Selecting authorizers using a plugin

Planning and testing

The plugin for the Authorizer modification plugin point must be carefully crafted because it is being executed multiple times during the authorization process.

Proper testing is considered best practice while developing these plugins.

The Bravura Security Fabric administrator should document the expected authorization workflow behavior prior to the creation of the plugin. The documented behavior should then be used as a guidance tool while developing and testing the authorization plugin.

Requirements

See Writing plugins for general requirements.

Execution points

This plugin is run by idwfm for every new request and then every time there is an action on the request. It is not run when the requester or recipient cancels a request.

If the plugin causes any changes to a request, those changes are written to the database and the plugin is executed again. The process repeats until the plugin no longer causes any changes.

Input

Input to the plugin includes:

"" "" = {
  "sessionid" = "<session ID>" # The session ID
  "extras" "" = {
    "actor" = "<Profile ID>" # The user causing the event
    "event" = "<EVENT_POST_BATCH|EVENT_AUTH_REJECTED|EVENT_AUTH_APPROVED|EVENT_BATCH_ATTRS_UPDATE>" # The event causing the plugin to be called
    "numrerun" = "<#>" # The number of times the plugin has run in the event
    "primary" = "<Profile ID>" # The user that is involved with the event
         
    "firstrun" = "<true|false>" # True if the plugin is run for the first time for the request.
                                # Otherwise, false or the key is not prsent.
  } # Extra information about when it is executed
  "event" = "<EVENT ID>" # The chain of events being evaluated.  1 or more keys are present.
  "request" "" = { # Standard request data listing resources
    "resource" "" = {} # 0 or more
  }
} 

Output

Output to the plugin includes:

 "" "" = {
    "errmsg" = "<text>"
    "infomsg" = "<text>" # Optional; Appends message to the request notes.
    "retval" = "<N>" # Mandatory; zero is success and non-zero is failure
    "runWizardPlugin" = "true|false" # true means wizard plugin will run after
                                     # authmod plugin is completed
                                     # false or missing this flag in kvg file
                                     # means that wizard plugin will not run
                                     # after authmod plugin is completed
    "request" = "<Batch ID>" = {
        "batchauthnote" = "<authorization note for the batch>"
    }
    "authorizer" "<authorizer's profile ID>" = { # 0 or more to add or reset
         
                                                 # authorization status.
       # Authorizer KVGroups as detailed below in
       # Subsubsection 6.3.7.1 .
   }
    "resource" "<Resource ID from the request>" = {
       "finalized" = <true|false>
               # All attached resources are not finalized by default.  By
               # default, resource operations wait for the request to be
               # decided (all authorizations received) on all resources.  If
               # the plugin sets a resource to be finalized (true) and the
               # approvals are received for the resource, the operations are
               # executed before other resource approvals are received.
               #
               # When finalizing roles, all role member/entitlements must be
         
               # finalized, and all authorizations for the role must be
               # received before processing role members/entitlements.
       "authorizationsRequired" = "<N>" #Optional, no change if omitted
               # If 0, the resource is auto-approved.
               # If greater than the number of resource authorizers,
               # insufficient approval will deny the request
               # immediately.
       "acctauthnote" = "<authorization note for resource>"
       "phase" "<phase number>" = { #Required; 1 or more phases
         "authorizationsReceived" = "<N>"
         "authorizationsRequired" = "<N>"
         "authorizer" = "<profile id>" #
               # One entry per authorizer is required.
               # If an authorizer is attached in the input and
               # not listed here, then they will be removed from the list
               # of authorizers.
               # If a new authorizer is listed here and not on the resource input,
               # they will be attached to the resource for authorization.
         "rejectionsReceived" = "<N>"
         "rejectionsRequired" = "<N>"
       }
    }
} 

Authorizer KVGroups

On output, the following authorizer KVGroups format is expected:

   "authorizer" "<authorizer id>" = {
      "resource" "<resource id>" = {
          "reason" = "<reason for being assigned>"
          "status" = "<resource authorization status>"
          "authauthnote" = "<authorization note for authorizer>"
      } # one or more
  } # one per authorizer 

Status can be:

When a resource needs 1 of 3 authorizers to approve, and one does, the other two are set to "irrelevant" since their answer (approve or reject) is not required any more. "P" is similar to "I" (irrelevant) in that they are not notified or expected to provide their approval. Once a phase is satisfied by the required authorizations, the status of the next phase of authorizers changes from "P" to "O".

Examples

The following are examples of KVGroup plugin output: