Access control functionalities in Bonita 6.5
I don't think there is a single easy answer to this question.
From Wikipedia
In information security, computer science, and other fields, the principle of least privilege (also known as the principle of minimal privilege or the principle of least authority) requires that in a particular abstraction layer of a computing environment, every module (such as a process, a user or a program depending on the subject) must be able to access only the information and resources that are necessary for its legitimate purpose.
And on this basis if you were to ask does a process have any access to any business data without it being assigned to the process, then I would have to say (contingent on the assumption the system hasn't been hacked) that the answer is least privilege is applied. No data is accessible to any process unless so assigned.
However you have to consider is what is minimal information for the process, this is beholden to the designer and developer of the physical process. I agree that ordinarily you would only want the relevant data necessary for a process. But looking at some previous questions people do not think like that...
Some have written processes that say for this Group of people under this role (C) show these fields but when under this role (D) show them a different sub-set of the same fields. The process still has access to the fields which these users are no-longer using and falls foul of the rules of least privilege.
Is this bad security, or good, normalized, process design?
Can a process extend it's reach beyond the data it has been assigned and hack its way to other data? Not that I know.
Further information on BonitaSoft Security can be found here:
http://documentation.bonitasoft.com/product-bos-sp/security-and-authentication
and for the organization/actor mappings
http://documentation.bonitasoft.com/product-bos-sp/organization
I know it's not much help but hopefully it's a starter for 10...
regards
Comments
Hello Sean McP, Thank you for your answer , but I think that my question wasn't clear , I was in particular asking about permissions given to a user. If he wants to do a task that requires a permission X , but he has other permissions , would all his permissions be "activated" or only permission X that is needed ? what about conflicting entities ? I hope it's clear now
Why aren't I getting answers ? what's wrong with that question ? :(
With respect,
What's wrong with me not answering while I'm at work? Some people do not live in the normal world and have to work Sunday. Actually - the Community is really only ever manned on a Monday thru Friday so the fact that I answered on Sunday is out of my kindness.
I do not work for BonitaSoft and give of my free time. With community you have to give it time. If you want immediate answers then I suggest you buy the subscription model of the software with 24x7 support. Or pay and go on a course...
Apologies, it's been a challenge of a day...
That answers the Why aren't I getting answers?
Now for the What's wrong with that question?
Absolutely nothing, but I have to go and cook break-fast, I might be back later, tomorrow or the day after... :|
Oh I am sorry , I said that while the number of views were incrementing (60) and there are no answers , I was really not talking about you. I am sorry again and thank you for your help.
Apology accepted,
There are always a lot of people looking at questions but very few of us with the time, or inclination to answer them. you will after a while see who the givers are...
Community is as Community does...I had help when I started, and now I give back...
Now as to your question...
I was in particular asking about permissions given to a user. If he wants to do a task that requires a permission X , but he has other permissions , would all his permissions be "activated" or only permission X that is needed ?
My understanding is as follows (but you need to check):
When a User logs in his profile is activated (does that mean loaded into memory? not sure).
When the user activates a process, the Process Actor is interrogated (who can run this process) and then compared against the users profile(does this user exist as an Actor for this process(group, role etc.)), if yes he can execute the process, if no then the process does not activate.
Note, from my understanding, imagine this
Organization X Group A Role A-1 Role A-2 User UA-1 Group B User UB-1 User UB-2 Role B-1 Role B-2 User UB-2
Process (L) Actor is Role A-2 -> User UA-1 can execute, no one else can
Process (M) Actor is Group B -> User UB-1 and UB-2 can execute, no one else can
Process (N) Actor is Role B-1 -> no one can execute
Process (O) Actor is Role B-2 -> User UB-2 can execute, no one else can execute
As I say that is my understanding...
In one of my organizations for example I have 30 users and over 1,000 groups and roles combined, each with upto 7 roles...the mapping is horrendous... :) but it works.
regards Seán McP