Posted by
Nicolas Malin (Jira) on
Apr 29, 2009; 10:24pm
URL: http://ofbiz.116.s1.nabble.com/jira-Created-OFBIZ-2380-Security-Re-Implementation-tp199288p199291.html
[
https://issues.apache.org/jira/browse/OFBIZ-2380?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12704380#action_12704380 ]
Andrew Zeneski commented on OFBIZ-2380:
---------------------------------------
To answer your first question, if a user has 'update' that is effectively the same as 'update:*', the * is just not needed. If the user has 'update:party' then that would mean 'update:party:*'. We define the most granular permission required when defining the permission for a piece of functionality. So, to update person information the permission would be defined as 'update:party:detail:${partyId}'. The partyId would be expanded at runtime.
The user will need either:
update
update:party
update:party:detail
Or if none of these permissions are associated with the user, then the DA logic kicks in to see if they are allowed to access the single party record.
So,
1. 'update' means update anything in the entire system,
2. 'update:party' means update anything in the party app.
3. 'update:party:detail' means update any party's detail information (name, groupName, etc)
As for you second comment, I'd like to hear more about this. I'm not sure how that would look and what the definition of 'context' is in this case. But I'm happy to add something which are helpful! :) We can take this over to the dev list if you like.
> Security Re-Implementation
> --------------------------
>
> Key: OFBIZ-2380
> URL:
https://issues.apache.org/jira/browse/OFBIZ-2380> Project: OFBiz
> Issue Type: Improvement
> Components: framework
> Affects Versions: SVN trunk
> Reporter: Andrew Zeneski
> Assignee: Andrew Zeneski
> Fix For: SVN trunk
>
> Original Estimate: 504h
> Remaining Estimate: 504h
>
> Parent Task for Security Re-Implementation -- Details defined here:
http://docs.ofbiz.org/x/-B0--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.