|
|
Command-level or role-based access controlCommand-level or role-based access control is coarse access control. It determines "who can do what." With role-based access control, you can specify that all users of a particular role can execute certain commands. Consider this access control policy: Sellers can execute sellers commands, in which one of the sellers commands is the ModifyAuction command. Role-based access control is used for controller commands and views. This type of access control does not consider the data resource that the command acts on. It only determines whether the user is allowed to execute a particular controller command or view. This level of access control is mandatory and is enforced by the Runtime. All controller commands must be protected by command-level access control. In addition, any view that can be called directly or that can be launched by a redirect from another command (in contrast to being launched by forwarding to the view) must be protected by command-level access control. Command-level access control for controller commands: Whenever you run a controller command, an access control policy must exist that grants users the right to perform the Execute action on the command resource. The resource is the interface name of the controller command. The access group is usually geared to a single role. For example, you can specify that users with the Account Representative role can execute any command in the resource group AccountRepresentativesCmdResourceGroup. Command-level access control for views: When a view is called directly from the URL, or is the result of a redirect from a command, it must have an access control policy. Such a policy must have the viewname specified as an action, in the ACACTION table. This action must then be associated with an action group, using the ACACTACTGP table. This action group must then be referenced in the appropriate command-level policy, in the ACPOLICY table. |
 ibm.com/redbooks |