Security

A permission gives access to a piece of data, business service or a function on the Verne register. In other words it protects a specific resource in the registry system. In order to grant access to the users a corresponding permission must be granted via a permission group or inherited via a permission pool. A user who has no permissions granted or inherited cannot access any registry resources.

Permissions are logically grouped into permission sets. Permission sets are tags/labels that are a way of managing similar permissions together, e.g. ‘work management’, ‘searches’ etc.

A permission has the following attributes:

• Code – a unique code for the permission, e.g. P011
• Name – name of the permission, e.g. Edit form
• Description – descriptive text explaining the permission
• Status – indicates if the permission is active or inactive, e.g. active
• SystemName – a unique code for the permission that is used in the configuration
• SystemYn – indicates if this permission is a permission that cannot be granted by a user

All permissions are stored using the same mechanism as all other data, via service transactions, with a current activated version and previous versions of the data.

The Domain Tree for a Permission is as follows:

{
  "_id": "<unique_domain_id>",
  "name": "User",
  "attributes":{
    "Code":"P011",
    "Name":"Edit form",
    "SystemName":"PERM_P011_EDIT_FORM",
    "Status":"active",
    "Description":"Access to edit and save details of the form of the business service instance that is associated with the task.",
    "SystemYn":"N"
  },
  "permissionSets":[
    {
      "_id":"<unique_domain_id>",
      "name":"PermissionSet",
      "arrName":"permissionSets",
      "attributes":{
        "Name":"Work management"
      }
    }
  ]
}

Notes:

1. The permissionSets array may contain 0 or more PermissionSet domains for each Permission Set a permission ‘belongs’ to.