(Click to open topic with navigation)
Moab Accounting Manager uses instance-level role-based access controls to determine what users can perform what functions. Named roles are created, actions are associated with the roles, and users are assigned to these roles.
The actions for a role consist of a set of tuples of object, action and instance permitted by the role. In other words, each role action defines an object (whether specific or ANY), the action that can be taken on that object (whether specific or ANY) and the instance of the object that action can be taken on (whether specific or ANY).
In the base configuration, there are three default roles: SystemAdmin, Anonymous and OVERRIDE. Other configurations, such as the bank configuration, add additional roles. Roles can be added as desired. The three base roles are required for proper function of Moab Accounting Manager and should not be deleted. By default, the SystemAdmin role can perform any action on any object. This role is usually assigned to the super user. The Anonymous role is intended to define the actions available to your standard unprivileged user. This may include the ability to set your password, query certain public objects and modify objects that belong to you (implemented via the OVERRIDE role). The OVERRIDE role is a special role type that defines those actions that should use special business logic intrinsic to the routine that handles that object and action. For example, in the bank configuration, the OVERRIDE logic for the Account Query routine will only allow the standard user to see information about accounts for which he or she is a member. A given user's privileges will be the superset of the actions of all roles that apply to that user.
The instance indicates which specific instances of the object the action can be performed on. There are several special instance types that can be used in certain situations. The ANY instance is supported by all objects and permits the specified action on all instances of the specified object. The SELF instance applies to the user's own instance if the object is User, or to objects that have a User attribute associated with the user. The MEMBERS instance applies to objects for which the user is a direct member. The ADMIN instance applies to objects for which the user is designated as an administrator. Unless otherwise specified, the instance will default to a value of ANY.