Roles, Privileges, and Actions
QVCS-Enterprise provides a role/privilege/action approach to authorization. Each user is assigned one or more roles for a project. When a user tries to perform an action, the server checks to see if any of the roles assigned to the user has the privilege to perform the requested action. If any of the user's assigned roles have the privilege to perform the requested action, action will be allowed; if none of the user's roles have the required privilege, the action will be denied.
For example, in order to checkin any changes for a given project, a user must have the "Check in " privilege. The pre-defined WRITER and DEVELOPER roles have this privilege enabled. As a consequence, if a user is assigned the WRITER and/or DEVELOPER roles, they will be allowed to checkin a file for the given project.
In order to even view a project, a user must have a "Get file " privilege. The pre-defined READER and DEVELOPER roles have this privilege enabled.
The ADMIN user, using the ADMIN tool, can define new roles to create a customized set of privileges for the given role. For example, it might make sense to create a TESTER role that included only those specific privileges needed for a TESTER to perform their job.
Role assignments are always at the project level. This means that a user may have different roles for different projects.
This table lists all the actions that can be requested, and identifies which built-in roles include that privilege.
Action/Privilege: | Pre-defined role(s) that include this privilege |
(Admin tool): Add user role | PROJECT_ADMIN |
(Admin tool): Remove user role | PROJECT_ADMIN |
(Admin tool): Assign user roles | PROJECT_ADMIN |
(Admin tool): List project users | PROJECT_ADMIN |
(Admin tool): List user roles | PROJECT_ADMIN |
(Admin tool): Maintain project | PROJECT_ADMIN |
Add directory | PROJECT_ADMIN |
Delete directory | PROJECT_ADMIN |
Maintain view | PROJECT_ADMIN |
Show cemetery | CEMETERY_ADMIN |
Break lock | PROJECT_ADMIN |
Get file | READER, DEVELOPER |
Get directory | READER, DEVELOPER |
Check out | WRITER, DEVELOPER |
Check in | WRITER, DEVELOPER |
Lock | WRITER, DEVELOPER |
Unlock | WRITER, DEVELOPER |
Label | WRITER, DEVELOPER |
Label directory | WRITER, DEVELOPER |
Label at checkin | WRITER, DEVELOPER |
Remove label | WRITER, DEVELOPER |
Remove label from directory | WRITER, DEVELOPER |
Rename file | WRITER, DEVELOPER |
Move file | WRITER, DEVELOPER |
Delete file | WRITER, DEVELOPER |
Set file attributes | WRITER, DEVELOPER |
Set comment prefix | WRITER, DEVELOPER |
Set file description | WRITER, DEVELOPER |
Set revision description | WRITER, DEVELOPER |
Create archive | WRITER, DEVELOPER |
In addition to the actions listed above, there are several actions that can only be performed by the ADMIN user using the admin tool. These actions are:
Action: | Purpose: |
Add user to server | Defines a user so they can login to the server. |
Remove user from server | Removes an existing user so they cannot login to the server. |
Maintain role privileges | Allows the ADMIN user to define and modify roles and their associated privileges. |
Create Project | Create a new project. |
Delete Project | Delete an existing project. |
Shutdown Server | Request the server to shutdown. |
The ADMIN role is built-in, and its privileges cannot be altered. The other built-in roles' privileges may be altered by the ADMIN user.
|