong to the same primary group that them. 

We need to define two rules, one to permit access and other to deny.

Rules

&&TODO&& sustituir la imagen cuando se arregle el label de Attribute selector

ThatWe define the rule that allow to the end-users touser query users information who belong to the same primary group that the end-user.

ThatThen, we define the rule that denies access to end-users to query users.users information.

Policy 2

The policy denies access to end-users only be able to update the users with internal user type.

We need to define two rules, one to permit access and other to deny.

Rules

 to

 

 

 

Policy 3

The end-users could not delete users.any user record.

We need to define only one rule to deny access.

Rules

That rule denies access to end-users to delete users.

 

 

Download XML

You can download a XML file with the example: policy-TestDynamicPEP.xml