...
| Excerpt |
|---|
The JOC Cockpit brings user authentication and authorization to the JobScheduler. Authentication can either take place against a Shiro compliant configuration file or , an LDAP compliant directory service or information stored in a database. Authorization is defined in roles - a set of roles is provided with the JOC Cockpit and users are able to define their own roles. The JOC Cockpit is able to handle authentication of multiple users and their authorization for multiple JobSchedulers simultaneously. |
| Status | ||||||
|---|---|---|---|---|---|---|
|
Authentication and Authorization
- The JOC Cockpit makes use of Apache Shiro to authenticate and authorize users.
- Authentication and Authorization can be mapped:
- to a directory service that provides an LDAP interface, e.g. Microsoft Active Directory,
- to a local configuration file (shiro.ini) that includes user names, roles and permission,
- to database that complies to with the Shiro data model requirements and that is managed (and populated) by an administrator.
...
- The JOC Cockpit accepts the user name and password from the login screen and:
- either tries to verify the credentials from its local configuration file,
- tries to login to the Active Directory service with the given credentialsor tries to verify the credentials from its local configuration file,
- or checks the credentials in a Shiro compliant database.
- The credentials are subsequently used for HTTP Authentication with each HTTP request that is created by the JOC Cockpit to the JobScheduler Web Services.
- Browsers may cache credentials during a session, i.e. they are re-used for single sign-on when opening the JOC Cockpit in a new browser tab. The credentials cache is cleared on termination of the browser.
- This behavior might vary depending on the browser and version.
- Authentication is configured in an
.inifile described in detail in the .... article.
Authorization
- After successful authentication the JOC Cockpit will check the assignment of roles to the given user:
- either by using a configurable LDAP query that checks membership of the user with a number of Active Directory groups. An LDAP query is configured for each role and in case of a positive match for group membership the user is assigned the respective relevant role.
- or by using its local configuration file that includes a assignment of users and roles.
- The assignment of permissions to roles is configured with the local
shiro.iniconfiguration file.- By default the JOC Cockpit ships with a number of predefined roles and assigned permission, see below the Matrix of Roles and Permissions below.
- Roles Users can be added.The assignment of permissions to roles can be changed:
- add additional roles of their own,
- change the permissions assigned to roles.
- Authorization is configured in an
.inifile described in detail in the .... article.
User Profile and Roles
The following screenshot shows the JOC Cockpit User Profile view with the User Details and Roles information:
...
The document below shows the default roles and permissions delivered with the JOC Cockpit. Users can define additional roles and modify permissions as required.
Document: joc-role-operation-permission.xlsx
...
- What cannot be changed:
- The number and type of permissions is fixed.
- What can be changed:
- The number of roles can be changed.
- The permission value yes/no can be changed for each permisison permission in each role.
- A user can be assigned any number of the roles offered.
- Role/permissions configuration file:
- The configuration of the permissions for each role is stored in a
shiro.inifile. - Users can be added to groups in an Active Directory for which queries have to be configured with
shiro.ini.
- The configuration of the permissions for each role is stored in a