|
|
Portal-related authorizations in the Roles Database |
Authorization = Person + Function + QualifierYou can create or delete Authorizations in the Roles Database only if you have the authority to do so, which is itself controlled by Authorizations about Authorizations (i.e., "meta-authorizations") within the Roles Database. To create an authorization, you pick a person from the list of people at MIT, a Function from the list of Functions for which you allowed to grant Authorizations, and a Qualifier related to the Function which you are allowed to pick. Functions are grouped into Function Categories (or application areas), and Qualifiers are grouped into Qualifier Types. Each Qualifier Type has a hierarchy of Qualifiers. An authorization granted for a Qualifier which represents the root or a node within the hierarchy applies to all child Qualifiers. Separate "meta-authorizations" can be assigned to allow a person to maintain Authorizations, Functions, and/or Qualifiers. (Many Qualifiers are updated automatically from other sources, but some are maintained by hand.) At the present time, Authorizations and Functions are maintained via the MIT-developed application, which was written in PowerBuilder and can be downloaded for Windows from IS&T's software web site. For Macintosh users, it is available on Citrix.
To give someone the Authorization to do Portal Administration limited to one area, e.g., EHS, connect to the Roles application and give the person the following authorization:
Person Function
CategoryFunction Qualifier the person's Kerberos principal PRTL PORTAL_ADMIN ALL_PORTAL_AREA
Existing Authorizations related to the Portal can be viewed either via the Roles Application or via the Roles Web interface. For a web-based report on all Authorizations for the Portal application, do the following:
Person Function
CategoryFunction Qualifier the person's Kerberos principal PRTL PORTAL_ADMIN EHS
select distinct kerberos_name, function_name, qualifier_code
from expanded_auth_func_qual
where function_category = 'PRTL'
and is_in_effect = 'Y';
Other columns are available, with information about who created the
authorization, when it was created or is due for expiration, the
level in the Qualifier hierarchy at which original Authorization was
granted, etc.. However, the above SELECT statement is probably sufficient
for simply extracting current Authorization information.
You can use a modified version of the SELECT statement to extract
pairs of information, with (a) Kerberos principle and (b) a combined
field derived from the Function and the Qualifier. The following
SELECT statement combines Function and Qualifier, does special processing
for the root qualifier, and changes the strings to lower-case:
select distinct lower(kerberos_name),
lower(replace(function_name || '_' || qualifier_code,
'_all_portal_area', ''))
from expanded_auth_func_qual
where function_category = 'PRTL'
and is_in_effect = 'Y';
As of this writing, Mike Berger, Mike Moretti, and Steve Landry have this Authorization, and they all have the authority to grant or delete it for others. Anyone who has this "meta-authorization" has the authority to create or delete Authorizations in the category PRTL (Portal) that will give people the role of a Portal Administrator in one or more areas. They need to use the Roles application on Windows or the Macintosh. See the "Software at MIT" site to download the application. Another prerequisite for using the Roles DB application is to have a username/password in the Roles DB Oracle database itself. (Mike, Mike, and Steve already have them.) Contact business-help@mit.edu to request a Roles DB username, which must match the MIT Kerberos principal for the person. Then, go to the Roles web site to use a secure web interface to set (or change) your Oracle Roles DB password:
Person Function
CategoryFunction Qualifier the person's Kerberos principal META CREATE AUTHORIZATIONS CATPRTL
As of this writing, Mike Berger, Mike Moretti, and Steve Landry have this Authorization, and they all have the authority to grant or delete it for others. To add, delete, or changes Qualifiers of type PTLA, do the following:
Person Function
CategoryFunction Qualifier the person's Kerberos principal META MAINTAIN QUALIFIERS QUAL_PRTA
ADD!FACILITIES!ALL_PORTAL_AREA!Facilities portal area
As of this writing, Mike Berger, Mike Moretti, and Steve Landry have this Authorization, and they all have the authority to grant or delete it for others. Anyone who has this "meta-authorization" has the authority to create or delete Functions in the category PRTL (Portal) that in turn can be used in Authorizations. You cannot delete a Function if there are still Authorizations assigned for it. As described in the section on maintaining Authorizations, you need to download the Roles application and set up a database username/password for yourself prior to maintaining Functions. We will not describe in detail how to use the Roles application to create Functions. However, we will describe what fields need to be defined in a new Function in the PRTL category. Make sure that you specify the following fields:
Person Function
CategoryFunction Qualifier the person's Kerberos principal META CREATE FUNCTIONS CATPRTL
Function name: A unique name, up to 30 characters, containing upper-case letters, numbers, and common special characters such as underlines, dashes, parentheses, commas, periods, or ampersands. Function description: Up to 50 characters, mixed case Function Category: PRTL Qualifier Type: PRTA