Skip navigation.
Downloads | Product Documentation | Support

Integrating ALES with Application Environments

# Setting Up Application Security Administrators

ALES allows you to set up application-level administrators who are responsible for managing the security for a specific application. The application-level administrator will be able to manage the policies protecting resources belonging to that application, but no others. This chapter describes some basic steps for establishing an application-level security administrators and provisioning them with an initial framework for protecting applications. This section provides information on the following topics:

- Overview on page 3-1
- Create Administrative Users on page 3-2

# Overview

Although the design of the administrative model will vary by use, it is presumed that the task of defining policies to secure an application will be assigned to application-level administrator who have complete rights only for the specific application.

The basic procedure described here for setting up an application-level administrator is to create a parent application resource that will contain a representation of the application in the resource tree, create administrator user accounts and groups as needed, and then use policies that will allow the administrators to manage the application's security.

# Establishing a Resource Parent for the Application

To represent an application in ALES, create an `binding application' resource to serve as the application parent. Then give the application security administrator the right to build resources under this parent.

To create an `binding application' resource for an application:

1. Select the Resource node in the navigation tree to display the current resource tree in the right page.
2. Right-click the top parent resource that will contain the application and select Add Resource.
3. Enter a resource name and select Binding in Type field. Then click OK.
4. Right-click the new resource and select Configure Resource.
5. Select Binding Application in the Type field and click OK.

# Create Administrative Users

User accounts are needed for the application security administrators. When desired, you may create application-specific directories containing users and groups for the application.

Note: An implicit group named `allusers` is automatically added to all directories.

## Identity Directories

To create a separate directory for an application's users/groups:

1. Select the Identity node in the navigation tree to display the current directories in the right page. After ALES is installed, there is one directory named ASI.
2. Click on New in the lower right page.
3. On the Create Directory dialog, enter the directory name and click OK.

## Users and Groups

To add a user or group to a directory:

1. Select the Identity node in the navigation tree to display the current directories in the right page.
2. Click on the directory where you want to add the user or group, then select Edit Users or Edit Groups at the bottom of the page. This displays the directory's groups or users depending on your selection.
3. Select New at the bottom of the page.
4. On the dialog that displays, enter the user or group name and select OK.

## Policies

Once the application parent is defined in the resource tree and the necessary identifies have been created, you can use policies to determine administrative access to the application. A number of ways to do this is shown below.

Note: A comprehensive understanding of this process can be obtained by examining the policies already in place for ALES components.

- Using policy constraints allows you to limit administrative rights. For example, the following policy assigns the Admin role to Joe only for managing resources for the Petstore application.

`grant(//role/Admin, //app/policy/ASI/admin/Resource, //user/asi/Joe/) if resource_is_child(resource, //app/policy/Petstore, no);`

Figure 3-1 Using the Resource_is_Child Constraint

- Assign Admin role to Bob (user) for the purpose of performing inquiries on policies set on the Petstore application.

`grant(//role/Admin, //app/policy/ASI/admin, //user/asi/Bob/) if sys_defined(resource) and resource_is_child(resource, //app/policy/Petstore, no);`