Forum Discussion
RMA - Role Based Security
RMA - Role Based Security
Background
Via customization we've been able to provide role based security at the folder or instance file level - which when we tried to upgrade from 6.0 to 6.5 was a nightmare.
For future projects we are trying to minimize the amount of customization done to the RMA - thus my questions.
Questions
(1) What's "best practice" for RMA authentication and security surrounding the application, folders, and even instance files?
(2) Even if it's not best practice, is it possible to configure role based security (with Active Directory) for the above mentioned?
*We have different rule writers that need to manage different instance files (Rulesets, Decision Tables, etc.) without anyone else being able to see or edit them.
4 Replies
We can use any LDAP systems as well as JAAS systems to configure Authentication and authorization on your repository as well as RMA.
You need to provide implementation for NdRepositoryAuthorizationManager and register it in the repository configuration file(com-blazesoft_repository_config.cfg).
I'm looking for more than just top level repository security.
The main question is "Can you configure instance file (or folder level) role base security without customizing the RMA? If so, how?".
- You need not customize your RMA to implement A&A, you can use the repository level configuration for A&A which is used by RMA, as RMA gets the data from repository using Blaze API's. If your repository supports authentication and authorization, the folders and instances the user can see or select will depend on the privileges they have.(In RMA as well as Repo)
There is an example of custom Authentication & Authorization manager at <Advisor_Home>\examples\authorizationManager\java\exaTheremplesAuthorizationManager
You can surely modify it so that the AAM class integrates with your LDAP for role based access to repository folders. There is no RMA customization as such, this AAM works at the repository layer. So whatever you implement will be available for both RMA and IDE.
