# Licensed Materials - Property of IBM, 5724-E76, (C) Copyright IBM Corp. 2004 - All Rights reserved.

# -------------------------------------------------------- #
# Properties of the Access Control Data Management Service #
# -------------------------------------------------------- #

# This setting determines if the group membership of groups is exploited at all by the
# Portal Access Control Component.
# Supported values: true, false (default: true)
accessControlDataManagement.enableNestedGroups=true

# This setting determines if the group membership of groups is exploited by the
# Portal Access Control Component for permission enforcement on users / groups.
# If this setting is false you can only get permissions on user groups via 
# roles on the groups / on users via roles on the direct groups the user is member
# of.
# Supported values: true, false (default: false)
accessControlDataManagement.enableTargetResourceGroupInheritance=false

# This setting determines if access control checks are done for the user first 
# or if the groups the user is in are checked first.
# You should change this property if you give access to resources directly
# to the users.
# Portal Access Control Component.
# Supported values: true, false (default: false)
accessControlDataManagement.checkUserFirst=false

# This setting determins the wait time in seconds between two
# periodic access control cache flushes. If no periodic cash 
# flushes shall occur, this property has to be set to 0.
# Activating this feature is required when using an external
# authorization provider (e.g. Tivoli Access Manager)
# (default: 0)
accessControlDataManagement.cacheTimeout=0

# This setting determins if the role name contains the unique name
# or the title of the resource the role was created on.
# It is recommended to set this setting to true when you use
# an external authorization provider (e.g. Tivoli Access Manager)
# as the role names can be found easier.
# Supported values: true, false (default: false)
accessControlDataManagement.reorderRoleNames=false