[midPoint] Restricting the roles a user can assign

[Pertti Kellomäki]

Hi all,


I am trying to create a restricted administrator role similar to the call center operator at

https://wiki.evolveum.com/x/UwDy


Below are the authorizations of the role. From the example I would expect that a user with the restricted administrator role would only be able to see and assign roles with roleType 'kapa' to other users, but instead all roles are visible, and the administrator can happily make other users superusers. I must be missing something very basic here. My midPoint version is 3.5 if that makes a difference.


Thanks, Pertti


   <authorization id="2">
      <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgAll</action>
      <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#usersAll</action>
      <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#dashboard</action>
   </authorization>
   <authorization id="3">
      <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
      <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
      <object>
         <type>OrgType</type>
      </object>
   </authorization>
   <authorization id="4">
      <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
      <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
      <object>
         <type>UserType</type>
      </object>
   </authorization>
   <authorization id="5">
      <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
      <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#unassign</action>
      <target>
         <type>RoleType</type>
         <filter>
            <q:equal>
               <q:path>roleType</q:path>
               <q:value>kapa</q:value>
            </q:equal>
         </filter>
      </target>
   </authorization>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20170314/83554de7/attachment.htm>