Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
docs:3400_how_to:0800_security_and_protection [2022/08/25 06:59] – ↷ Page moved and renamed from docs:3400_how_to:0800_security_and_protection:0000_start to docs:3400_how_to:0800_security_and_protection administratordocs:3400_how_to:0800_security_and_protection [2026/04/01 00:41] (current) – aware_support3
Line 1: Line 1:
 ====== Security And Protection ====== ====== Security And Protection ======
 +==== How To ====
  
 {{simplenavi>docs:3400_how_to:0800_security_and_protection}} {{simplenavi>docs:3400_how_to:0800_security_and_protection}}
 +
 +<accordion id="security protection" collapsed="true">
 +<panel type="primary" title="give different authority to different users">
 +Most multi-user systems require that different categories of users have access to different features of the system. In //**AwareIM**// this is done by assigning different access levels to different users – see the “[[docs:2000_concepts:0900_prod_feats:0100_access_control:0100_access_level|Access Level]]” section.
 +</panel>
 +
 +<panel type="primary" title="limit access to database tables">
 +In //**AwareIM**// you are not dealing with database tables directly – instead you can limit access to business objects – see the “[[docs:2500_config_apps:1400_add_edit_acls|Setting Access to Business Objects]]” section for details. You can also limit access to business objects based on some conditions – see [[docs:3400_how_to:0800_security_and_protection:1040_conditional_access]].
 +</panel>
 +
 +<panel type="primary" title="limit access to records">
 +In //**AwareIM**// you are not dealing with database records directly – instead you can limit access to attributes of business objects – see the “[[docs:2500_config_apps:1400_add_edit_acls|Setting Access to Business Objects]]” section for details. You can also limit access to attributes based on some conditions – see [[docs:3400_how_to:0800_security_and_protection:1040_conditional_access]].
 +</panel>
 +
 +<panel type="primary" title="limit access to operations">
 +Most operations are invoked from forms - see [[docs:3400_how_to:0200_forms_and_user_interface:0210_different_forms]]. You can also limit access to processes and services – see the “[[docs:2500_config_apps:1400_add_edit_acls|Adding/Editing Access Levels]]”.
 +
 +You can also define an “applicability condition” when defining an operation, for example:
 +
 +<code aim>Member.Status = 'Active' </code>
 +
 +The operation will only be shown for those members whose status is Active.
 +</panel>
 +
 +<panel type="primary" title="define access based on some conditions">
 +If you want to limit access to business objects or its attributes based on some conditions you have to specify business rules that use the ''[[a_f:a:protect|PROTECT]]'' action. See the description of the ''[[a_f:a:protect|PROTECT]]'' action in the [[docs:3000_rule_language|Rule Language Reference]] for details.
 +</panel>
 +
 +<panel type="primary" title="get end users to define their own access restrictions">
 +Sometimes it may be necessary for end users (for example, system administrators) to override access restrictions supplied by developers. This could be the case if developers sell their application to many different customers each of them having their own unique access level requirements. 
 +
 +This can be done as part of the “User Defined Processes/Workflows” module. A developer needs to include a menu command of the “Configuration of User Defined Processes type”. This menu command brings up the user defined processes configuration module that allows among other things to define access restrictions to business objects and attributes.
 +</panel>
 +
 +<panel type="primary" title="implement multi-tenancy">
 +It is often required that the same application is hosted for different “tenants”. A tenant logs into the system and only sees data that belongs to him, but not other tenants.
 +
 +There are two approaches in //**AwareIM**// on how this can be implemented:
 +
 +  - Each tenant has a separate business space allocated to the tenant and the same application is loaded into each business space
 +  - All tenants are managed by the same business space and the application itself is defined in such a way that each tenant’s data is protected from another tenant
 +There are pros and cons in both approaches, so the approach you should take depends on your specific requirements.
 +
 +The advantage of the first approach is that each tenant is completely independent from each other because each business space is totally separate from another one. Moreover, you can allocate a separate database to each business space, so that the data of each tenant is stored in its own database. The application is simpler because there is nothing in it that refers to tenants. Data backup can be done on a tenant-by-tenant basis and a data problem in one tenant doesn’t affect another tenants.
 +
 +The disadvantage of the first approach is that if there are thousands of tenants, existence of thousands of business spaces can significantly impact the performance of the server (however, you can add more servers to alleviate the problem). Another disadvantage is that if your applications needs functionality that works across different tenants – for example, if you want to collect statistics about your tenants, look at all registered tenants etc, it may be hard to do if all your tenants are independent applications.
 +
 +Advantages and disadvantages of the second approach are reverse of that of the first one. The second approach may not depend as much on the larger number of tenants as the first approach and it’s also quite easy to provide functionality that looks across different tenants. But the application itself becomes more complicated and it is a lot more difficult to provide backup/restore on a tenant-by-tenant basis (but not impossible). 
 +
 +The following paragraph describes what needs to be done in the application to implement the second approach. This is what you need to do:
 +
 +   - Define an object representing a Tenant 
 +   - For all objects that belong to the tenant add a reference to the Tenant that it belongs to, for example ''Account.Tenant''
 +   - The user object must have a reference to Tenant that it operates on behalf of - ''LoggedInSystemUser.Tenant''
 +   - For each object that belongs to some tenant add rules to initialise tenant from the tenant of the logged in user that created the object, for example:<code aim>IF Account.Tenant IS UNDEFINED THEN 
 + Account.Tenant = LoggedInSystemUser.Tenant </code>
 +  - Finally add protection rules to the object that belong to the tenant so that other tenants do not see it, for example:<code aim>IF Account.Tenant <> LoggedInSystemUser.Tenant THEN
 +   READ PROTECT Account FROM ALL EXCEPT System </code> 
 +</panel>
 +
 +<panel type="primary" title="set up SSL">
 +//**AwareIM**// uses web server such as Tomcat or Weblogic to process web requests. The default web server that comes with //**AwareIM**// is Tomcat. If you want //**AwareIM**// to use SSL protocol for the web requests you can set up the web server to use SSL. Please refer to the documentation of the web server. See also the [[docs:1100_inst_guide|AwareIM Installation Guide]].
 +</panel>
 +
 +</accordion>