Resource attribute groups
A resource attribute group is a named collection of resource attributes. You can configure resource attribute groups to include resource attributes on the resource definition pages for:
Target systems
Template accounts
Roles
managed group s
Managed systems
Managed accounts
Account group memberships
Computer group memberships
Child group memberships
Role memberships
SoD rules
You must also configure access controls to determine who can read and write resource attribute values.
Getting started
Requirements
Before you add a resource attribute group:
You require the Manage resources administrative privilege in order to access the Resource attribute groups menu item.
Navigation steps
Use the page to add and configure resource attribute groups. To navigate to this page:
Click Manage the system > Resources > Resource attribute groups.
To define a:
New resource attribute group – click Add new....
Existing resource attribute group – search for, or select the resource attribute group you want to view or modify.
Built-in resource attribute groups
The following attribute groups are included in Bravura Security Fabric :
GROUP_INFO_CREATE | Group information used in create group operations. |
GROUP_INFO_UPDATE | Group information used in update group operations. |
SOD_EXCEPTION_EXPIRY | Expiry settings for requested exceptions to SoD rules. |
ROLE_VALIDITY | Defines the start and end times for role entitlements. |
Creating resource attribute groups
To create a resource attribute group:
Navigate to the Resource attribute group definition page .
Type a unique ID and Description.
Select one or more resource types to which you want to apply this group.
Click Add.
Adding attribute group members
To add resource attributes to a resource attribute group:
From the Resource attribute group definition page , click the Members tab.
Click Select… to see a list of all resource attributes.
Select or enable the checkboxes next to the resource attributes you want to include.
Click Select .
To remove resource attributes from the resource attribute group, enable the checkbox next to the resource attribute and click Delete. If required confirm your actions .
Assigning read and write permissions
There must be at least one user group defined for Access to resource attributes before you can assign read and write permissions for a resource attribute group.
To add a user group to control access to resource attribute groups:
Click Manage the system > Security > Access to resource groups.
Click Add new…
Type a unique ID and Description.
Click Add.
Select the Membership Criteria tab.
Select or create user classes to define membership criteria.
Membership of non-built-in user classes can be cached to improve performance. There are options to recalculate or invalidate the cache on the user class configuration page.
Note
In a replicated environment, cache recalculation can only be performed on the instance which runs psupdate.
After you have defined user groups, you can assign read and write permissions for a resource attribute group, either from the page, or the page:
Select the Access control tab.
If required, search to refine the list of groups displayed on the page.
Select Read and Write checkboxes as required.
By default, the checkboxes indicate allowed permissions. If Bravura Security Fabric is configured to display Allow and Deny columns, ensure that you select checkboxes in the appropriate columns.
Click Update.
If you require product administrators to be able to edit attributes, you must assign them both read and write permissions.
Determining how attributes are displayed
To determine how the group’s attribute fields are displayed to users:
From the Resource attribute group definition page , click the Display criteria tab.
Determine the Display type. Select:
Main – to display the group and its attributes on the main resource definition page.
Subsidiary – to display the group’s attributes on a subsidiary page.
None – to hide the group and its attributes from users.
Click Update.
To determine the order in which resource attributes within a group are listed:
From the Resource attribute group definition page , click the Members tab.
Drag and drop one of the double direction arrows in the ID field to change the resource attributes’ order in the list.
Click Update.
Determining attribute group display order
To determine the order in which attribute groups are displayed to users:
Click Manage the system > Resources > Resource attribute groups.
Click Order....
Drag and drop one of the double direction arrows in the ID field to change the attribute groups’ order in the list.
Click Update.
Bravura Security Fabric saves the changes to the attribute groups’ order.