U3.3 Administration

U3.3 Administration

1. Creating, deleting, changing access rights for subjects and to objects

   • Time consuming, complicated, error prone
     • Can be simplified by aggregation of subjects and or objects

2. Groups

   • Creates an intermediate layer between the subjects and objects
     • Simplifies admin by grouping subjects
   • Subjects may belong to more than 1 group
   • Objects may be accessible by more than 1 group
   • Permissions for individuals within a group can still be altered without changing the group permissions

3. Roles

   • Permission to objects is assigned to the role that is created
     • Subjects are then assigned a role
       • administrator role will allow you to perform most functions
         • Clerk role will have limited functions
           • Also a form of segregation of duties

4. Groups Vs Roles

   • group is a collection of users and is really a vehicle to simplify the administration of user's access rights.
   • role is a collection of access rights (or permissions) and hence pertains to what users are permitted to do. The concept of a role fits very well into a hierarchical organisation.

Images and files in the map