Oracle Service Registry Permission Rules

• Permissions are always positive. This means that permissions say what is possible or allowed. Permissions allow user to perform an action some method on some API. Any action that is not expressly permitted is denied. • Permissions can be set for an individual user or for a group of members. Each user is member of the group systemeveryone , therefore every user has the default permissions associated with this group. For more information, see Section 5.1, Data Access Control: Principles

6.3. Setting Permissions

This section describes the configuration of permissions. The setting of permissions is written from the administrators point of view. There are three basic ways to set permissions for a user: • By performing methods on PermissionApi. A user can call these methods only if that user has the appropriate permissions. • By calling methods via SOAP or via the Registry Control. • By changing permissions directly in the configuration file. The PermissionApi contains several methods for managing permissions. These methods are described below: get_permission Used for obtaining all of a users permissions. A user possessing the ApiManagerPermission can obtain permissions of other users. A user with only ApiUserPermission, can only discover his or her own permissions. Note that users who have neither ApiUserPermission nor ApiManagerPermission for a method on PermissionApi , cannot call this method. set_permission Provides users the ability to set permissions for other users. It is necessary to possess ApiManagerPermission for this call. get_permissionDetail Similar to get_permission, this method can be called for more than one user at a time. get_permission takes a principal as the input parameter. On the other hand, get_permissionDetail takes an array of principals as the input parameter. If you want to find out the permissions of three users, you can call get_permission three times or you can call get_permissionDetail once. who_hasPermission Enables a user to find out who owns a given permission. Important It is not recommended to change permissions directly in the configuration file. However, if the administrator wants to change default permissions for new users meaning changing permissions for the group systemeveryone , there is no other possibility. Before making any changes to these permissions, we strongly recommend making a reserve copy of the configuration. The permissions for special users or groups are stored in the file permission_list.xml. Page 368

6.3. Setting Permissions

6.4. Permissions and User Roles

Many systems use user roles in addition to permissions. A user role is usually a set of permissions; it can be predefined in the system or be user-defined. In Oracle Service Registry, the user roles mechanism is implemented by groups. The administrator is allowed to set permissions not only for individual users but also for groups. Instead of restricting the relationship to users and roles, it is possible to create groups, set permissions for them and then add users into these groups. This group mechanism in Oracle Service Registry is nearly the same as user role mechanism and it is used instead of user roles. For more information, see Section 1.3, Group Management .

6.5. ApiManagerPermission Reference

ApiManagerPermission allow user to use operation in a privileged mode. The following tables explain what does it mean for certain APIs and operations. Table 4. Account API org.systinet.uddi.account.AccountApi Description operation action Not used. find_userAccount Allows to get foreign account. get_userAccount Allows to saveupdate any account. Allows to set up non default limits. Allows to skip mail confirmation if it is required. save_userAccount Allows to delete any account. delete_userAccount Not used. enable_userAccount Table 5. Admin Utils API org.systinet.uddi.admin.AdministrationUtilsApi Description operation action Allows to call the deleteTModel operation. ApiUserPermission is not sufficient to call the operation. deleteTModel Allows to call the replaceKey operation. ApiUserPermission is not sufficient to call the operation. replaceKey Allows to call the cleanSubscriptionHistory operation. ApiUserPermission is not sufficient to call the operation. cleanSubscriptionHistory Allows to call the resetDiscoveryURLs operation. ApiUserPermission is not sufficient to call the operation. resetDiscoveryURLs Allows to call the transform_keyedReferences operation. ApiUserPermission is not sufficient to call the operation. transform_keyedReferences Allows to call the rebuild_cache operation. ApiUserPermission is not sufficient to call the operation. rebuild_cache Allows to call the replaceURL operation. ApiUserPermission is not sufficient to call the operation. replaceURL Page 369

6.5. ApiManagerPermission Reference