您使用授权策略来控制对租户中资源的访问权限。例如,您可以创建策略以授权用户创建和管理 Oracle Content Management 实例。
可以使用 Infrastructure 控制台创建策略。请参见管理策略。
以下信息与 Oracle Content Management 的服务策略相关:
此表列出了 Oracle Content Management 的资源类型。
资源类型 | 说明 |
---|---|
oce-instance | 单个 Oracle Content Management 实例 |
oce-instances | 一个或多个 Oracle Content Management 实例。 |
oce-workrequest | 单个 Oracle Content Management 工作请求
在 Oracle Content Management 实例上执行的每个操作都会创建一个工作请求。例如,创建、更新、终止等操作。 |
oce-workrequests | 一个或多个 Oracle Content Management 工作请求。 |
这些变量的值由 Oracle Content Management 提供。此外,还支持其他通用变量。请参见适用于所有请求的通用变量。
此表列出了 Oracle Content Management 支持的变量。
变量 | 类型 | 说明 | 示例值 |
---|---|---|---|
target.compartment.id | 实体 | 请求的主资源的 OCID。 | target.compartment.id = 'ocid1.compartment.oc1..<unique_ID>' |
request.operation | 字符串 | 请求的操作 ID(例如 "GetUser")。 | request.operation = 'ocid1.compartment.oc1..<unique_ID>' |
target.resource.kind | 字符串 | 请求的主资源的资源种类名称。 | target.resource.kind = 'ocid1.contentexperiencecloudservice.oc1..<unique_ID>' |
Oracle Cloud Infrastructure 提供了一组标准的动词来定义各种 Oracle Cloud Infrastructure 资源的权限(INSPECT、READ、USE、MANAGE)。这些表列出了与每个动词关联的 Oracle Content Management 权限。从 INSPECT 到 READ、再到 USE、再到 MANAGE,访问级别是累加的。
INSPECT
资源类型 | INSPECT 权限 |
---|---|
|
|
|
|
|
|
READ
资源类型 | READ 权限 |
---|---|
|
|
|
|
|
|
USE
资源类型 | USE 权限 |
---|---|
|
|
|
|
|
|
MANAGE
资源类型 | MANAGE 权限 |
---|---|
|
|
|
|
|
|
此表按资源类型分组显示了可用于 Oracle Content Management 的 API 操作。
REST API 操作 | CLI 命令操作 | 使用操作所需的权限 |
---|---|---|
ListOceInstances | oce-instance list | OCE_INSTANCE_INSPECT |
GetOceInstance | oce-instance get | OCE_INSTANCE_READ |
CreateOceInstance | oce-instance create | OCE_INSTANCE_CREATE |
DeleteOceInstance | oce-instance delete | OCE_INSTANCE_DELETE |
UpdateOceInstance | oce-instance update | OCE_INSTANCE_UPDATE |
ChangeOceInstanceCompartment | oce-instance change-compartment | OCE_INSTANCE_UPDATE |
ListWorkRequests | work-request list | OCE_INSTANCE_WORKREQUEST_INSPECT |
GetWorkRequest | work-request get | OCE_INSTANCE_WORKREQUEST_READ |
ListWorkRequestErrors | work-request-error list | OCE_INSTANCE_WORKREQUEST_INSPECT |
ListWorkRequestLogs | work-request-log list | OCE_INSTANCE_WORKREQUEST_INSPECT |
下面提供了在授权访问 Oracle Content Management 实例时您可能会使用的典型策略语句。
为租户创建策略时,您会通过策略继承授予用户对所有区间的访问权限。或者,也可以限制对单个 Oracle Content Management 实例或区间的访问权限。
允许管理员组中的用户完全管理任何 Oracle Content Management 实例
# Full admin permissions (CRUD) allow group Administrators to manage oce-instances in tenancy allow group Administrators to manage oce-workrequests in tenancy
# Full admin permissions (CRUD) using family allow group Administrators to manage oce-instance-family in tenancy
允许 group1 组中的用户检查任何 Oracle Content Management 实例及其关联的工作请求
# Inspect permissions (list oce instances and work requests) using metaverbs: allow group group1 to inspect oce-instances in tenancy allow group group1 to inspect oce-workrequests in tenancy
# Inspect permissions (list oce instances and work requests) using permission names: allow group group1 to {OCE_INSTANCE_INSPECT} in tenancy allow group group1 to {OCE_INSTANCE_WORKREQUEST_INSPECT} in tenancy
允许 group2 组中的用户读取有关任何 Oracle Content Management 实例及其关联工作请求的详细信息
# Read permissions (read complete oce instance and work request metadata) using metaverbs: allow group group2 to read oce-instances in tenancy allow group group2 to read oce-workrequests in tenancy
# Read permissions (read complete oce instance and work request metadata) using permission names: allow group group2 to {OCE_INSTANCE_INSPECT, OCE_INSTANCE_READ} in tenancy allow group group2 to {OCE_INSTANCE_WORKREQUEST_INSPECT, OCE_INSTANCE_WORKREQUEST_READ} in tenancy
允许 group3 组中的用户读取所有 Oracle Content Management 实例及其关联的工作请求
# Use permissions (read on oce instance, read on work request) using metaverbs: allow group group3 to use oce-instances in tenancy allow group group3 to read oce-workrequests in tenancy
# Use permissions (read on oce instance, read on work request) using permission names: allow group group3 to {OCE_INSTANCE_INSPECT, OCE_INSTANCE_READ, OCE_INSTANCE_UPDATE} in tenancy allow group group3 to {OCE_INSTANCE_WORKREQUEST_INSPECT, OCE_INSTANCE_WORKREQUEST_READ} in tenancy
允许 group4 组中的用户管理任何 Oracle Content Management 实例及其关联的工作请求
# Manage permissions (use/delete on oce instance, read/cancel on work request) using metaverbs: allow group group4 to manage oce-instances in tenancy allow group group4 to manage oce-workrequests in tenancy
# Manage permissions (use/delete on oce instance, read/cancel on work request) using permission names: allow group group4 to {OCE_INSTANCE_INSPECT, OCE_INSTANCE_READ, OCE_INSTANCE_UPDATE,OCE_INSTANCE_CREATE, OCE_INSTANCE_DELETE} in tenancy allow group group4 to {OCE_INSTANCE_WORKREQUEST_INSPECT, OCE_INSTANCE_WORKREQUEST_READ} in tenancy