public class RoleType extends AbstractRoleType implements Serializable, Cloneable
<?xml version="1.0" encoding="UTF-8"?><p xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3" xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" xmlns:jaxb="http://java.sun.com/xml/ns/jaxb" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:xjc="http://java.sun.com/xml/ns/jaxb/xjc" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> A role in the extended Role-Based Access Control (RBAC) sense. The roles specify privileges that the user (or other object) should have. </p>
<?xml version="1.0" encoding="UTF-8"?><p xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3" xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" xmlns:jaxb="http://java.sun.com/xml/ns/jaxb" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:xjc="http://java.sun.com/xml/ns/jaxb/xjc" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> The role may "grant" accounts on resources, attributes and entitlements for such accounts. The role can also assign organizational units, other roles or various IDM objects that can be assigned directly to user. From this point of view the role is in fact just a named set of assignments. </p>
<?xml version="1.0" encoding="UTF-8"?><p xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3" xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" xmlns:jaxb="http://java.sun.com/xml/ns/jaxb" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:xjc="http://java.sun.com/xml/ns/jaxb/xjc" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> The roles form the basic building block of midPoint's extended role-based access control (RBAC) mechanism. It defines what rights (e.g. accounts) should be given to user, how they should look like (attributes) and what groups or native roles to assign to them (entitlements). </p>
<?xml version="1.0" encoding="UTF-8"?><p xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3" xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" xmlns:jaxb="http://java.sun.com/xml/ns/jaxb" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:xjc="http://java.sun.com/xml/ns/jaxb/xjc" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> Roles can also specify user authorizations to access specific parts of midPoint. This is used to implement fine-grained authorization mechanism. When combined with organizational structure it forms a delegated administration mechanism. </p>
<?xml version="1.0" encoding="UTF-8"?><p xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3" xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" xmlns:jaxb="http://java.sun.com/xml/ns/jaxb" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:xjc="http://java.sun.com/xml/ns/jaxb/xjc" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> Roles can also be conditional, i.e. applicable only if a specific condition is true. Roles can be parametric, e.g. the expressions inside the role can use parameters that were specified at the time when the role was assigned (as opposed to parameters defined when the role was defined). </p>
Java class for RoleType complex type.
The following schema fragment specifies the expected content contained within this class.
<complexType name="RoleType"> <complexContent> <extension base="{http://midpoint.evolveum.com/xml/ns/public/common/common-3}AbstractRoleType"> <sequence> <element name="roleType" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/> </sequence> </extension> </complexContent> </complexType>
Modifier and Type | Field and Description |
---|---|
static QName |
COMPLEX_TYPE |
static QName |
F_ROLE_TYPE |
F_APPROVAL_PROCESS, F_APPROVAL_SCHEMA, F_APPROVER_EXPRESSION, F_APPROVER_REF, F_AUTHORIZATION, F_AUTOMATICALLY_APPROVED, F_CONDITION, F_DISPLAY_NAME, F_EXCLUSION, F_IDENTIFIER, F_INDUCEMENT, F_OWNER_REF, F_POLICY_CONSTRAINTS, F_REQUESTABLE, F_RISK_LEVEL
F_ACTIVATION, F_ASSIGNMENT, F_ITERATION, F_ITERATION_TOKEN, F_LINK, F_LINK_REF
F_DESCRIPTION, F_EXTENSION, F_FETCH_RESULT, F_METADATA, F_NAME, F_PARENT_ORG, F_PARENT_ORG_REF, F_TENANT_REF, F_TRIGGER
Constructor and Description |
---|
RoleType() |
RoleType(com.evolveum.midpoint.prism.PrismContext prismContext) |
Modifier and Type | Method and Description |
---|---|
RoleType |
clone() |
String |
getRoleType() |
void |
setRoleType(String value) |
getApprovalProcess, getApprovalSchema, getApproverExpression, getApproverRef, getAuthorization, getAutomaticallyApproved, getCondition, getDisplayName, getExclusion, getIdentifier, getInducement, getOwnerRef, getPolicyConstraints, getRiskLevel, isRequestable, setApprovalProcess, setApprovalSchema, setAutomaticallyApproved, setCondition, setDisplayName, setIdentifier, setOwnerRef, setPolicyConstraints, setRequestable, setRiskLevel
asPrismContainer, asPrismContainerValue, asPrismObject, equals, getActivation, getAssignment, getIteration, getIterationToken, getLink, getLinkRef, hashCode, setActivation, setIteration, setIterationToken, setupContainer, setupContainerValue, toDebugName, toDebugType, toString
getDescription, getExtension, getFetchResult, getMetadata, getName, getOid, getParentOrg, getParentOrgRef, getTenantRef, getTrigger, getVersion, setDescription, setExtension, setFetchResult, setMetadata, setName, setOid, setTenantRef, setVersion
public static final QName COMPLEX_TYPE
public static final QName F_ROLE_TYPE
public RoleType()
public RoleType(com.evolveum.midpoint.prism.PrismContext prismContext)
public String getRoleType()
public void setRoleType(String value)
public RoleType clone()
clone
in class AbstractRoleType
Copyright © 2015 Evolveum. All rights reserved.