[midPoint] disable "DeleteAll" options in production

[Dobruše Lukášová]

Hi,

this can be addressed using deny authorizations. Bellow there are two possible approaches, each with its own trade-offs.

1. Deny delete operations

You can deny the underlying delete operation for specific object types, for example UserType or ShadowType:

<authorization>
    <name>Deny user deletion</name>
    <decision>deny</decision>
    <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
    <object>
        <type>UserType</type>
    </object>
</authorization>

This prevents deletion of all objects of the specified type, including both individual and bulk delete operations.


2. Restrict access to the Repository Objects page

You can deny access to the Repository Objects page using the following GUI authorization:

<authorization>
    <name>Deny Repository Objects page</name>
    <decision>deny</decision>
    <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#debugs</action>
</authorization>

This removes access to the entire Repository Objects page, including the destructive actions available there.

These deny authorizations can either be added directly to the Superuser role or placed into a separate restricting role that is assigned to the user in addition to the Superuser role.

Unfortunately, we did not find a dedicated authorization that would disable only the Delete all actions while leaving the rest of the page and functionality available.

Kind regards,

Dobruše Lukášová

------------------------------------------------------------



Is there a way to remove the option or the permissions that allow a super user to "Delete All Objects" or "Delete all Shadows" from the repository menu and other screen where that may exist. There is no reason that I can think of where we would want to do this in production and unfortunately it has happen by accident twice in the last 2 years. 


STEVEN L ASHWILL
Software Engineer Coordinator
Administrative Information Technology Services
University of Illinois at Urbana-Champaign
50 Gerty Drive | M/C 673
Champaign, IL 61820
217.265.6337 |?sashwill at uillinois.edu
www.aits.uillinois.edu
?


Under the Illinois Freedom of Information Act any written communication to or from university employees regarding university business is a public record and may be subject to public disclosure.?




------------------------------