Access Permissions for MDM Dictionary Elements
Setup of access permissions for MDM dictionary elements depends on the selected access control methods.
Discretionary Access Control Method
When selecting discretionary access control method, follow the steps:
Make sure that the Use Discretionary Access Control checkbox is selected on the Access Control tab in the Policies Editor section.
Set up access parameters for a specific user for:
Required MDM dictionary.
Database that stores dictionary data.
Access parameters can be set up on the Discretionary Access Control tab on the Properties side panel in the Navigator section.
Select the checkboxes next to general operations to allow or deny them. To set up access to a dictionary and database at the same time, select the dictionary and click the 
Linked Objects button on the toolbar. Select checkboxes next to the objects, which permissions must be changed, on the Discretionary Access Control tab and click the Apply Permissions button.
Select the Elements have Discretionary Access Permissions checkbox on the Basic Settings page in the MDM dictionary wizard.
Set up access permissions for the selected dictionary element using the Access Permissions item in the dictionary element's context menu. The Access Permissions dialog box opens to set up dictionary element access permissions. The command is available for the dictionary element selected in the MDM dictionary opened for edit in the object navigator.
If the dialog box is opened for several elements, access permission settings are displayed for the focused element. When setting access permissions these permissions are set for all selected elements.
In the dialog box that opens select checkboxes next to the operations that will be allowed or denied for the user when working with elements. Deny the operations on the elements, for which the user must not have access.
Disabling Discretionary Access to Elements
To disable discretionary access to MDM dictionary elements:
Make sure that element attributes that are responsible for discretionary permissions do not have parameters added, no keys added, and the Alternative Hierarchy checkbox is deselected in properties.
Deselect the Elements have Discretionary Access Permissionscheckbox on the Basic Settings page in the MDM dictionary wizard.
After discretionary access control is disabled for MDM dictionary elements, the user has full access to dictionary elements.
Attribute-Based Access Control Method
Access permission control for MDM dictionary elements is executed if:
Attribute-based access control method and discretionary access control method are used simultaneously.
Only attribute-based access control method is used.
Access control methods can be selected on Access Control tab in the Policies Editor section.
When selecting attribute-based and discretionary access control methods, follow the steps:
Make sure that the Use Attribute-Based Access Control and the Use Discretionary Access Control checkboxes are selected on the Access Protocol tab in the Policies Editor section, and the OR access permission combination option is selected.
Make sure that discretionary access control parameters for a specific user enable all operations on objects:
Folder containing MDM dictionary. If the MDM dictionary is not located in the repository root, but in the folder or folder hierarchy, each folder must not have denied operations.
Database that stores MDM dictionary data.
Internal MDM dictionary table.
Discretionary access permissions can be set up for each object on the Discretionary Access Control tab on the Properties side panel in the Navigator section.
Create an attribute-based access control structure that sets access permissions for a specific user to MDM dictionary elements, in the Attribute-Based Access Control section.
Set of policies determines the user, for whom access for MDM dictionary elements is set up. For example:
Objective: SUBJECT.NAME = <user name>.
Rule combination algorithm: Allow overriding.
Policy determines access to the MDM dictionary by key or identifier. For example:
Objective: OBJECT.KEY = <MDM dictionary key> or OBJECT.ID = <MDM dictionary identifier>.
Rule combination algorithm: Allow overriding.
Rules determine access to MDM dictionary elements. For example:
Objective: OPERATION = <specific operation value>.
An additional condition is set for rules, which specifies comparison of element attribute where the value corresponding to data type of attribute identifier, and effect that determines whether it is allowed or denied access by rule execution result.
NOTE. When creating an additional condition take into account features of MDM dictionary element attribute use.
Examples of access control rules for MDM dictionary elements are given in the Example section.
Select the Elements have Attribute-Based Access Permissions checkbox on the Basic Settings page in the MDM dictionary wizard.
After executing the operations, attribute access control method rules will be applied to MDM dictionary elements. When attribute-based and discretionary access control methods are used at the same time, one can apply access control methods to MDM dictionary elements using discretionary access control. For details see the Discretionary Access Control Method section.
When only attribute-based access control method is selected, the built-in authorization should be used. Access permission control for MDM dictionary elements is set up for the users not included in the ADMINISTRATORS built-in group. To do this, follow the steps:
Make sure that the Use Attribute-Based Access Control checkbox is selected on the Access Control tab in the Policies Editor section.
Create an attribute-based access control structure that determines access permissions for a specific user to MDM dictionary elements, in the Attribute-Based Access Control section. The attribute-based access control structure should contain:
Access permissions for MDM dictionary and the following objects:
Folder containing the MDM dictionary. If the MDM dictionary is not located in the repository root, but in the folder or folder hierarchy, each folder must not have denied operations.
Database that stores MDM dictionary data.
Internal MDM dictionary table.
Access denials for MDM dictionary elements.
Select the Elements have Attribute-Based Access Permissions checkbox on the Basic Settings page in the MDM dictionary wizard.
After executing the operations, attribute-based access control method rules are applied to MDM dictionary elements.
Access permissions for MDM dictionary elements can be set up in the development environment using the ABAC assembly. The example of denying the user to read MDM dictionary element is given in the Access Permissions for MDM Dictionary Elements section.
Example
The example displays the attribute-based access control structure when only the attribute-based access control method is used. The structure contains two sets of policies that limit access of a specific user for MDM dictionary elements:
The first set of policies contains a policy and a rule that determine full access of a specific user for all repository objects:
Parameters of set of policies:
Objective: SUBJECT.NAME = <user name>.
Rule combination algorithm: Allow overriding.
Policy parameters:
Objective: OBJECT.KEY >= 0.
Rule combination algorithm: Allow overriding.
Rule parameters:
Objective: OPERATION IN 1.
Effect: Allow.
Rule combination algorithm: Allow overriding.
The second set of policies determines an object class, for which access is set up, a policy determines access to a specific MDM dictionary by key or identifier, rules determine access to MDM dictionary elements:
Parameters of set of policies:
Objective: OBJECT.CLASS = <object class: MDM dictionary>.
Rule combination algorithm: Allow overriding.
Policy parameters:
Objective: OBJECT.KEY = <MDM dictionary key> or OBJECT.ID = <MDM dictionary identifier>.
Rule combination algorithm: Allow overriding.
Rule parameters:
Objective: OPERATION = <specific operation value>.
An additional condition is set for rules, which specifies comparison of element attribute where the value corresponding to data type of attribute identifier, and effect that determines whether it is allowed or denied access by rule execution result.
Parameters of access control rules for MDM dictionary elements, for example:
Deny reading elements of one-level MDM dictionary with the 1 and 2 keys:
Objective: OPERATION = 1048576.
Condition: (OBJECT.ELEMENT.KEY >= 0) And (OBJECT.ELEMENT.KEY <= 2).
Effect: Deny.
Deny editing MDM dictionary element with the 3 key.
Objective: OPERATION = 2097152.
Condition: OBJECT.ELEMENT.KEY = 3.
Effect: Deny.
Disabling Attribute-Based Access Control to Elements
To disable attribute-based access control to MDM dictionary elements, deselect the Elements have Attribute-Based Access Permissions checkbox on the Basic Settings in the MDM dictionary wizard.