Access permissions

Overview

Roles provide permissions for user to perform specific operations on resources. The following tables denote roles as follows: Role@Resource. Roles are organized in a hierarchy. Roles that are higher in the hierarchy generally include the permissions of roles that are lower in the role hierarchy. For example, to install web modules the editor role on the virtual resource Web Modules, Editor@Web Modules, is the minimum role assignment for this operation. The manager role is higher in the hierarchy than the editor role. For this reason, the manager role includes the permissions of the editor role. Manager@Web Modules also allows users to install web modules.

When access permissions are granted to any listed resource, it inherently requires access to the resource Access Control Administration.

Use the Access Control Administration to change the owner of a resource.

The resources listed can be different depending on other products that might be installed with the product. Some roles are required on virtual resources; other roles must be on resource instances.

Users might also have access permissions for some operations through ownership of resources.

Terms...

private	Accessible only by the owner of the resource. Creators of private resources automatically gain rights that are similar to the rights of a Manager. For example, if you create a private page, you have rights similar to manager for that page. We can also perform certain actions such as changing the page theme or deleting the page.
non-private	Accessible by those people who were granted access to the resource.
public	Accessible without authentication.

PORTAL and EXTERNAL_ACCESS_CONTROL are virtual resources.

The Security Administrator@EXTERNAL_ACCESS_CONTROL role is created and managed in the External Security Manager (ESM). It must be modified using the ESM management tools. For example, use the IBM Security Access Manager pdadmin> command line or the Computer Associates eTrust SiteMinder administrative console.

Minimum role assignments necessary to perform operation

View the access control configuration of a resource R	If R is under internal PORTAL protection: Security Administrator@R ...or... Security Administrator@PORTAL. If R is under external protection: Security Administrator@R ...or... Security Administrator@PORTAL + Security Administrator@EXTERNAL_ACCESS_CONTROL
Create a role RT on resource R	If R is under PORTAL protection: Security Administrator@R + RT@R ...or.. Security Administrator@PORTAL If R is under external protection: Security Administrator@R + RT@R ...or... Security Administrator@PORTAL + Security Administrator@EXTERNAL_ACCESS_CONTROL
Delete a role created from role RT on resource R. All corresponding role mappings are also deleted.	If R is under internal PORTAL protection: Security Administrator@R + RT@R + Delegator role on all assigned principals ...or... Security Administrator@PORTAL If R is under external protection: Security Administrator@R + RT@R + Delegator role on all assigned principals ...or... Security Administrator@PORTAL + Security Administrator@EXTERNAL_ACCESS_CONTROL
Create or delete a role assignment for user or group U created from role RT on resource R	If R is under internal PORTAL protection: Security Administrator@R + RT@R + Delegator@U ...or... Security Administrator@PORTAL If R is under external protection: Security Administrator@R + RT@R + Delegator@U ...or... Security Administrator@PORTAL + Security Administrator@EXTERNAL_ACCESS_CONTROL
Create or delete a role block for all roles created from role RT on resource R	If R is under internal PORTAL protection: Security Administrator@R + RT@R ...or... Security Administrator@PORTAL If R is under external protection: Security Administrator@R + RT@R ...or... Security Administrator@PORTAL + Security Administrator@EXTERNAL_ACCESS_CONTROL A Security Administrator on this resource is always implicitly a Delegator on this resource. For all other roles, the Security Administrator@R plus the previous assignments are required.
Externalizing or internalizing resources: Moving a resource R back and forth from internal to external control. All non-private child resources of R move with it. Private resources cannot be externalized.	Security Administrator@R + Security Administrator@EXTERNAL_ACCESS_CONTROL ...or... Security Administrator@Portal + Security Administrator@EXTERNAL_ACCESS_CONTROL
Modify the owner of a resource: Setting a user or group U1 as new owner of the non-private resource R, where the old owner was U2	Delegator@U1, Delegator@U2, Manager@R, and Security_Administrator@R
View a Business Rule	User@Business Rules Workspace Set this permission on the Business Rules Workspace in the Personalization navigator by selecting the root node and then choosing Extra Action > Edit Access from the menu.
Create a Business Rule	Contributor@Business Rules Workspace Contributor@Business Rules Workspace is the minimum required access permission to create a Business Rule. However, use Editor@Business Rules Workspace to create and maintain business rules and use the Portal administration facilities.
Delete a Business Rule	Manager@Business Rules Workspace
Assign a Business rule to a page P	For non-private pages: Editor@P and User@Business Rules Workspace For private pages: Priviliged User@P and User@Business Rules Workspace
Assign a Business rule to a portlet PO on page P	For non-private pages: Editor@P, User@PO, and User@Business Rules Workspace For private pages: Privileged User@P, User@PO, and User@Business Rules Workspace
Additional actions	When we use the Set Access button in Personalization to add a user or a group to a role on the root of the workspace, the same role is given to that user or group for all Web Content Manager libraries, policies, and templates.
Traversing a page: Viewing the navigation of a page P	User@P or @ some child resource of P
View the content of a page P, including page decoration and potentially the portlets on that page. The portlets on a page are protected separately. See the portlets on pages row of this table for information.	User@P
Modify page properties includes: Add or remove markup Add or remove a locale Add or remove parameters to or from a page P	Editor@P
Modify page properties includes: Set page layout properties of a static page.P	Markup editor role. If the resources are in secure locations of layout templates, use Manager role. For more information, see Adapt the list of required runtime configuration changes for your theme in the related links.
Change the theme of a page P	Editor@P
Modify the layout of a page P includes: Add or remove wires Manage actions	For non-private pages: Editor@P For private pages: Privileged User@P For managing receiving actions of a portlet on a target page: Editor@P and Editor@PO
Customize the layout of a non-private page: Creating a private, implicitly derived copy of a non-private page P	Privileged User@P
Create and add a new top-level page P	For non-private pages: Editor@Pages For private pages: Privileged User@Pages Pages is a virtual resource.
Add a page: Creating a page under any Page P	For non-private pages: Editor@P For private pages: Privileged User@P
Create a derived page: Creating a page underneath P1 that is explicitly derived from page P2	New page is private: Privileged User@P1 + Editor@P2 New page is non-private: Editor@P1 + Editor@P2
Delete a page P and all descendant pages, including further subpages and the portlets on those pages	Manager@P
Move page P1 to a new parent page P2	For non-private pages: Manager@P1 + Editor@P2 For private pages: Manager@P1 + Privileged User@P2
Lock or unlocking the contents of a non-private page P	Editor@P + User@portlet (Page Locks) + User@page (Locks)
Edit page associations for a non-private page P	Editor@P
Edit page associations for a private page P	Privileged User@P
Enable membership-based access control delegation for a Community Page P associated to an IBM Connections Community C represented by the virtual user groups G. It is activated through the Limit access to this page to only community members Page Associations check mark.	Editor@P + Security Administrator@P + Delegator@G + View Privileges@C(in IBM Connections)
Activating Portal Page Security for a web content page P associated with site area SA in web content library L. This security is activated through the Use Portal Page Security check mark in the Page Associations window.	Editor@P + User@SA + Administrator@L and Editor@P + User@SA + Administrator@L + Manager@VirtualResource CONTENT MAPPINGS
Add a root page Create and adding a new top-level page Pages based on page template T	For non-private pages: Editor@Pages and User@T For private pages: Privileged User@Pages and User@T Additional roles can be required based on instantiation features associated to page template T: T is associated to site area SA1 in WCM, and the wps.content.root label is associated with site area SA2, with default content associations on each site area. Web Content Manager view permissions on SA1 and Web Content Manager create content permissions on SA2. T is associated to an IBM Connections community C. Grant the following privileges to the user in IBM Connections: View C Create new communities T is configured to create a community during instantiation with the ibm.portal.instantiation.community.create.new page parameter. Grant the following privileges to the user in IBM Connections: Create new communities T is enabled for Membership-based access control delegation: Delegator@USER_GROUPS USER_GROUPS is a virtual resource.
Add a page Create a page from Template T under any Page P	For private pages: Privileged User@P and User@T Additional roles can be required based on instantiation features associated to page template T: T is associated to site area SA1 in WCM, and the wps.content.root label is associated with site area SA2, with default content associations on each site area. Web Content Manager view permissions on SA1 and Web Content Manager create content permissions on SA2. T is associated to an IBM Connections community C. Grant the following privileges to the user in IBM Connections: View C Create new communities T is configured to create a community during instantiation with the ibm.portal.instantiation.community.create.new page parameter. Grant the following privileges to the user in IBM Connections: Create new communities T is enabled for Membership-based access control delegation: Delegator@USER_GROUPS
Adding, viewing, or deleting a vault segment	Management of the Credential Vault through the Credential Vault portlet requires access to an instance of the Credential Vault portlet.
Add a shared administrative credential vault slot (containing a system credential)	Management of the Credential Vault through the Credential Vault portlet requires access to an instance of the Credential Vault portlet.
Retrieve the credential from a shared administrative credential vault slot (containing a system credential)	User@slot ...or... User@ADMIN_SLOTS
Modify a shared administrative credential vault slot (containing a system credential)	Editor@slot ...or... Editor@ADMIN_SLOTS
Delete a shared administrative credential vault slot (containing a system credential)	Manager@slot ...or... Manager@ADMIN_SLOTS
Adding, viewing, deleting, or editing a non-shared vault slot	Management of the Credential Vault through the Credential Vault portlet requires access to an instance of the Credential Vault portlet.
Add or deleting portal trace settings	Add or deleting portal trace setting through the Enable Tracing portlet requires access to an instance of the Enable Tracing portlet.
Manage event handlers: Creating, modifying, and deleting event handlers	Security Administrator@Event Handlers Virtual resource: Event Handlers is a virtual resource.
Manage clients: Viewing the portlet; deleting, modifying, and adding clients in the Manage Clients portlet	User@Manage Clients
Create a search index	Editor@PSE_Sources Virtual resource: PSE_Sources is a virtual resource.
Associate keywords with content items through the Search Center portlet, so they are promoted to users who search for those keywords.	Administrator@ for Search Center Portlet Virtual resource: Search Center Portlet is a virtual resource.
Modify keywords associated with content items that exist in the Suggested Links portlet already.	Administrator@ for Suggested Links Portlet Virtual resource: Suggested Links Portlet is a virtual resource.
Create the New Virtual Portal	Security Administrator@Portal Virtual resource: Portal is a virtual resource.
View the virtual portal	Security Administrator@Portal Virtual resource: Portal is a virtual resource.
Delete the virtual portal	Security Administrator@Portal Virtual resource: Portal is a virtual resource.
Edit the virtual portal	Security Administrator@Portal Virtual resource: Portal is a virtual resource.
Manage Markups: Creating, deleting, or modifying a Markup	Editor@Markups
Create a Policy under any Policy	Editor@Policy and User@Business Rules Workspace Contributor@Policy is the minimum required access permission to create a Policy under any Policy, though it is not recommended. Editor@Policy is recommended to create and maintain policies and use the Portal administration utilities. If a rule must be created or edited during the creation of a Policy, then Editor@Business Rules Workspace and Editor@Policy is also required. Business Rules Workspace is the root node in the Personalization navigator for Business Rules resources. Set permissions on this node by selecting the workspace node and then choosing Extra Action > Edit Access from the menu.
Assign a Business rule to a Policy	User@Business Rules and Editor@Policy
Edit a Policy	Editor@Policy and User@Business Rules If a rule must be created or edited during the creation of a Policy, then Editor@Business Rules is also required.
View a Policy	User@Policy + User@Business Rules
Import a new Policy	Editor@Policy_Root Important: Contributor@Policy_Root is the minimum required access permission to import a new Policy, however, use Editor@Policy_Root to import and maintain policies and use the Portal administration utilities.
Delete a Policy	Manager@Policy + User@Business Rules Delete policies: When we delete a policy, the associated rule is not deleted.
View current portal settings	User@Portal Settings Virtual resource: Portal Settings is a virtual resource.
Modify current portal settings	Editor@Portal Settings Virtual resource: Portal Settings is a virtual resource.
View the portlet application definition information for a portlet application PA	User@PA
Modify a portlet application includes: Add or remove a locale Set default locale Modify settings to, from, or of the portlet application PA.	Editor@PA
Duplicating a portlet application: Creating a portlet application based on an existing portlet application PA	Editor@Portlet Applications + User@PA Virtual resource: Portlet Applications is a virtual resource.
Delete a portlet application and removing all corresponding portlets and portlet entities from all pages within the portal	Manager@PA
Enable or disable a portlet application: Temporarily enabling or disabling the portlet application PA	Manager@PA
View an installed portlet: Viewing the portlet definition information of a portlet PO	User@PO
Modify an installed portlet includes: Add or remove a locale Set default locale Modify settings to, from, or of the portlet PO.	For adding or removing locales and setting default locale: Editor@PO For modifying settings: Manager@PO
Duplicating an installed portlet: Creating a new installed portlet based on an existing portlet PO that is part of a portlet application PA.	Editor@Portlet Applications + User@PO + User@PA Virtual resource: Portlet Applications is a virtual resource.
Delete an installed portlet PO and removing all corresponding portlet entities from all pages within the portal	Manager@PO
Enable or disable an installed portlet: Temporarily enabling or disabling a portlet PO	Manager@PO
Provide portlet PO as a WSRP service	Editor@WSRP Export and Editor@PO Virtual resource: WSRP Export is a virtual resource.
Withdrawing portlet PO from WSRP service	Manager@WSRP Export and Editor@PO Virtual resource: WSRP Export is a virtual resource.
Integrate the portlet of a WSRP Producer PR into the portal	If no portlet application exists for the group of portlets: Editor@Portlet Applications and User@PR Virtual resource: Portlet Applications is a virtual resource. If a Portlet Applications PA exists for the group of portlets: Editor@PA and User@PR
Delete an integrated WSRP portlet PO contained in the portlet application PA from the portal	If this is the last portlet in Portlet Applications: Manager@PA If more than one portlet is located in Portlet Applications: Manager@PO
View a portlet PO on page P	User@P + User@PO
Configure an installed portlet: Entering the configure mode of a portlet PO and modifying its configuration	Manager@PO
Modify a portlet on a page: Entering the edit mode of a portlet PO on page P and modifying its configuration If P is a non-private page and the user has no Editor role for this page, then modifying the configuration of the portlet results in the creation of an implicitly derived copy of page P.	Editor@P + Editor@PO Or Privileged User@P + Privileged User@PO
Modify page content: Adding or removing a portlet PO to/from a page P If P is a non-private page and the user has no Editor role for this page, then modifying the content of P results in the creation of an implicitly derived copy of page P.	For non-private pages: Editor@P + User@PO Or For private pages: Privileged User@P + User@PO
Add web content to a page: Add a web content viewer portlet PO configured to render web content C from site area SA in WCM. Portlet PO is configured with the option Create content (based on selection), and page P is associated with site area SA. If P is a non-private page and the user has no Editor role for this page, then modifying the content of P results in the creation of an implicitly derived copy of page P.	For non-private pages: Editor@P + User @ PO + Web Content Manager view permissions on C and Web Content Manager create content permissions on SA. For private pages: Privileged User@P + User@PO + Web Content Manager view permissions on C and Web Content Manager create content permissions on SA
Restricting the content of a page: Adding or removing a portlet from the Allowed Portlet List of a page	Editor@P + User@PO
Operating with ActionSets or PropertySets for a portlet PO	User@PO
Creating, updating, or deleting a wire from a portlet PO1 on Page P1 to a portlet PO2 on Page P2	Global wire: Editor@P1, User@PO1, Editor@P2, User@PO2 Personal wire: Privileged User@P1, User@PO1, Privileged User@P2, User@PO2 To update or delete a personal wire, the user must have the previous role assignments and created the wire they are updating or deleting.
Create a wire from a portlet PO1 on Page P1 to a portlet PO2 on Page P2	Global wire: User@P1, User@PO1, User@P2, User@PO2 Personal wire: Privileged User@P1, User@PO1, Privileged User@P2, User@PO2 To create a personal wire, the user must have the previous role assignments and created the wire they are executing.
View a wire from a portlet PO1 on Page P1 to a portlet PO2 on Page P2	Global wire: User@P1, User@PO1, User@P2, User@PO2 Personal wire: Privileged User@P1, User@PO1, Privileged User@P2, User@PO2 To view a personal wire, the user must have the previous role assignments and created the wire they are viewing
Create a PSE Source: Creating a search collection	Editor@PSE Sources Virtual resource: PSE Sources is a virtual resource.
View a PSE Source: Viewing a search collection SC	User@SC
Facilitating a PSE Source: Using a search collection SC	User@SC
Edit a PSE Source: Editing a search collection SC	Editor@SC
Delete a PSE Source: Deleting a search collection SC	Manager@SC
View community tags and ratings that other users applied. Create and delete personal public tags and ratings. Delete community tags regardless of ownership.	Manager@Tags + Manager@Ratings Virtual resource: Tags and Ratings are virtual resources.
View community tags and ratings that other users applied. Create and delete personal public tags and ratings.	Contributor@Tags + Contributor@Ratings
View community tags and ratings that other users applied. Create and delete personal private tags and ratings.	Privileged user@Tags + Privileged user@Ratings
View community tags and ratings that other users applied.	User@Tags + User@Ratings
Creating, viewing, editing, and deleting a Theme, Skin, or Layout Template	Manager@THEME MANAGEMENT Virtual resource: THEME MANAGEMENT is a virtual resource.
Manage unique names: Viewing the portlet; deleting, modifying, and adding unique names in the Unique Names portlet
Create a URL mapping context UMC	Editor@URL Mapping Contexts Virtual resource: URL Mapping Contexts is a virtual resource.
Traversing a URL mapping context: The ability to traverse a URL mapping context due to a role assignment to some child context of UMC	User@UMC or @ some child context of UMC
View the definition of a URL mapping context UMC	User@UMC
Assign a URL: Creating or editing a mapping between a URL mapping context UMC and a portal resource R	Editor@UMC + User@R
Modify a URL mapping context: Changing the properties of an existing URL mapping context UMC; for example editing the label	Editor@UMC If Virtual Portal Mapping: Editor@VP URL Mappings Virtual resource: VP URL Mappings is a virtual resource.
Delete a URL mapping context UMC and all of its child contexts	Manager@UMC
Create a User group within the user registry	Editor@User Groups Virtual resource: User Groups is a virtual resource.
View the User group profile information of a user group UG	User@UG
Modify the profile information of a User group UG	Editor@UG
Add or remove an existing User U or a User group UG2 to or from an existing User group UG1	Security Administrator@Users + Editor@UG1 Virtual resource: Users is a virtual resource.
Delete a user group UG	Manager@UG Delete the user group: The owner of the user group can also delete it.
Create a user in the user registry	Editor@User Self Enrollment ...or... Editor@Users Editor@User Self Enrollment allows the user to add new users. We can modify other existing users with Editor@Users Virtual resource: User Self Enrollment is a virtual resource. Users is also a virtual resource.
View the user profile information of a user U	User@UG and U is a member of user group UG or User@Users Virtual resource: Users is a virtual resource
Modify the profile information of a user U	Editor@UG and U is a member of user group UG or Editor@Users Virtual resource: Users is a virtual resource.
Delete a user from the user registry and deleting all private pages created by this user	Manager@Users Virtual resource: Users is a virtual resource.
Impersonating a user to troubleshoot problems and view pages, portlets, and other portal components.	Can Run As User@Users To use the Can Run As User role, you must enable the impersonation feature and assign the Can Run As User role to an appropriate user.
Create new clippings	Editor@Portlet Applications Virtual resource: Portlet Applications is a virtual resource.
Install a new portlet application WAR file	Editor@Web Modules Virtual resource: Web Modules is a virtual resource.
Update a web module WM by installing a corresponding WAR file	Editor@Web Modules + Manager@WM
Uninstall a web module and removing all corresponding portlet applications and portlets from all pages within the portal	Manager@WM + Manager @ all portlet applications contained in WM
Add a remote WSRP Producer PR to the Portal	Editor@WSRP Producers Virtual resource: WSRP Producers is a virtual resource.
Edit the settings of a remote Producer PR	Editor@PR
View the settings or display the list of portlets provided by a remote WSRP Producer PR	User@PR
Delete a remote WSRP Producer from the portal	Manager@PR
Running commands using the XML configuration interface	Security Administrator@Portal + Editor@XML Access Virtual resources: Portal and XML Access are virtual resources.
Creating, modifying, or deleting a vanity URL that points to page P	Editor@P and Editor@VANITY_URL
Overlay reports Can view overlay reports on a resource.	User@OverlayReports + User@Resource OVERLAY_REPORTS is a virtual resource.
Overlay reports Can view all existing site promotions.	User@SitePromotions SITE_PROMOTIONS is a virtual resource.
Overlay reports Can create a site promotion.	Editor@SitePromotions
Overlay reports Can update an existing site promotion.	Editor@SitePromotions
Overlay reports Can delete a site promotion.	Editor@SitePromotions
Overlay reports Can add a site promotion assignment on specific resource.	Editor@SitePromotions + User@Resource
Overlay reports Can view a site promotion assignment on specific resource.	User@SitePromotions + User@Resource
Site promotions Can remove a site promotion assignment on specific resource.	Editor@SitePromotions + User@Resource

Role Mappings and WSRP services

On the WSRP producer side, we can set the configuration property wsrp.security.enabled to enforce the access control decision for the provided portlets. If this property value is set to true, then all access control decisions in the producing portal are based on the authenticated principal. If wsrp.security.enabled is set to false, then the producing portal does not enforce any access control on incoming client portal WSRP requests.

When using identity propagation, the user authenticated on the client portal needs to have the required role assignments. If no identity propagation is configured, but SSL client certificate authentication is enabled, then the ID of the certificate needs to have the required role assignments. If none of the previously mentioned authentication methods is used, then the request is treated as if coming from the Anonymous Portal Users. In the latter case, the required roles need to be assigned to the Anonymous Portal User, which implies allowing unauthenticated access to the corresponding resources for all users who can access the producer portal.

Parent: Resources, roles, access rights, and initial access control settings

Related tasks: Secure a WSRP Producer portal
Configure security on the Consumer portal
Configure Portal Access Control for a WSRP Producer portal
Adapting the list of required runtime configuration changes for the theme