Rights | Memority Documentation

Definition

A Right is the security unit that can be granted to an Identity. The Right will be granted through Roles.

A Right is described by:

a name
a category
a security scope

Rights can be split into several categories:

Category	Type	Prefix	Description
Authentication	System	auth	Builtin rights dedicated to managing authentication methods, managed internally.
System	System	sys	Builtin rights used to give access to Memority functionalities
Application	Access	app	Configured rights used to give access to applications. Classic terminology is "access rights", and they are largely used for provisioning only. The "applications" are typically those created as managed resources inside of Memority (although not compulsory).
Asset	Access	asset	Configured rights used to give access to assets (such as mobile phones, external APIs...). The "assets" are typically those created as managed resources inside of Memority (although not compulsory).
Feature	Access	feat	Semi-configured rights used to give access to Features. Those rights are automatically created when new Features are configured. They are used in low-level access control.
Administration	Access	adm	Configured rights used to give access to non builtin functionalities in Memority . Those rights would typically serve in the definition of Feature Access Policies. Beware that granting too many "adm" rights can lead to issues with the JWT token, when it grows too large. Consider using User rights instead, if applicable (see below)
User	Access	user	Configured rights used to give access to external functionalities or to perform access control in high level Memority functions through checks in Rules.

Built-in Rights vs. Configured Rights

In Memority we distinguish between builtin (system) and configured (access) Rights.

Builtin Rights

Builtin Rights are internal and static, and are used to perform access control on core Memority operations (such as creating attribute definitions, updating objects, etc.).

Configured Rights

Configured Rights are mutable and must be managed independently, they declare Rights either for configurable features of Memority or for external needs (rights on provisioning targets typically).

Configuration

🎯

You can access the Rights configuration :

by clicking on "Rights"
by clicking on "System" → "Configurations" and perform an import/export.

Global properties

Domain	Code
Version and encoding : Each Right starts by announcing the version and encoding.	<?xml version="1.0" encoding="UTF-8"?> <kit:DataSet xmlns:ctd="http://www.memority.com/citadel/1_0" xmlns:ctdcore="http://www.memority.com/citadel/core/1_0" xmlns:ctdidm="http://www.memority.com/citadel/idm/1_0" xmlns:ctdrule="http://www.memority.com/citadel/rule/1_0" xmlns:ctdtnt="http://www.memority.com/citadel/tnt/1_0" xmlns:kit="http://www.memority.com/toolkit/1_0" xmlns:rule="http://www.memority.com/toolkit/rule/1_0" xmlns:ruleaddon="http://www.memority.com/toolkit/addons/rule/1_0" xmlns:search="http://www.memority.com/toolkit/search-expression/1_0" xmlns:settings="http://www.memority.com/toolkit/addons/settings/1_0" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <ctdidm:Right id="app.groupeldap"> </ctdidm:Right> </kit:DataSet>
DataSet : Each Right starts by announcing the DataSet. This is the main tag which contains all the other tags.
Right : Each Right has the following configuration to describe it.

Domain

Code

Version and encoding : Each Right starts by announcing the version and encoding.

<?xml version="1.0" encoding="UTF-8"?>
<kit:DataSet xmlns:ctd="http://www.memority.com/citadel/1_0" xmlns:ctdcore="http://www.memority.com/citadel/core/1_0" xmlns:ctdidm="http://www.memority.com/citadel/idm/1_0" xmlns:ctdrule="http://www.memority.com/citadel/rule/1_0" xmlns:ctdtnt="http://www.memority.com/citadel/tnt/1_0" xmlns:kit="http://www.memority.com/toolkit/1_0" xmlns:rule="http://www.memority.com/toolkit/rule/1_0" xmlns:ruleaddon="http://www.memority.com/toolkit/addons/rule/1_0" xmlns:search="http://www.memority.com/toolkit/search-expression/1_0" xmlns:settings="http://www.memority.com/toolkit/addons/settings/1_0" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <ctdidm:Right id="app.groupeldap">
   </ctdidm:Right>
</kit:DataSet>

DataSet : Each Right starts by announcing the DataSet.
This is the main tag which contains all the other tags.

Right : Each Right has the following configuration to describe it.

Configuration

Properties

Property name	Type	Mandatory	Description	Values	Modifiable after creation
id	`String`	YES	The id is the unique identifier of each Right. It is case sensitive and no special characters (except - or _) are allowed.	-	NO
category	`Enum`	YES	Allows to choose the category of the Right.	SYSTEM, APPLICATION, ASSET, FEATURE, ADMINISTRATION	NO
scope	`Enum`	YES	Allows to choose the scope of the Right.	GLOBAL, RESOURCE	NO
description	`String`	NO	Allows to describe the purpose of the Right.	-	YES

Example

XML

<ctdidm:Right id="adm.right2">
	<category>ADMINISTRATION</category>
	<scope>GLOBAL</scope>
	<description>Right to Access 1</description>   
</ctdidm:Right>

Dimensions

Properties

Property name	Type	Mandatory	Description	Values (default value in bold)
key	`String`	YES	The unique key of each dimension.	-
type	`Enum`	YES	The type of the dimension.	STRING, BOOLEAN, FLOAT, INTEGER, IDENTITY_REF, ORGANIZATION_REF, RESOURCE_REF, ROLE_REF, ROLE_PUBLICATION_REF
order	`Integer`	NO	Indicates the display order of dimensions. If two dimensions have the same priority, a random display is executed.	0, 1, 2, 3, 4...
forManualProvisioning	`Boolean`	NO	Allows to define if the dimension is required as manual provisioning.	true, false
multivalued	`Boolean`	NO	Indicates if the dimension can have several values.	true, false
mandatory	`Boolean`	NO	Indicates if the dimension is mandatory when assigning the Role.	true, false
validationRules	`Rule`	NO	Allows to create a validation rule for the value of the dimension and to associate an error message. It is possible to configure several validation rules.	-
normalizationRules	`Rule`	NO	Allows to normalize data and therefore to modify the entered value of the dimension if it does not correspond to the rule. It is possible to configure several normalize rules.	-
choicesRule	`Rule`	NO	Allows to create a choices list to define the value of the dimension by using: Reference Table Resource Type Groovy Script Only if the value type = STRING	-
initializationRules	`Rule`	NO	Allows to define a dimension value, which will be displayed when the requester accesses the role assignment.	-
displayCondition	-	NO	Allows to define when the dimension will be displayed or not. Available contexts: OBJECT. DIMENSION. OPERATION.	-
tags	`Enum`	NO	Allows to define tag(s) on each dimension. These tags will be reused on the configuration of a Role Request Policy and Role Request Widget to manage dimensions (editable or not).	-
detail	`Boolean`	NO	Allows to define if the dimension should be displayed in the Role Dashboard.	true, false

Example

<dimensions>
	<dimension>
		<key>dim1</key>
		<type>STRING</type>
		<order>0</order>
		<forManualProvisioning>false</forManualProvisioning>
		<multivalued>false</multivalued>
		<mandatory>false</mandatory>
		<validationRules/>
		<normalizeRules/>
		<choicesRule class="choicesReferenceTable">
			<config xsi:type="ctdrule:ReferenceTableChoicesConfigurationType">
				<referenceTableId>access-adp-profiles</referenceTableId>
				<columnIndex>0</columnIndex>
				<i18nPrefix>ui.model.dimension.adp.profile.values</i18nPrefix>
 			</config>
		</choicesRule>
		<tags/>
		<detail>true</detail>
	</dimension>
</dimensions>

Target and Privilege Mappings

A Role defines a set of Rights that will be automatically granted to Identities.

The following conditions are expected to be valid:

the bound right Target
Privilege
Dimensions

The Target Mapping is a mapping used to computed the target on the Right. Only required for RESOURCE scoped rights.

The Privilege Mapping is a mapping expression used to computed the privilege on the Right. Only required for Rights that expect a privilege.

Properties - Value Type

Property name	Type	Mandatory	Description	Values (default value in bold)
targetMapping or privilegeMapping	-	NO		-
type	`Enum`	YES	Allows to define the type of the mapping.	VALUE
value	`Dimension type`	YES	Explicitly indicate the dimension value.	*, id of the feature etc...

Example

<targetMapping>
	<type>VALUE</type>
	<value>*</value>
</targetMapping>

<targetMapping>
	<type>VALUE</type>
	<value>LDAP%GROUPLDAP</value>
</targetMapping>

Properties - Direct type

Property name	Type	Mandatory	Description	Values (default value in bold)
targetMapping or privilegeMapping	-	NO		-
type	`Enum`	YES	Allows to define the type of the mapping.	DIRECT
rightDimensionId	`Dimension name`	YES	Explicitly indicate the dimension name.	-

Example

<targetMapping>
	<type>DIRECT</type>
	<rightDimensionId>target</rightDimensionId>
</targetMapping>

Properties - Expression type

Property name	Type	Mandatory	Description	Values (default value in bold)
targetMapping or privilegeMapping	-	NO		-
type	`Enum`	YES	Allows to define the type of the mapping.	EXPRESSION
rule	`Groovy`	YES	Explicitly indicate the Groovy rule.
rightDimensionId	`Dimension name`	YES	Explicitly indicate the dimension name.	-

Example

<privilegeMapping>
	<type>EXPRESSION</type>
	<rule>
		<script><![CDATA[
return "${DIMENSION.sourceDimensions["GroupName"]}"
]]></script>
	</rule>
	<rightDimensionId>privilege</rightDimensionId>
</privilegeMapping>

Properties - None type

Property name

Type

Mandatory

Description

Values (default value in bold)

targetMapping or privilegeMapping

type

Enum

YES

Allows to define the type of the mapping.

Considered as "exposed".

NONE

Example

<targetMapping>
	<type>NONE</type>
</targetMapping>

Definition

Built-in Rights vs. Configured Rights

Builtin Rights

Configured Rights

Configuration

Global properties

Configuration

Properties

Example

Dimensions

Properties

Example

Target and Privilege Mappings

Properties - Value Type

Example

Properties - Direct type

Example

Properties - Expression type

Example

Properties - None type

Example

Read Next