Borland VisiBroker® 7.0 - Borland Technical Publications

Defining access control with Role DBThe Role DB file is used to determine the access rights of principals (client identities).Each role defined in the Role DB has client identities assigned to it. Access rights aregranted based on roles rather than specific client identities. For example, theapplication may recognize a Sales Clerk role. User identities for all sales clerks can beassigned to the Sales Clerk role. Later, the Sales Clerk role is granted the right toperform certain operations, such as an add_purchase_order method, for example. Allsales clerks associated with the Sales Clerk role are able to performadd_purchase_order.Anatomy of Role DBThe Role DB file itself has the following form, and can contain multiple role entries:role-name {assertion1 [, assertion2, ... ]...[assertion-n]...}role-name2 {assertion3 [, assertion4, ... ]...[assertion-n]...}A role entry is made up of a role name and a list of rules within curly braces (“{}”). A rolemust be made up of one or more rules. Each rule is a single line containing a list ofcomma-separated assertions for proper access identifications. Similarly, each rulemust contain one or more assertions.Each line in the Role Entry is a rule. Rules are read top-to-bottom, and authorizationproceed until one succeeds or none succeed. That is, each rule is read as thoughseparated by an “OR” operator. Assertions are separated on the same line by a comma(“,”). Assertions are read left-to-right, and all assertions must succeed in order for therule to succeed. That is, each assertions in a rule is read as though separated by an“AND” operator.Each rule must contain all necessary security information for a given Principal'ssecurity credentials. That is, each principal must have at least those attributes requiredfrom the rule—or exactly all the listed attributes. Otherwise authorization will notsucceed.Assertion syntaxThere are a variety of ways to specify rules using logical operators with attribute/valuepairs that represent the access identifications necessary for authorization. There isalso a simplified syntax using the wildcard character (“*”) to give your rules moreflexibility. Both of these are discussed below.44 VisiBroker Security Guide