Security Guide

     Previous  Next    Open TOC in new window    View as PDF - New Window  Get Adobe Reader - New Window
Content starts here

Configuring Delegated Administration

This chapter provides an overview of how to configure delegated administration using the WebLogic Portal Administration Console. Delegated administration provides a mechanism for propagating WebLogic Portal Administration Console privileges within a hierarchy of roles.

In your organization, you typically want individuals to have different access privileges to various administration tasks and resources. For example, a system administrator might have access to every feature in the WebLogic Portal Administration Console. The system administrator might then create a portal administrator role that can manage instances of portal resources in specific desktop views of your portal, and a library administrator role that can manage your portal resource library.

WebLogic Portal has one predefined delegated administration role, PortalSystemDelegator. By default, all members of the Administrators group are assigned the PortalSystemDelegator role. Anyone assigned the PortalSystemDelegator role has unlimited access to administrative tasks anywhere in the enterprise portal application. Other delegated administration roles only have access to resources if that access has been explicitly granted.

You can create as many different administrators as you need by creating administrator roles and then assigning role membership dynamically, based on username, group membership, user profile property values, session and request attributes, and date and time functions.

You can use delegated administration to propagate access privileges within a hierarchy of roles that define the structure for delegated administration. You have flexibility in the way you set up your administration hierarchy and assign privileges to your administrators. Given the appropriate privileges, administrators can delegate both the privilege to administer a given resource capability and the privilege for the delegatee to delegate further. For additional information on role hierarchies, see Setting Up a Delegated Administration Role Hierarchy.

This chapter includes the following sections:

 

Creating Delegated Administration Roles

Perform the following steps to create a new delegated administration role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the parent role for which you want to create a new child role. The PortalSystemDelegator role is the top level parent role, and exists before any other delegated administration roles have been created.
  3. From the Browse Roles tab, click Create New Role.
  4. In the dialog box that appears, enter the name of the new role, and optionally, a description, and click Create.
    5. Figure 7-1 Create New Role Dialog


    Create New Role Dialog

The new delegated administration role appears in the resource tree.

You can now define the role by adding users to the role, adding groups to the role, or using expressions. For more information, see Adding Users, Groups, and Conditions in Delegated Administration Roles.

Note: When you are establishing your delegated administration role hierarchy, child role names must be unique. For example, you cannot have a delegated administration role called RoleA with a child role of RoleB if you already have a child role called RoleB elsewhere in the hierarchy.

 

Adding Users, Groups, and Conditions in Delegated Administration Roles

Once you create delegated administration roles in the WebLogic Portal Administration Console, you can assign users and groups to them. You can also use expressions, based on use profile properties, dates, and times, to determine who is assigned a delegated administration role.

Figure 7-2 shows the Details tab for the PortalSystemDelegator role.

Figure 7-2 PortalSystemDelegator Role - Details Tab

PortalSystemDelegator Role - Details Tab

Adding Users to Delegated Administration Roles

When you add a user to a role, you grant that user access the administrative privileges attributed to that role. This section describes how to add one or more users to a role.

If you have a large number of users you want to add to a role, for the best performance add users to groups, then create roles with those groups, or use expressions.

Tip: Roles can sometimes be mapped directly to groups. The difference between groups and roles is that group membership is statically assigned by a server administrator, while role membership is dynamically determined based on information including the username, user profile property values, group membership, and dates and times. Roles can also be scoped to specific WebLogic resources within a single application in a WebLogic Server domain, while groups are always scoped to an entire WebLogic Server domain.

Perform the following steps to add one or more users to a delegated administration role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role for which you want to add users.
  3. Select the Users in Role tab.
  4. Click Add Users To Role.
  5. If necessary, find the users you want to add to the role using the Search feature. Users appear in the Search Results section.
    6. Tip: If you are using an SQL authentication provider, be aware that user names are case sensitive. For example, user Bob is different than user bob.
  6. Select the check box next to each user you want to add, and click Add. Selected users now appear in the Users to Add section.
  7. Click Save.

Any users you have added now appear in the Users in Role section of the Details and Users in Role tabs.

Adding Groups to Delegated Administration Roles

When you add a group to a role, you grant the members (users) of that group—and users in any sub-groups of that group—access to the administrative privileges attributed to that role.

Perform the following steps to add a group to a delegated administration role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role for which you want to add groups.
  3. Select the Groups in Role tab.
  4. Click Add Groups To Role.
  5. If necessary, find the groups you want to add to the role using the Search feature. Groups appear in the Search Results section.
    6. Tip: If you are using an SQL authentication provider, be aware that group names are case sensitive. For example, group Managers is different than group managers.
  6. Select the check box next to each group you want to add, and click Add. Selected groups now appear in the Groups to Add section.
    7. Note: If a list of groups is not displayed, make sure you have built a group hierarchy tree for the authentication provider. If you do not see a list of groups after building a group hierarchy tree, the authentication provider might not allow read access. To see if your authentication provider allows read access, view the authentication provider details, as described in Viewing Authentication Provider Details.
    Note: You can activate a text field for group name entry for authentication providers that do not allow read access, as described in Enabling Text Entry for Authentication Providers.

Any groups you have added now appear in the Groups in Role section in the Details and Groups in Role tabs.

Adding Conditions to Delegated Administration Roles with Expressions

You can use expressions to set conditions, in addition to username and group membership, that dynamically determine membership in a delegated administration role. Conditions specify the values of user profile properties, session and request attributes, dates, and times.

For example, you can define a role with the following type of expression: If a logged-in user has the administrator property set to true and the time is between 9 a.m. and 5 p.m. PST, the user is a role member.

Perform the following steps to add conditions to a delegated administration role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role to which you want to add conditions.
  3. Select the Role Expression tab.
  4. In the top left corner of the tab, ANY or ALL is underlined. By selecting, you can toggle between these values.
  5. For each expression you want to create, click Add Condition. When you select a condition, it expands to let you specify the value. You can create an expression from a drop-down list containing the following options:
    • The date is:

      • Specify a date using the calendar.

    • It is after a given date:

      • Specify a date using the calendar.

    • It is after a given date and time:

      • Specify a date and time using the calendar.

    • It is between two times:

      • Specify a time range using the calendars.

    • It is between two dates:

      • Specify a date range using the calendars.

    • It is between two date/times:

      • Specify a range of dates and times using the calendars.

    • The visitor, visitor’s HTTP request, or visitor’s HTTP session has characteristics:

      • To set characteristics, you must specify a Property Set, a Property from the property set, a Value for the property, and the ANY or ALL comparator. Specify a property value from the pull-down menu. You can click Add Another Value to add multiple properties and corresponding values.

    • The consumer’s registration has these values:

      • Specify WSRP registration properties. For more information, see the Federation Guide.

      Tip: User profile properties, HTTP session and request properties, and WSRP registration properties are created by developers in Workshop for WebLogic.
  6. Click Save to apply the conditions.
Note: If you define roles with expressions whose evaluation changes during the processing of a request, you may need to adjust your portal application cache settings to ensure that the correct role definition is retrieved instead of a cached role.

 

Removing Users, Groups, and Conditions from Delegated Administration Roles

You can change who is assigned a role by removing users, groups, and conditions from delegated administration roles.

Removing Users from Delegated Administration Roles

If you want to revoke user access to administrative privileges associated with a role, you can remove the user from the role.

Perform the following steps to remove one or more users from a delegated administration role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role from which you want to remove users.
  3. Select the Users in Role tab.
  4. In the list of users, select the check box in the Remove section next to each user you want to remove. By selecting the check box in the header above the user names, you can remove all users from the role.
  5. Click Remove.

Users you have removed no longer appear in the Users in Role tab or in the Details tab under Users in Role.

Removing Groups from Delegated Administration Roles

Perform the following steps to remove one or more groups from a role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role from which you want to remove groups.
  3. Select the Groups in Role tab.
  4. In the list of groups, select the check box in the Remove section next to each group you want to remove. By selecting the check box in the header above the group names, you can remove all groups from the role.
  5. Click Remove.

Groups you have removed no longer appear in the Groups in Role tab or in the Details tab under Groups in Role.

Removing Conditions in Delegated Administration Roles

Perform the following steps to remove one or more conditions from a role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role from which you want to remove conditions.
  3. Select the Expressions in Role tab.
  4. In the list of conditions, select the check box in the Delete section next to each one you want to remove. By selecting the check box in the header above the conditions, you can remove all conditions from the role.
  5. Click Delete.

Conditions you have removed no longer appear in the Role Expressions tab or in the Expressions in Role section of the Details tab.

 

Modifying Conditions in Delegated Administration Roles

You can modify an existing expression in a delegated administration role, as long as you do not want to change the type of condition. For example, if you created a condition based on a date range, you can change the dates.

You can also add a condition from the Role Expressions tab; see Adding Conditions to Delegated Administration Roles with Expressions for more information. To remove a condition, see Removing Conditions in Delegated Administration Roles.

Perform the following steps to modify a role condition:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role for which you want to modify a condition.
  3. Select the Role Expressions tab.
  4. Click Edit for the condition you want to modify.
  5. Specify the new value or values for the condition.
  6. Click Save.

The modified condition appears in the list of conditions.

 

Granting Additional Delegation Properties to Roles

You can allow a selected role to manage sub-roles. For example, you can allow another administrator to create child roles, delete them, move them, and add users to them in the selected role. Each role in the node can be granted the privileges to edit its subordinate roles.

Note: You can modify those roles that are below you in the administrator hierarchy. You cannot modify your own role or any roles above you in the hierarchy.

Perform the following steps to grant delegation authority to an existing role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role for which you want to view or modify delegation properties.
  3. From the Details tab, select Advanced Options, or click the Edit icon next to it.
  4. To allow any user or group assigned this role to manage sub-roles, select the check box Administrators in this Role can manage child Roles.
    5. Tip: If you want parent roles to automatically be granted any capabilities granted to a child role, select the check box Implicitly grant the capabilities of a sub-role to its parent role. This option is displayed only when the PortalSystemDelegator role is selected in the tree, because it is applied globally to all roles.
  5. Click Save.

Figure 7-3 shows the Advanced Properties dialog.

Figure 7-3 Advanced Properties Dialog

Advanced Properties Dialog

 

Viewing Delegated Administration Role Details

Once you have created a role, you can select it in the Delegated Administration tree.

Perform the following steps to view the details about a delegated administration role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role for which you want to see detailed information.
  3. Select the Details tab.

Figure 7-4 shows the Details tab for the DA_Authentication role.

Figure 7-4 Delegated Administration Details Tab

Delegated Administration Details Tab

 

Viewing the Delegated Resources

You can view the portal resources that are associated with a role. This is useful because before you can delete a delegated administration role, you have to remove the security policies associated with the role. A security policy is created when you define an association between a WebLogic resource and one or more users, groups, or roles. Hence, a role policy defines a role and a security policy defines an authorization constraint associated with that role.

Tip: You can delete security policies from the policy summary page, or from the Delegated Admin tab for the specific resource.

Perform the following steps to view a delegated administration role’s delegated resources.

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select a role.
  3. Select the Delegated Resources tab.

There you can view the information for the role’s delegated resources:

Tip: From this tab, you can delete a security policy by selecting the check box in the Delete column and clicking Delete.

Figure 7-5 shows the Delegated Resources tab.

Figure 7-5 Delegated Resources Tab

Delegated Resources Tab

 

Renaming Delegated Administration Roles

You can change the name and description of existing delegated administration role if there are no security policies associated with the role. For information about viewing the policies associated with a role, see Viewing the Delegated Resources.

Tip: If there are policies associated with a role, it does not appear as editable in the Details tab.

Perform the following steps to rename a delegated administration role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the role you want to rename.
  3. From the Details tab, select Name & Description, or click the Edit icon next to it.
  4. In the dialog box that appears, type the new name, and optionally, a new description, and click OK.

The new role name appears in the Delegated Administration tree and the tabs.

 

Deleting Delegated Administration Roles

When you delete a delegated administration role, the child roles associated with it are also deleted.

A delegated administration role can only be deleted when no security policies are associated with it. If there are security policies associated with a role you are trying to delete, a warning is displayed. You must delete all such references before you can delete the role.

Perform the following steps to delete a delegated administration role:

  1. Choose Users, Groups, & Roles > Delegated Administration.
  2. In the Delegated Administration tree, select the parent role for the role want to delete.
  3. In the list of roles, select the check box next to any roles you want to delete.
  4. Click Delete.

If you receive a message that the role cannot be deleted while resource dependencies exist, select the Delegated Resources tab for that role to view, and optionally delete, the resource dependencies. For more information, see Viewing the Delegated Resources.

 

Setting Delegated Administration on Authentication Providers

You can determine which portal administrators can manage each authentication provider by assigning delegated administration roles to the provider.

The only capability that can be specified for an authentication provider is Can Use. This allows you to manage users and groups from this authentication provider.

Note: If you attempt to assign a delegated administration role to a group as described in Setting Delegated Administration on Groups, and you do not have Can Use capability, a dialog box asks if you would like to grant access to the provider as well. If you click OK, you provide access to the authentication provider and assign the delegated administration role to the group. If you click Cancel, the role is not allowed access to the authentication provider.

Perform the following steps to assign delegated administration to an authentication provider:

  1. Choose Users, Groups, & Roles >Security Providers.
  2. In the Security Providers tree, navigate to the provider for which you want to set delegated administration.
  3. Select the Edit Delegated Admin tab.
  4. Click Add Role.
  5. In the list of roles in the Search Results section, select the check box next to any roles you want to add and click Add. The selected roles are added to the Roles to Add section.

    6. You can remove a role from the Roles to Add section by selecting the check box next to the role and clicking Remove Selected.

  6. Click Save.
  7. In the Delegate Capabilities to Resource dialog, select the check box for the Can Use capability. By selecting the check box in the header above the role names, you enable the Can Use capability for all roles.
  8. Click Save.

The roles you have added are listed in the Browse Roles Delegated to this Resource section.

 

Removing Delegated Administration on Authentication Providers

If you no longer want administrator capabilities to be available for an authentication provider, you can remove administrator capabilities from it.

The only administrator capability for authentication providers is Can Use, so if you edit the role to remove this capability, the delegated administration role is removed from the authentication provider.

Perform the following steps to remove delegated administration on an authentication provider:

  1. Choose Users, Groups, & Roles >Security Providers.
  2. In the Security Providers tree, navigate to the provider for which you want to remove delegated administration.
  3. Select the Edit Delegated Admin tab.
  4. Under Browse Roles Delegated to this Resource, select the check box in the Remove Role column for each role you want to remove. By selecting the check box in the header above the role names, you remove the Can Use capability from all roles.
  5. Click Remove.

The changes you make are reflected in the Browse Roles Delegated to this Resource section.

 

Setting Delegated Administration on Groups

You can determine which portal administrators can manage each group by assigning delegated administration roles to the group. Table 7-1 describes administrator capabilities for groups.

Table 7-1 Descriptions of Administrator Capabilities for Groups
Profile Admin
Determines whether the administrator can edit profile properties in the Group Profile tab and the User Profile tab for users in that group.
Read User/Group
Determines whether the administrator can view information about the group and users in the group.
Create Update Delete User/Group
Determines whether the administrator can manage the group and users in the group (including adding users to groups).

Tip: If you are using more than one authentication provider, it is possible to have a group in one provider with an identical name to a group in another provider. When you set delegated administration on a group, an administrator in that delegated administration role is able to administer that group in all providers that contain that group, if the administrator also has administrator capabilities for the other providers.

Perform the following steps to assign delegated administration to a group:

  1. Choose Users, Groups, & Roles > Group Management.
  2. In the Groups tree, select the group for which you want to set delegated administration.
    3. Note: If a list of groups is not displayed, make sure you have built a group hierarchy tree for the authentication provider. If you do not see a list of groups after building a group hierarchy tree, the authentication provider might not allow read access. To see if your authentication provider allows read access, view the authentication provider details, as described in Viewing Authentication Provider Details.
    Note: You can activate a text field for group name entry for authentication providers that do not allow read access, as described in Enabling Text Entry for Authentication Providers.
  3. Select the Delegated Admin tab.
  4. Click Add Role.
  5. In the list of roles in the Search Results section, select the check box next to any roles you want to add and click Add. The selected roles are added to the Roles to Add section.

    6. You can remove a role from the Roles to Add section by selecting the check box next to the role and clicking Remove Selected.

  6. Click Save.
    7. Note: Roles that are allowed to administer groups must also have Can Use capability to access the authentication provider. If the delegated administration role you are assigning to the group does not have access to the authentication provider, a dialog box asks if you would like to grant access to the provider as well. Click OK to provide access to the authentication provider and assign the delegated administration role to the group. Click Cancel if you do not want the role to have access to the authentication provider. The delegated administration role is not assigned to the group if you click Cancel.
  7. In the Delegate Capabilities to Resource dialog, select the check boxes for the capabilities listed in Table 7-1, Descriptions of Administrator Capabilities for Groups, on page 7-16. By selecting the check box in the header above the role names, you enable that capability for all roles.
  8. Click Save.

The roles you have added are listed in the Browse Roles Delegated to this Resource section.

 

Removing and Editing Delegated Administration on Groups

If you no longer want administrator capabilities to be available for a group of users, you can remove delegated administration from the group. You can also change the capabilities of a delegated administration role on a group, which is also described in this procedure.

Tip: You can also remove a delegated administration role from a group from the Delegated Resources tab for that role. From this tab, delete a security policy by selecting the check box in the Delete column and clicking Delete.

Perform the following steps to remove or edit delegated administration on a group:

  1. Choose Users, Groups, & Roles > Group Management.
  2. In the Groups tree, select the group for which you want to remove or edit delegated administration.
    3. Note: If a list of groups is not displayed, make sure you have built a group hierarchy tree for the authentication provider. If you do not see a list of groups after building a group hierarchy tree, the authentication provider might not allow read access. To see if your authentication provider allows read access, view the authentication provider details, as described in Viewing Authentication Provider Details.
    Note: You can activate a text field for group name entry for authentication providers that do not allow read access, as described in Enabling Text Entry for Authentication Providers.
  3. Select the Delegated Admin tab.
  4. From the Browse Roles Delegated to this Resource section:

The changes you make are reflected in the Browse Roles Delegated to this Resource section.

 

Setting Delegated Administration on Portal Resources in the Library

Security policies determine what capabilities a delegated administration role has for a given portal resource. You can set delegated administration on portal resources in the resource library or in the desktop (Portals node). Within the library, you can set administrator capabilities on specific books, pages, and portlets, or all resources in each of these categories.

You can control administrator access to the following types of portal resources in the library:

Each has administrator capabilities that are based on the type of resource, as shown in Table 7 -2.

Table 7 -2 Administrator Capabilities According to Portal Resource Type in the Library
 
Manage Definition
Create/Remove Instances
Use Definition
View Templates
Library

Choosing Administrator Capabilities

Choosing Administrator Capabilities

Choosing Administrator Capabilities

 
Portlet

Choosing Administrator Capabilities

Choosing Administrator Capabilities

   
Portlet Category

Choosing Administrator Capabilities

Choosing Administrator Capabilities

   
Book

Choosing Administrator Capabilities

Choosing Administrator Capabilities

   
Layout

Choosing Administrator Capabilities

 

Choosing Administrator Capabilities

 
Look and Feel

Choosing Administrator Capabilities

 

Choosing Administrator Capabilities

 
Menu

Choosing Administrator Capabilities

 

Choosing Administrator Capabilities

 
Page

Choosing Administrator Capabilities

Choosing Administrator Capabilities

   
Shell

Choosing Administrator Capabilities

 

Choosing Administrator Capabilities

 
Template (Community and Desktop)
     

Choosing Administrator Capabilities

Theme

Choosing Administrator Capabilities

 

Choosing Administrator Capabilities

 

Table 7-3 describes each administrator capability.

Table 7-3 Descriptions of Administrator Capabilities for Portal Resources in the Library
Manage Definition
Determines who can edit resource definitions that are propagated globally throughout all instances of this resource. For example, an administrator who has Manage Definition capability on a page can edit the contents of the page (including portlets), the position of the portlets on the page, or the entitlements for the page, and those changes are applied to every instance of that page. The page is then available as a template that other administrators can use to create new pages. An administrator with this capability can also create and remove instances of this resource.
Create/Remove Instances
Determines whether the administrator can make these portal resources available to specific portals. Once you create a resource in the library to use as a template for other pages, you must make that resource available for portal administrators to select from the list of resources available for their portlet. For example, an administrator can create a page template in the library, then make that page available for specific portals to use as resources.
Use Definition
Determines whether the administrator can use the resource. If this is the only capability granted, the administrator cannot modify the resource, and the resource is not displayed in the Library tree. Resources that can be used with desktops, books and pages can be given Use Definition capabilities. For example, if an administrator has Use Definition capability for a layout, they can only use that layout within the context of the page that they are allowed to manage.
View Templates
Only applicable to templates; determines if the administrator can create a new desktop or community based on a template.

Note: You must add a delegated administration role to a page or a portlet only after you have made the required changes to the portal or page (like theme, layout, or title changes). If you assign the role first, the role will disappear from the page later when the administration instance is created.

Perform the following steps to set delegated administration on a portal resource in the library:

  1. Choose Portal Management > Portal.
  2. From the Library node in the Portal Resources tree, navigate to and then select the portal resource (or resource type) for which you want to set delegated administration.
  3. Select the Delegated Admin tab.
  4. Click Add Role.
  5. Optionally, search for the role you want to add by role name.
  6. In the list of roles in the Search Results section, select the check box next to any roles you want to add and click Add. The selected roles are added to the Roles to Add section.

    7. You can remove a role from the Roles to Add section by selecting the check box next to the role and clicking Remove Selected.

  7. Click Save.
  8. In the Delegate Capabilities to Resource dialog, select the check boxes for the capabilities you want each role to have (see Table 7 -2, Administrator Capabilities According to Portal Resource Type in the Library, on page 7-20). By selecting the check box in the header above the role names, you enable that capability for all roles.
  9. Click Save.

The roles you have added are listed in the Browse Roles Delegated to this Resource section. Figure 7-6 shows an example Delegate Capabilities to Resource Dialog.

Figure 7-6 Choosing Administrator Capabilities

Choosing Administrator Capabilities

 

Setting Delegated Administration on Portal Resources in the Desktop

Security policies determine what capabilities a delegated administration role has for a given portal resource. You can set delegated administration on portal resources in the library or in the desktop (Portals node). Within a given desktop you can set administrator capabilities on specific instances resources, such as a page, book, or portlet in that desktop. You can also set administrator capabilities on an entire desktop or community.

You can control administrator access to the following types of portal resources in the desktop:

The only capability that can be specified for a desktop instance of a portal resource is the Manage Instance capability. This allows administrators to manage that specific instance of the resource.

Note: You must add a delegated administration role to a page or a portlet only after you have made the required changes to the portal or page (like theme, layout, or title changes). If you assign the role first, the role will disappear from the page later when the administration instance is created.

Perform the following steps to set delegated administration on a portal resource in the desktop:

  1. Choose Portal Management > Portal.
  2. From the Portals node in the Portal Resources tree, navigate to and then select the resource instance for which you want to set delegated administration.
  3. Select the Delegated Admin tab.
  4. Click Add Role.
  5. Optionally, search for the role you want to add by role name.
  6. In the list of roles in the Search Results section, select the check box next to any roles you want to add and click Add. The selected roles are added to the Roles to Add section.

    7. You can remove a role from the Roles to Add section by selecting the check box next to the role and clicking Remove Selected.

  7. Click Save.
  8. In the Delegate Capabilities to Resource dialog, select the check box for the Manage Instance capability. By selecting the check box in the header above the role names, you enable the Manage Instance capability for all roles.
  9. Click Save.

The roles you have added are listed in the Browse Roles Delegated to this Resource section.

 

Removing and Editing Delegated Administration on Portal Resources

If you no longer want administrator capabilities to be available for a portal resource, you can remove administrator capabilities from it. You can also change the capabilities of a delegated administration role on a portal resource, which is also described in this procedure.

In the desktop, the only administrator capability for a resource instance is Manage Instance, so if you edit the role to remove this capability, the delegated administration role is removed from the resource instance.

Tip: You can also remove a delegated administration role from a portal resource from the Delegated Resources tab for that role. From this tab, you can delete a security policy by selecting the check box in the Delete column and clicking Delete.

Perform the following steps to remove or edit delegated administration from a portal resource or type of portal resource:

  1. Choose Portal > Portal Management.
  2. From the Library or Portals node in the Portal Resources tree, navigate to the resource or resource type from which you want to remove delegated administration.
  3. Select the Delegated Admin tab.
  4. From the Browse Roles Delegated to this Resource section:

The changes you make are reflected in the Browse Roles Delegated to this Resource section.

 

Setting Delegated Administration on Interaction Management Resources

You can determine the level of access portal administrators have in administering interaction management resources (campaigns, placeholders, segments, and content selectors) by setting delegated administration on them.

The only administrator capability for interaction management resources is Can Manage, which determines whether the administrator can manage that interaction management resource.

Perform the following steps to set delegated administration on an interaction management resource:

  1. Depending on the resource for which you want to remove delegated administration, choose Interaction > Campaigns, Interaction > Placeholders, Interaction > Segments, or Interaction > Content Selectors.
  2. In the tree, select the interaction management resource to which you want to assign delegated administration.
  3. Select the Delegated Admin tab.
  4. Click Add Role.
  5. Optionally, search for the role you want to add by role name.
  6. In the list of roles in the Search Results section, select the check box next to any roles you want to add and click Add. The selected roles are added to the Roles to Add section.

    7. You can remove a role from the Roles to Add section by selecting the check box next to the role and clicking Remove Selected.

  7. Click Save.
  8. In the Delegate Capabilities to Resource dialog, select the check box for the Can Manage capability. By selecting the check box in the header above the role names, you enable that capability for all roles.
  9. Click Save.

The changes you make are reflected in the Browse Roles Delegated to this Resource section.

 

Removing Delegated Administration on Interaction Management Resources

If you no longer want administrator capabilities to be available for an interaction management resource, you can remove administrator capabilities from it.

The only administrator capability for interaction management resources is Can Manage, so if you edit the role to remove this capability, the delegated administration role is removed from the interaction management resource.

Perform the following steps to remove delegated administration from an interaction management resource:

  1. Depending on the resource for which you want to remove delegated administration, choose Interaction > Campaigns, Interaction > Placeholders, Interaction > Segments, or Interaction > Content Selectors.
  2. In the tree, select the interaction management resource from which you want to remove delegated administration.
  3. Select the Delegated Admin tab.
  4. Under Browse Roles Delegated to this Resource, select the check box in the Remove Role column for each role you want to remove. By selecting the check box in the header above the role names, you remove the Can Manage capability from all roles.
  5. Click Remove.

The changes you make are reflected in the Browse Roles Delegated to this Resource section.

 

Setting Delegated Administration on Content Management Resources

You can determine the level of access portal administrators have in administering for content management resources.

You can create delegated administration roles to control administration access to the following types of content management resources:

Each has administration capabilities that are based on the type of resource, as shown in Table 7 -4.

Table 7 -4 Administration Capabilities According to Content Management Resource Type
 
Create
View
Update
Delete
Publish
Instan-
tiate
Assign Workflow
Manage
Content

Choosing Administrator Capabilities

Choosing Administrator Capabilities

Choosing Administrator Capabilities

Choosing Administrator Capabilities

Choosing Administrator Capabilities

 

Choosing Administrator Capabilities

 
Content Type

Choosing Administrator Capabilities

Choosing Administrator Capabilities

Choosing Administrator Capabilities

Choosing Administrator Capabilities

 

Choosing Administrator Capabilities

Choosing Administrator Capabilities

 
Workflow

Choosing Administrator Capabilities

Choosing Administrator Capabilities

Choosing Administrator Capabilities

Choosing Administrator Capabilities

   

Choosing Administrator Capabilities

 
Repository
             

Choosing Administrator Capabilities

Tip: The capabilities you assign to a delegated administration role determine how the administrator participates in the content workflow. For example, a role that is not granted Publish capabilities cannot transition content to the Published or Retired status.

The capabilities that can be specified for content are described in Table 7-5.

Table 7-5 Descriptions of Administrator Capabilities for Content
Create
Determines whether administrators can create content.
View
Determines whether administrators can view the content and any properties associated with it.
Update
Determines whether administrators can update the properties and change the content workflow status of the content.
Delete
Determines whether administrators can delete the content.
Assign Workflow
Determines whether administrators can assign a workflow with the content.
Publish
Determines whether administrators can approve the content by checking it in with a status other than draft or ready.

The capabilities that can be specified for content types are described in Table 7-6.

Table 7-6 Descriptions of Administrator Capabilities for Content Types
Create
Determines whether administrators can create a content type.
View
Determines whether administrators can view the content type and its properties.
Update
Determines whether administrators can modify a content type.
Delete
Determines whether administrators can delete a content type.
Instantiate
Determines whether administrators can create content based on this content type.
Assign Workflow
Determines whether administrators can assign a workflow to the content type.

The capabilities that can be specified for content workflows are described in Table 7-7.

Table 7-7 Descriptions of Administrator Capabilities for Content Workflows
Create
Determines whether administrators can create a content workflow.
View
Determines whether administrators can view the properties of a content workflow.
Update
Determines whether administrators can modify a content workflow.
Delete
Determines whether administrators can delete a content workflow from the repository.
Assign Workflow
Determines whether the workflow is available for selection when an administrator assigns a workflow to a content type or content.

The only capability that can be specified for a repository is the Manage capability. This determines whether administrators can modify the properties of the repository.

Perform the following steps to set delegated administration on content:

  1. Choose Content > Content Management.
  2. In the Content tree, navigate to the resource on which you want to set administrator capabilities:
    • To set delegated administration on workflows, select Repositories, and navigate to the workflow.
    • To set delegated administration on a content type. select Types, and navigate to the content type.
    • To set delegated administration on content, select Content, and navigate to the content.
    • To set delegated administration on a repository, select Repository and select the repository.
  3. Select the Delegated Admin tab.
  4. Click Add Role.
  5. In the list of roles in the Search Results section, select the check box next to any roles you want to add and click Add. The selected roles are added to the Roles to Add section.

    6. You can remove a role from the Roles to Add section by selecting the check box next to the role and clicking Remove Selected.

  6. Click Save.
  7. In the Delegate Capabilities to Resource dialog, select the check boxes for the capabilities you want each role to have (see Table 7-5, Table 7-6, and Table 7-7 for capabilities on content, content types, and workflows, respectively). By selecting the check box in the header above the role names, you enable that capability for all roles.
  8. Click Save.

The roles you have added are listed under Browse Roles Delegated to this Resource.

 

Removing and Editing Delegated Administration on Content Management Resources

If you no longer want administrator capabilities to be available for content, a content type, or a workflow, you can remove administrator capabilities from it. You can also change the capabilities of a delegated administration role on the content management resource, which is also described in this procedure.

Tip: You can also remove a delegated administration role from a content management resource from the Delegated Resources tab for that role. From this tab, you can delete a security policy by selecting the check box in the Delete column and clicking Delete.

Perform the following steps to remove or edit delegated administration on a content management resource:

  1. Choose Content > Content Management.
  2. In the Content tree, navigate to the resource on which you want to remove delegated administration.
  3. Select the Delegated Admin tab.
  4. From the Browse Roles Delegated to this Resource section:

The changes you make are reflected in the Browse Roles Delegated to this Resource section.

 

Setting Delegated Administration on Visitor Entitlement Roles

You can determine the level of access portal administrators have in administering visitor entitlement roles by setting delegated administration on them.

The only administrator capability for visitor entitlements is Manage Role, which determines whether the administrator can manage that visitor entitlement role.

Perform the following steps to set delegated administration on a visitor entitlement role:

  1. Choose Users, Groups, & Roles > Visitor Entitlements.
  2. In the Visitor Roles tree, select the visitor role to which you want to assign delegated administration.
  3. Select the Delegated Admin tab.
  4. Click Add Role.
  5. Optionally, search for the role you want to add by role name.
  6. In the list of roles in the Search Results section, select the check box next to any roles you want to add and click Add. The selected roles are added to the Roles to Add section.

    7. You can remove a role from the Roles to Add section by selecting the check box next to the role and clicking Remove Selected.

  7. Click Save.
  8. In the Delegate Capabilities to Resource dialog, select the check box for the Manage Roles capability. By selecting the check box in the header above the role names, you enable that capability for all roles.
  9. Click Save.

The changes you make are reflected in the Browse Roles Delegated to this Resource section.

 

Removing Delegated Administration from Visitor Entitlement Roles

If you no longer want administrator capabilities to be available for a visitor entitlement role, you can remove administrator capabilities from it.

The only administrator capability for visitor entitlements is Manage Role, so if you edit the role to remove this capability, the delegated administration role is removed from the visitor entitlement role.

Perform the following steps to remove delegated administration from a visitor entitlement role:

  1. Choose Users, Groups, & Roles > Visitor Entitlements.
  2. In the Visitor Roles tree, select the role from which you want to remove delegated administration.
  3. Select the Delegated Admin tab.
  4. Under Browse Roles Delegated to this Resource, select the check box in the Remove Role column for each role you want to remove. By selecting the check box in the header above the role names, you can remove the Manage Role capability from all roles.
  5. Click Remove.

The changes you make are reflected in the Browse Roles Delegated to this Resource section.


  Back to Top       Previous  Next