<div style="font-family: Arial, sans-serif; font-size: 14px;">Hi</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">we're trying to create a couple of admin roles to split the "super user" into sub-admins.</div><div style="font-family: Arial, sans-serif; font-size: 14px;">In other words, I want to limit authorisations as much as I can.</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">Our first admin role that will be used is a "role manager" and below is the authorisations that we have right now. I am worried though, that it is not limited enough. There are a couple of authorisations that I haven't been able to use an object or target or anything to specify that the authorisation is referring to. </div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">Please take a look and share any thoughts.</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">kind regards,</div>
<div class="protonmail_signature_block" style="font-family: Arial, sans-serif; font-size: 14px;">
<div class="protonmail_signature_block-user">
Markus<br><br></div><div class="protonmail_signature_block-user"><div style="color: rgb(88, 110, 117); background-color: rgb(253, 246, 227);"><pre style="font-family:'JetBrains Mono',monospace;font-size:9.8pt"><span style="color: rgb(147, 161, 161);"><</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">></span>Manage ALL Roles - GUI Authorisation<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#rolesAll<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#adminAssignMember<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#adminUnassignMember<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">></span>c:RoleType<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(220, 50, 47);"><br></span><span style="color: rgb(147, 161, 161);"><</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">></span>Manage ALL Roles - add/modify/delete authorisation<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">phase</span><span style="color: rgb(147, 161, 161);">></span>request<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">phase</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">></span>c:RoleType<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">></span>c:ShadowType<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">owner</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">></span>c:RoleType<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="font-weight: bold; color: rgb(38, 139, 210);">owner</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"><br></span><span style="color: rgb(147, 161, 161);"><</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">></span>Manage ALL Roles - Assign/Unassign access to users<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#unassign<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-bulk-3#assign<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-bulk-3#unassign<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"><br></span><span style="color: rgb(147, 161, 161);"><</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">></span>Manage ALL Roles - modify USER assignment<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">phase</span><span style="color: rgb(147, 161, 161);">></span>execution<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">phase</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">></span>UserType<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">item</span><span style="color: rgb(147, 161, 161);">></span>assignment<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">item</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"><</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">></span>Manage ALL Roles - modify Shadow assignment<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">name</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">></span>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">action</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">phase</span><span style="color: rgb(147, 161, 161);">></span>execution<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">phase</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">></span>ShadowType<span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">type</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="font-weight: bold; color: rgb(38, 139, 210);">object</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"></</span><span style="font-weight: bold; color: rgb(38, 139, 210);">authorization</span><span style="color: rgb(147, 161, 161);">><br></span></pre></div><br></div><div class="protonmail_signature_block-user"><br></div>
<div class="protonmail_signature_block-proton protonmail_signature_block-empty">
</div>
</div>