Borland VisiBroker® 7.0 - Borland Technical Publications

Security ProfilesConfiguring AuthorizationYou can configure authorization by either creating your own Authorization Rolemap byhand or by using the Management Console.About the rolemap fileThe authorization rolemap is captured in a .rolemap file. Typically, you would name thisfile after your authorization domain (for example, a profile called “default” wouldtypically call its rolemap default.rolemap) but this is not required. The rolemap file, alsocalled Role DB, is a map of users to roles, or access control list. Typically, an accesscontrol list specifies a set of roles that can use a particular resource. The rolemapdesignates the set of people whose attributes match those of particular roles, and whoare then allowed to perform those roles.VisiSecure provides a mechanism for specifying role names and a set of attributeswhich define the roll. For example, the contents of Role DB could be:ServerAdministrator {CN=*, OU=Security, O=Borland, L=San Mateo, S=California, C=US*(CN=admin)*(GROUP=administrators)}Customer {role=ServerAdministrator*(CN=borland)*(CN=pclare)*(CN=jeeves)*(GROUP=RegularUsers)}This defines two roles, ServerAdministrator and Customer along with a set of rules andattributes which define them. For information on how to define roles and write acustomer rolemap, see Chapter 4, “Authorization.”Once the rolemap file is complete, it is placed in the profile's folder with the config.jaasfile.Configuring Authorization Using the Management ConsoleYou use the Authorization Settings dialog to configure Authorization for a SecurityProfile. With this you can:■■■■View authorization rolemaps and rules.Add, edit, and remove authorization rolemaps for a domain.Add, edit, and remove roles within an authorization rolemap.Add, edit, and remove rules within a role.56 VisiBroker Security Guide