Grouper Training Developers and Architects How to Design Permissions Shilen Patel Duke University This work licensed under a Creative Commons Attribution-NonCommercial 3.0 Unported License.

Introduction Permission definitions Permission names Actions Roles Permission assignments Limits Inheritance Application integration 2 Contents

Introduction 3 Attributes Roles Permissions Attribute definition Permission definition Role inheritance Delegation model extends that for Groups

Type of attribute definition where the type of attribute is permission. Typically have one definition for a set of permission names (resources) and actions. Also contain security information. Who can create permission assignments using a given definition? Who can see permission assignments? 4 Permission Definitions

Permission names are the “resource” in the permission triple. Typically have more than one per permission definition. 5 Permission Names

Each permission definition can have a set of actions that can be used to form permissions using that definition. Actions are free form strings (e.g. “read”, “write”, “admin”) 6 Actions

Special type of groups. Unlike regular groups, roles can be associated directly with permission assignments. Roles can also have permission inheritance. 7 Roles

Contain the triple Subject (role or a specific subject within a role) Action Resource (the permission name) Start and end dates Permission will start on a future date. Permission will end on a future date. 8 Permission Assignments

Allowed versus disallowed permissions Permission processor will resolve conflicts when performing permission queries (e.g. PermissionFinder.hasPermission()) Direct assignments trump inherited assignments A lower depth inherited assignment trumps a higher depth inherited assignment (on the directed graph of inheritance) Inherited ALLOW assignments (of equal depth) trump inherited NOT_ALLOW assignments 9 Permission Assignments (continued)

Runtime constraints on permissions assignments. There are many built-in limits (such as Weekday 9 to 5). When querying permissions using the permission processor, you can supply limit values (e.g. current time). Can only apply to permissions that are allowed (not disallowed). 10 Limits

Role inheritance – One role inherits permissions of another role (e.g. senior manager inherits permissions assigned to a manager.) Resource inheritance – Permission on one resource implies permission on another. Useful in hierarchies (e.g. read access on the OIT resource within an application implies read access on OIT:IDM) 11 Inheritance

Action inheritance – One action implies another (e.g. admin implies read). Group membership – Adding a group as a member of a role. 12 Inheritance (continued)

Using the Grouper change log to propagate permissions to an external application. Change log events occur when permissions are added or dropped. Change log will tell you which roles have permission changes. Change log category is “permission” and change log action is “permissionChangeOnRole” 13 Application Integration

Application can look up permissions using Grouper Web Services. Possible approach for custom applications. Need to consider caching especially if permissions are fine-grained. Can also send limit values in permission queries and simply get a boolean response for whether the user has the permission. 14 Application Integration (continued)

Grouper views Useful for read-only queries when the permission processor is not needed. grouper_perms_assigned_role_v – shows all permissions assigned to roles. grouper_perms_role_v – shows all permissions assigned to users due to the users being in a role, and the role being assigned the permission. grouper_perms_role_subject_v - shows all permissions assigned to users directly while in a role. grouper_perms_all_v – Union of grouper_perms_role_v and grouper_perms_role_subject_v. Grouper API 15 Application Integration (continued)

Click on the quiz link in the video description to reinforce your knowledge of this topic. 16 Quiz

Thanks! Further information: Infosheets, mailing lists, wiki, downloads, etc.: Grouper demo server: grouperdemo.internet2.edu/ grouperdemo.internet2.edu/ Grouper Online Training Home: spaces.internet2.edu/x/IIGfAQ This work licensed under a Creative Commons Attribution-NonCommercial 3.0 Unported License. 17