48 Authorizing Users to Access Application Resources
Before authorizing users to access application resources, see “REST Authorization” in Administering Oracle WebCenter Sites for background information relating to the steps provided in the following topics:
-
Viewing REST Security Configurations
-
Creating a Group
-
Adding Users to a Group
-
Configuring Security for REST Resources
Note:
To configure security for REST resources, you to must assign privileges to groups. To view the list of groups, continue with the section “Viewing REST Security Configurations”. To create groups, see the section “Creating a Group”.Viewing REST Security Configurations
A security configuration identifies which groups have which permissions to which REST resources. WebCenter Sites defines security configurations for two default groups. They are RestAdmin
and SiteAdmin_AdminSite
.
To view REST security configurations:
-
Log in to the WebCenter Sites Admin interface as a general administrator.
-
In the General Admin tree, expand the Admin node, expand the User Access Management node, expand the REST Security node, and then double-click Configure Security.
The Security Configurations window opens in the main window.
-
Depending on your requirements, continue as follows:
-
To create a group, see the section “Creating a Group”.
-
To add users to a group, see the section “Adding Users to a Group”.
Note:
To complete this step, ensure that the required groups exist. You must assign privileges to the groups.
-
To configure security privileges for REST resources, see the section “Configuring Security for REST Resources”.
-
Creating a Group
To create a group:
-
Log in to the Admin interface as a general administrator.
-
In the General Admin tree, expand the Admin node, expand the User Access Management node, expand the REST Security node, expand the Groups node, and then double-click Add New.
-
In the Add New Group form, enter a name and brief description about the group you want to create.
-
Click Save.
The group you created is now listed under the Groups node.
-
Now that you have created a group, you can:
-
Add users to the group. For instructions, see the section “Adding Users to a Group”.
-
Configure REST security for the group. For instructions, see the section “Configuring Security for REST Resources”.
-
Adding Users to a Group
Add users to a group to determine the permissions that they will have to operate on REST resources associated with applications.
-
Log in to the Admin interface as a general administrator.
-
In the General Admin tree, expand the Admin node, expand the User Access Management node, expand the REST Security node, expand the Assign Users to Groups node, and then double-click Add New.
-
In the Assign Groups to User form, select users and assign them to any combination of the listed groups.
Note:
If the user you want to assign to the group is not listed, that user is a member of a group. To assign the user to another group, see step 5.
-
Click Save.
The user names you selected are listed under the Assign Users to Groups node. To view the groups that include a particular user, double-click the user name.
-
(Optional). If the name of the user you want to assign to a given group is not displayed in the User Name field, do the following:
-
In the General Admin tree, expand the Admin node, expand the User Access Management node, expand the REST Security node, expand Assign Users to Groups, and then double-click the name of the user you want to assign to another group.
-
In the Inspect form, click Edit to open the Edit User Groups form.
-
In the Groups field, select the groups to which you want to assign the user, and then click Save.
-
-
Now that you have added users to a group, you can do the following:
-
Create a group. For more information, see the section “Creating a Group”.
-
Configure security for a group. For more information, see the section “Configuring Security for REST Resources”.
-
Configuring Security for REST Resources
When configuring security, you specify which object types and objects must be accessible to groups, and which actions the groups can perform on the objects.
To configure security for REST resources:
-
Log in to the Admin interface as a general administrator.
-
In the General Admin tree, expand the Admin node, expand the User Access Management node, expand the REST Security node, expand the Configure Security node, and then double-click Add New.
-
In the Add New Security Configuration form, set security for object types and objects.
These two tables show a summary of possible security configurations.
Action | Description |
---|---|
Create |
Group members can create specified resources. |
Delete |
Group members can delete specified resources. |
List |
Group member can retrieve specified resources. |
Read/Head |
Group members can read specified resources. Read returns the requested resources. Head returns metadata describing the requested resources. |
Update |
Group members can modify specified resources. Note: Create and Update are each paired with the Read/Head privilege. Assigning one of these privileges to a group automatically assigns the Read/Head privilege to the group. |
Object Type | Name | Subtype | Site | Possible Actions |
---|---|---|---|---|
ACLs |
Any |
N/A |
N/A |
List |
Application (see note 1) |
Any |
N/A |
N/A |
Create, Update, Delete |
Application |
AppName |
N/A |
N/A |
Update, Delete |
Asset |
Any |
N/A |
Any |
List, Read/Head, Create, Update, Delete |
Asset |
Any |
N/A |
SiteName |
List, Read/Head, Create, Update, Delete |
Asset |
AssetType |
N/A |
SiteName |
List, Read/Head (see note 2), Create, Update, Delete |
Asset |
AssetType and AssetName |
N/A |
SiteName |
Read/Head, Update, Delete |
AssetType |
Any |
N/A |
N/A |
List, Read/Head, Create, Delete |
AssetType |
AssetType |
N/A |
N/A |
Read/Head, Delete |
AssetType |
AssetType |
Any |
N/A |
List |
AssetType |
AssetType |
Subtype |
N/A |
Read/Head |
Group |
Any |
N/A |
N/A |
List |
Group |
GroupName |
N/A |
N/A |
Read/Head |
Index |
Any |
N/A |
N/A |
List, Read/Head, Create, Update, Delete |
Index |
IndexName |
N/A |
N/A |
Read/Head, Update, Delete |
Role |
Any |
N/A |
N/A |
List, Read/Head, Create, Update, Delete |
Role |
Role |
N/A |
N/A |
Read/Head, Update, Delete |
Site |
Any |
N/A |
N/A |
List, Read/Head (see note 3), Create, Update, Delete |
Site |
SiteName |
N/A |
N/A |
Read/Head, Update, Delete |
User |
Any |
N/A |
N/A |
List, Read/Head, Create, Update, Delete |
User |
UserName |
N/A |
N/A |
Read/Head, Update, Delete |
UserDef |
Any |
N/A |
N/A |
List |
UserLocales |
Any |
N/A |
N/A |
List |
For more information, see the REST security topics in Administering Oracle WebCenter Sites.
Note:
-
For an example of setting security for applications, see step 3.
-
READ allows reading associations on the named site.
-
READ allows reading users and asset types on the named site.