Adding Access Check Rules and Policies

To add access check rules and policies, use the Attribute-Based Access Control section on the navigation panel:

Make sure that the Use Attribute-Based Access Control checkbox is selected in the access control.

NOTE. When roles of the information security administrator and the application administrator are separated, the Attribute-Based Access Control section is available only for the information security administrator. Attribute-based access control structure creation (attribute addition, policy and rules editing) is controlled by the system and is available to the administrator with the Changing User Permissions, Distributing Roles, Changing Policy and the Changing Security Label and Access Control List of Any Object privileges.

The section is based on the attribute-based access control method, it is used to create access check rules with necessary conditions. The system checks if a user can execute a specific action with an object and/or data segment through an attribute check.

The section contains the attribute-based access control structure that includes the elements hierarchy:

IMPORTANT. If attribute-based access control structure is not set, all operations with objects are denied.

To add a set of policies:

Select in the Attribute-Based Access-Control policies list hierarchy:

Click the Create button in the toolbar.
Select the Add Set item in the drop-down menu of the Create button.

Select the existing set of policies in the list hierarchy:

Select the Add Set item in the drop-down menu of the Create button.

After executing one of the operations the set of policies for the selected element in the list hierarchy is added. Set properties of a set of policies on the Properties side panel.

To add a policy, select the existing set of policies in the list hierarchy:

Click the Create button in the toolbar.
Select the Add Policy item in the drop-down menu of the Create button.

After executing one of the operations the policy is added for the selected set of policies. Set properties of a set of policies on the Properties side panel.

To add a rule, select the existing policy in the list hierarchy:

Click the Create button in the toolbar.
Select the Add Rule item in the drop-down menu of the Create button.

After executing one of the operations the rule for the selected policy is added. Set properties of a set of policies on the Properties side panel.

For attribute-based access control, selected set of policies, policy, rule, set properties that determine access to objects and/or data segments on the Properties side panel.

Description of properties:

Name. The name that unites the set of policies, policies and rules.
Objective. A condition for further checking user action access to object.

IMPORTANT. If a rule is added, the field is mandatory. When a set of policies and a policy are added, the objective is set as data filtering.

Condition. Additional condition of access control as a dynamically calculated logical expression. An MDM dictionary element attribute is also specified as a condition to set up user access permissions to element.
Effect. Enable or disable access after the rule execution.

NOTE. The effect works if logical expression calculation result matches in the objective and the condition.

Root Set/Policies/Rule Combination Algorithm. A drop-down list of algorithms, which determines the access:

Deny Overriding. It denies access if at least one calculation result returns deny.
Allow Overriding. It allows access if at least one calculation result returns allow.
Apply the First Available Rule. The calculation result of the first available rule in the policy hierarchy. The rule is available if logical expression calculation result matches in the objective and the condition.

NOTE. If no rule is available, the policy is not executed.

Apply the Only Available Rule. The calculation result of the single available rule in the policy hierarchy. The rule is available if logical expression calculation result matches in the objective and the condition.

NOTE. If the policy contains several rules or the single rule is unavailable, the policy is not executed.

Description. The comment to the generated set of policies, policy, rule.

After creating an access check policy the section will display attribute-based access structure.

To optimally place attribute-based access control elements in the structure, use the

Up and

Down buttons or Drag&Drop mechanism.

If required, delete attribute-based access control elements using the

Delete button.