Makes sense. Thanks much Aditi. !!
Original Message:
Sent: 03-12-2024 06:30
From: Aditi Verma
Subject: Permissions for entity types based on the value of specific attribute
Hi @Nidheesh R
I am glad this was helpful!
To your first question, we do not have an API to update the metadata security configuration at the moment. So the only way to update this config, will be to Delete and post the new version of it. APIs are available here - Metadata security APIs
Regarding the permissions in each of these roles, I would suggest you start by creating these roles without any specific service permissions. Create Roles API
So each of the roles mentioned above, would be created empty without any services attached to them. Next, when you are creating user Groups, you can add these OOB roles - ROLE_API and ROLE_USER along with the new empty roles that you have created in previous steps. Example - Finance Group will have - ROLE_API + ROLE_USER + ROLE_CUSTOMER_FINANCE_EDIT + ROLE_CUSTOMER_HEALTH_READ_ONLY .
ROLE_API and ROLE_USER should give enough permissions for a user to access tenant and data and then your custom roles will be able to filter the data and make only the applicable data visible/editable to the users.
Let me know, if it helps.
Thanks.
------------------------------
Aditi Verma
------------------------------
Original Message:
Sent: 03-11-2024 16:12
From: Nidheesh R
Subject: Permissions for entity types based on the value of specific attribute
Thanks much Aditi. You response has helped a long way in shaping our feature. I'm however stuck at a point now.
For any change is metadata permission, it is demanding a DELETE API call to erase the existing metadata configuration. And it is only then the new metadata permissions are able to update. Would like to know if this is expected.
Also, it would be of great help if you can share a sample custom role Json(similar to the the existing Reltio System Roles) to create basic permissions for any user to have a READONLY view of all the UI data and features in a Reltio tenant. Because, I think it is a good approach to have basic/minimum default role that is required for a user to access a read-only mode of Reltio UI data and, all features the UI offers, then create custom roles and apply custom metadata role permissions on top of it based on the metadata security we are discussing here.
Tried doing this myself but ending up with this error.
"Permission denied. Access to object entities/* is forbidden. Required privileges: READ"
------------------------------
Nidheesh R
EPAM Systems
Original Message:
Sent: 03-07-2024 09:34
From: Aditi Verma
Subject: Permissions for entity types based on the value of specific attribute
Hi @Nidheesh R
You can try it this way -
1. Create 6 roles ( or more depending on granularity of operations you will do in Reltio) one for read only access to each domain of data and one for edit access to each domain. You can check the config I have pasted below for different roles.
2. In your Finance User group, add ROLE_CUSTOMER_FINANCE_EDIT and ROLE_CUSTOMER_HEALTH_READ_ONLY. Now all the user associated to this group will have 1. Read-only access to Health Business Domain data, Edit access to Finance Business domain data and no visibility to Audit Business domain data.
3. Create a metadata security configuration like below ( Reltio doc - https://docs.reltio.com/en/explore/get-going-with-apis-and-rocs-utilities/reltio-rest-apis/engage-apis/configuration-api/role-based-security/metadata-security)
[
{
"uri": "configuration/entityTypes/MyEntity",
"permissions": [
{
"role": "ROLE_CUSTOMER_FINANCE_EDIT",
"filter": "equals(attributes.BusinessDomain ,'Finance')",
"access": [
"READ",
"CREATE",
"UPDATE"
]
},
{
"role": "ROLE_CUSTOMER_FINANCE_READ_ONLY",
"filter": "equals(attributes.BusinessDomain ,'Finance')",
"access": [
"READ"
]
},
{
"role": "ROLE_CUSTOMER_HEALTH_READ_ONLY",
"filter": "equals(attributes.BusinessDomain ,'Health')",
"access": [
"READ"
]
},
{
"role": "ROLE_CUSTOMER_HEALTH_EDIT",
"filter": "equals(attributes.BusinessDomain ,'Health')",
"access": [
"READ",
"CREATE",
"UPDATE"
]
},
{
"role": "ROLE_CUSTOMER_AUDIT_READ_ONLY",
"filter": "equals(attributes.BusinessDomain ,'Audit')",
"access": [
"READ"
]
},
{
"role": "ROLE_CUSTOMER_AUDIT_EDIT",
"filter": "equals(attributes.BusinessDomain ,'Audit')",
"access": [
"READ",
"CREATE",
"UPDATE"
]
}
]
}
]
4. You can add more levels to the permissions based on your full use case, but using metadata security config should help you achieve this use-case.
------------------------------
Aditi Verma