Example Dynamic role PEP

Dynamic role Enforcement Point

We want to define a policy to restrict access to the Soffid console user's page (MainMenu > Administration > Resources > Users).

The users who are assigned to the SOFFID_RRHH role (from this point forward: end-users) will have limitations to perform some actions:

The end-users only be able to query the information about the users who belong to the same primary group that them.
The end-users only be able to update the users with internal user type.
The end-users could not delete any user record.

First of all, we define a policy set. We need to define the subject, in that case users with SOFFID_RRHH role assigned.

Then, we can create the policies, in that case, we can create three policies, one for each operation that we want to manage.

We can define a policy for each operation, to permit or deny access.

Also, we can define a variable that contains the end-user primary group in order to use it when we define the conditions.

The end-users only be able to query the information about the users who belong to the same primary group that them.

We need to define two rules, one to permit and other to deny access.

&&TODO&& sustituir la imagen cuando se arregle el label de Attribute selector

We define the rule that allow to the end-user query users information who belong to the same primary group that the end-user.

Then, we define the rule that denies access to end-users to query users information.

The end-users only be able to update the users with internal user type.

We need to define two rules, one to permit and other to deny access.

We define the rule that allow to the end-user update users information who are internal users.

Then, we define the rule that denies access to end-users to update users information.

The end-users could not delete any user record.

We need to define only one rule to deny access.

We define the rule that deny to the end-user delete any user.

You can download a XML file with the example: policy-TestDynamicPEP.xml