Organization-Based Authorization

Service Provider administrators are Oracle Waveset users that are assigned capabilities and can control organizations. These administrators can be created and maintained in the same way as Oracle Waveset administrators.

Several different levels of administrators might be needed in your environment to perform various tasks, such as the following:

• The lowest level of administrator might be permitted to create and edit end user (customer) accounts only. There might be thousands administrators with these capabilities.

• Another level of administrator might be permitted to create, edit, and delete low-level administrators as well as customer accounts. There might be hundreds of such administrators.

• A set of administrators to manage the LDAP directory and other resources. There might be several dozen of this type of administrator.

• A few high-level administrators that have super user abilities.

The last two categories of administrators would likely be created and maintained manually in the Administrator Interface. However, to create the lower-level administrators, perform the following tasks:

1. Review the object classes and attributes present in your LDAP directory and determine which of these items contain data that indicates the user should have administrative powers. For example, you might have an attribute that indicates a user is a retailer or manager. A retailer would have the ability to create accounts. A manager might be permitted to create retailer accounts.

2. Add the attributes to the schema map of the LDAP resource.

3. Determine how you will limit the scope of each administrator. For example, a retailer based in Texas probably should not be allowed to create accounts for users who live in New York. Similarly, a manager should not be allowed to delete accounts outside her realm.

4. Create organizations in Oracle Waveset that correspond to the scopes defined in the previous step.

5. Create a user form that creates an Oracle Waveset account, assigns capabilities as well as an organization for each administrator. The user form must use the attributes defined in Organization-Based Authorization.

6. Use reconciliation or other data loading mechanism to load the administrator accounts into Oracle Waveset.