User authorisation is the process of determining whether a user has the permission to access functionality in the Verne. Also known as access control.
Verne employs a permission-based security model that controls user access to the system. This allows control over the functions users have access to, as well as the data they have access to. Users inherit permissions via permission groups and permission pools. Permissions are NOT assigned to a user directly.
The process by which authorisation for a function is tested and granted/or not relies on three things:
- The function that authorisation is being sought for.
- The permission(s) the function requires to grant authorisation.
- The user that is requesting authorisation and the permission(s) they inherited.
Permissions required and the permissions held are established and compared to see whether they match.
Verne ensures all access to functionality and data takes place through the application itself, with access controlled by the Verne security model. Foster Moore works with clients through all Verne installations to ensure that all servers, including application, web and database servers, are adequately secured from unauthorised access. Read more about Verne security model on the Verne Security Core page.
Note, that access control to the items on the work queue does not employ permission-based security model and uses the concept of teams instead.
