Security profiles

A security profile defines a set of restrictions and authorizations for the platform administration. To be effective, security profiles must be associated with roles. If a role has no security profile, the user connected with this role will not have restrictions on the administration operations. It is important to set up security profiles to ensure the security of the platform administration.

The information entered while defining a security profile is as follows:

Code

Identifies the security profile.

Description

Describes the security profile.

Personalization level

Defines the level of personalization a user can perform on pages:
* None: no personalization is allowed.
* User: personalization is allowed, but only on a page that is dedicated to the user.
* Administrator: the user can modify authored page shared by several users.

Allow Office document upload

Defines whether the user can upload Office documents or not. By default, it is deactivated to protect against malicious Office documents. It has to be activated so that the user can upload Office documents.

Security Level

Defines a numeric level associated with each profile. Profile levels range from 0 to 99. A user can only create/modify security profiles that are higher than the Security profile he is associated with. In other words a user with Security level 1 can only view /maintain Security profiles with security level 2 and above.

Authorizations

In this grid, a list of predefined codes is displayed with an associated description. Every code identifies the corresponding controlled entities with filters.

For example, the users code controls the access to the users, groups, and roles entities. The myProfile code controls the access to the user profile for the connected user. A user may have the right to change its own profile, but not the profile of other users. The detailed list of the codes and associated entities is given in the Appendix section.

For every code, you can select the check boxes to define the access rights granted by the security profile. When a check box is cleared, the access right is denied. A user cannot provide access to codes for which he doen't have rights. If it is the case,the corresponding check boxes are disabled.

The access rights are the usual CRUD access (Creation, Read, Update, and Delete), plus an additional Execution right. The execution right controls dedicated operations as described in the Appendix section.

Associated roles

This section defines the list of roles where the security profile applies. The assignment can be done here or on the roles management.
A role cannot be associated with several security profiles. If the role has no security profile, there is no restriction set on the role.

Factory

This check box defines if the record is supplied as a factory record. When this happens, a factory code is also displayed and can be entered if you are a factory provider. This features allows to prevent some modifications on records supplied by defaut by Sage or by a vertical solution provider. More information about this feature is given in the following document.

Appendix: definition of security profile codes

The list of codes and their corresponding entities are defined in the following table:

• For every code, a list of entities can be given.
• If the filter is not filled, the access rights apply on the whole entity.
• The Execution right describes the associated operations if they exist.