Using Filters in etrust IAM Policies 2

Transcription

1 Using Filters in etrust IAM Policies Using Filters in etrust IAM Policies 2 1. Policy Filters How to build filters to use in searches? Building Filters Filter Examples of 15

2 Using Filters in etrust IAM Policies 1. Policy Filters In searches we can limit the search by specifying the conditions through filters. Similarly in Policies, you can further limit the access policy through these filters. We can also define multiple filters combining them into groups using and/or operations just the way we define conditions in "where" clause while searching the database. Filters are attached to the policies to limit the scope of a policy. etrust IAM uses filters during the evaluation phase of the policy evaluation process. Basic structure of a filter Each filter consists of the following components: The connector to the previous filter (logic) (Optional) One or more left parentheses before the expression A sub-expression, consisting of a left-hand side value, an operator, and a right-hand side value (Optional) One or more right parentheses after the expression The Filter takes in 7 arguments. They are logic, lparens, col, optype, oper, val, and rparens in order. Let's see what they actually mean: Parameter Description logic lparens constant int value from SafeEnum.Logic number of left parens Overview Logic is used to represent the logic between each ordered filter. The available SafeEnum.Logic values are AND, OR, LAST, NONE. This is for the logical grouping of filters. Works together with right parens col the column field This is the left side value of the condition optype oper constant int value from SafeEnum.OpType constant int value from SafeEnum.Oper OpType is used to set the operator's data type, the data type is used for proper evaluation of filters. Oper is used to represent the operator. Available operations are like, notlike, equal, notequal, match, notmatch, withinset, notinset, startswith, endswith, greater, greaterequal, less, lessequal, contains. 2 of 15

3 val the value field This represent the left side value of the condition rparens number of right parens These are count of number closing braces to end a group of conditions. Example: Build a filter which limits the search of Users whose FirstName is equal to "Ravi" and whose Jobtitle is Manager. Observe what our condition is - "FirstName" "is equal to" "Ravi" and "Jobtitle" "is equal to" "Manager". Analyzing in the same manner as above will get us: 'FirstName=Ravi and JobTitle=Manager' 1st Filter : new SafeFilter(SafeEnum.Logic.NONE, 0, "A:FirstName", SafeEnum.OpType.STRING, SafeEnum.Oper.EQUAL, "Ravi", 0); 2nd Filter : new SafeFilter(SafeEnum.Logic.NONE, 0, "A:JobTitle", SafeEnum.OpType.STRING, SafeEnum.Oper.EQUAL, "Manager", 0); Filters are ordered in IAM. So, in the logic of second filter, we must use "AND" logic instead of "NONE" logic. And we have added to List in the same order. So, finally it looks like: List filterq = new ArrayList(); filterq.add(new SafeFilter(SafeEnum.Logic.NONE, 0, "A:FirstName", SafeEnum.OpType.STRING, SafeEnum.Oper.EQUAL, "Ravi", 0)); filterq.add(new SafeFilter(SafeEnum.Logic.AND, 0, "A:JobTitle", SafeEnum.OpType.STRING, SafeEnum.Oper.EQUAL, "Manager", 0)); List globalusers = safecontext.searchglobaluser(filterq); 2. How to build filters to use in searches? In the SafeContext class, we have many search methods using which we can search for application instances, calendars, appobjects, policies, user groups, global user groups, users and global users. And by implementation all the mentioned objects are inherited from Safe Stored Object class. This is because all these objects are stored. We will refer to any of these objects commonly as stored objects. When searching for stored objects, use "cn" to refer to the Name of the object.that is: List filterq = new ArrayList(); 3 of 15

4 filterq.add(new SafeFilter(SafeEnum.Logic.NONE, 0, "cn", SafeEnum.OpType.STRING, SafeEnum.Oper.LIKE, "app*", 0)); // Build the filter and just call the appropriate search method. List globalusergroups = safecontext.searchapplicationinstances(filterq); 3. Building Filters You can use filters to manage searches. Filters are similar to the 'where' clause in the databases when used in searches. You can define multiple filters by combining groups using the AND and OR operations. The easiest way to read filters is to string them together, ignoring the logic in the initial filter. For example: Logic ( Left type/value Operator Right type/value ) (ignore) named attribute: ward == value: ER AND ( named attribute: ward == user: ward OR ( named attribute: doctor == global user: UserName AND user group: Name == value: Doctors )) The following fields are available in each filter: Logic Indicates the connector to the previous filter that is ignored for the first filter. ( and ) Indicates how the sub-expressions are grouped, which affects the logic. Left type/value and Right type/value Specifies a type and value for the sub-expression. The possible values vary based on the selected type. The type can include any of the following: 4 of 15

5 global user Specifies a global user attribute, as follows: User Name First Name Middle Name Last Name Alias Job Title Company Department Office Work Phone Number Fax Phone Number Mobile Phone Number Home Phone Number Address City State Postal Code Country Mail Stop Address Description Incorrect Login Count Suspended Comments Group Membership Display Name Password Change Date Password Expire Time Suspended Date Disable Date Enable Date Change Password Next Login Override Password Policy Password Time to Warn Parent Path global user group Specifies a global user group attribute, as follows: Name Description Group Membership Parent Path 5 of 15

6 user Specifies a user attribute, as follows: Name Group Membership Parent Path Terminology Preference JobFlowMonitoringRefreshInterval JobFlowOverviewRefreshInterval JobEditObjectDisplayCount Note: User values are application-specific. This list will change for each etrust IAM application. user group Specifies a user group attribute, as follows: Name Description Group Membership Parent Path named attribute Specifies a resource attribute (passed in with the authorization request), as follows: Resource Class Named Attributes AlertAction component - the name of the component issuing nametype - View or Server name - viewname or servername ApplicationAccess component - the name of the component issuing category the category for a set of applications name a specific application within the application category CommandExecute component - the name of the component issuing servername the name of the server command command to be executed on the given server CommandSetup component - the name of the component issuing mode local or global cmdname the name of the command specification in the local or global command set 6 of 15

7 Resource Class Named Attributes JobActionAutoSys component - the name of the component issuing nametype view or server name name of the view or server JobActionCA7 component - the name of the component issuing nametype view or server name name of the view or server LogAccess component - the name of the component issuing servername the name of the server MonitorViewControl component - the name of the component issuing viewname name of the view objecttype JobFlow, PriorRun, or RunLog ObjectAccess component - the name of the component issuing servername the name of the server objecttype AlertPolicy, Calendar, Cycle, ExtendedCalendar, GlobalVariable, Job, Jobset, Report objectname the name of the object ObjectControl component - the name of the component issuing servername the name of the server objecttype AlertPolicy, ARFDef, ARFSet, Calendar, Cycle, Dataset, ExtendedCalendar, GlobalVariable, Job jobtype Box, CA-7, Command, FileWatcher, InfoPackage, ProcessChain, SAP, WebServices, UserDefinedX objectsubtype Predecessor, Schedule, Trigger predtype Dataset, Job, Network, UserRequirement, VRM PortletAccess component - the name of the component issuing category the category for a set of portlets name a specific portlet within the portlet category ServerAccess component - the name of the component issuing type - AutoSys, CA7, or Event servername the name of the server Note: Named Attributes are application-specific. This list will change for each etrust IAM application. Components are comprised of the following: Applications: Configuration JobEditor 7 of 15

8 JobFlowDesign JobFlowMonitoring JobFlowOverviewEditor JobStatusConsole EventConsole HostAccess WebServicesBasic WebServicesAdvanced SecurityConfiguration Reporting QuickView Portlets: QuickStart ServerStatus ServicesStatus CredentialGroupSummaryStatus CredentialUserSummaryStatus CCILinkStatus CredentialUserPasswordModification JobEditorCreateObject JobEditorFindObject JobFlowOverview JobStatusViews CommandLine session Specifies a session attribute, as follows: ses:{name} evaluates to the value(s) of the session's attributeq (sessionattrq) matching {name} Enter the name of the session attribute in the value. environment Specifies an environment attribute, as follows: Env:{name} evaluates to the value(s) of the environment attributeq (envattrq) maching {name} Enter the name of the environment attribute in the value. 8 of 15

9 request Specifies a request attribute, as follows: req:{identity action resource when delegator} evaluates to the corresponding values from the permission check request value Specifies an open-ended value. Enter the value. val:{data} evaluates to the single value of {data} Operator dynamic user group Specifies a dynamic user group by its name. dug:name evaluates to the name(s) of the Dynamic UserGroups the identity belongs to. request time (when) calculation Specifies the offset in minutes from the current request time. For example, "-360" means 10 hours before the current request, and "60" means one hour after the current request. when:{offset} evaluates to req:when offset by the {offset} ({offset} is specified in minutes). Sets the offset in minutes from the current request time. For example, "-360" means 10 hours before the current request, and "60" means one hour after the current request. Specifies an XML-based formula to be performed during policy evaluation. This opens the Calculation Editor. calc:{calculation} evaluates to result of the {calculation} Indicates the datatype and operator with which to evaluate the subexpression, as follows: Datatype Specifies one of the following datatypes: Notype STRING INT32 9 of 15

10 Operator UINT32 REAL32 REAL64 TIMESTAMP REGEX XPATH BOOLEAN Note: You must ensure that the datatype selected matches the datatype of the type/value being evaluated. Specifies one of the following operators: NONE EQUAL == NOTEQUAL!= LESS < GREATER > LESSEQUAL <= GREATEREQUAL >= LIKE ~ NOTLIKE!~ WITHINSET {} NOTINSET!{} STARTSWITH --* ENDSWITH *-- CONTAINS *--* The following buttons and icons are available: Add Filter Adds another empty filter to the end of the list. Remove Removes the associated filter. Show Calculation Editor Displays the Calculation Editor so that you can manipulate attribute values before a comparison. 10 of 15

11 4. Filter Examples Global User: Example 1: Policy will restrict the allowed users to only those whose first names begin with an A. Example 2: Policy will restrict the allowed users to only those whose office is New York. Example 3: Policy will restrict allowed users to those whose office is New York, and whose last name is either Smith or Singh. Global User Group: Example 1: Policy will restrict allowed users to those who are in the Global User Groups with names that begin with WCC*. User: Example 1: Policy will restrict allowed users to those with a terminology preference of Native. 11 of 15

12 Named Attribute: Example 1: Policy will only allow access to the Job Flow Monitoring component. Dynamic User Group: Example 1: Policy will allow access only to users whose dynamic user group is not equal to Operator. Session: Example1: Here we are building a filter based on the session of global user headnurse. Policy: The entire Chiefs global group can read any billing data. If we want only headnurse can only read the data who is member of Chiefs. We are defining filter as shown below. Example 2: Chiefs can read any billing data, where nurse is member of the group chiefs 12 of 15

13 Request: Example 1: Filter based on request for a resource. Filter for: Chiefs can enter any ward except office. Example 2: Office workers can read/write any safeobject except policies Example 3: Request in combination with when Chiefs can enter any ward with in 1 hour Example 4: Combinations of request and named attribute.( Delegation Policy) Filter: if worker delegates his rights to the head doctor for global users and users in the Medical subfolder 13 of 15

14 Selected Identities are Resources are: Filter: Calculation: Example 1: If the calculation defined in the filter evaluates to true then only, the permission check on that policy evaluates to true. Access policy for door resource class: Door should be opened by erdoctor only Filter: 14 of 15

15 Example 2: Calculation on Integer operations Example 3: Calculation on REAL32 operations Example 4: Calculation with TIMESTAMP Custom variable and Request time: Custom variable and Request time filter conditions are used to be only through SDK. These filters are meant only for developers integrating etrust IAM into their applications. Usage of these filters through UI is not intended/encouraged. 15 of 15