Question
Areteans
NZ
Last activity: 17 Jul 2021 3:35 EDT
Security - Privileges granted to a class
Hello,
I have an access role created for my application like Booking:SysAdm4 which has dependent role as PegaRULES:SysAdm4 and Booking:SysAdm4 doesnt have Inherit privileges checked.
I have created an ARO on application work class for Booking:SysAdm4 without any privileges added.
However I see that application work class has been granted all the privileges defined on Work- class in PegaRULES:SysAdm4.
Can you help me understand how privileges are granted to a class and what difference does Inherit privileges checked makes.
Any suggestions are appreciated.
Pegasystems Inc.
NL
Pega applies the privilege of the most specific class in a role. When the privilege is not defined on that class, the security check will refer to the dependent roles in the order listed.
With the 'inherit privileges within class hierarchy' turned on however, before referring to the dependent role, privileges are sought on any more generic classes within the same role. In case there's a match any dependent roles will not be used.
In your situation you have turned the hierarchy check on, but there's no class in the hierarchy of your current implementation role that has the privilege defined, thus the privilege is granted by the dependent PegaRULES:SysAdm4 role. Assuming you haven't changed that standard role this means you get all the privileges it has defined on the Work class like Perform and WorkUpdate.
Hope this helps.
Areteans
NZ
@Eric RietveldThanks for the response. In my situation hierarchy check is not turned on but still all the privileges defined on Work class in dependent role are granted.
As per your comments privileges can be inherited from dependent roles based on class hierarchy even when hierarchy check is not turned on. However when hierarchy check is turned on privileges are checked in current role before checking the dependent role.
Please advise if my understanding is correct.
Pegasystems Inc.
NL
@SatishKumarL5551, yes, the role dependency works independent of the hierarchy checkbox. When needed you can override privileges granted by depend roles by redefining them in the most specific class in your implementation role.
So for example you can set a BK-Work-Complain ARO with WorkUpdate privilege to 0 to prevent it from being granted that privilege from the Work- ARO in SysAdm4.
As a side remark: I do not recommend trying to make a secure version of the SysAdm4 role, so I hope it's just an example. For securing end user roles also consider using UserRestricted as described in https://community.pega.com/knowledgebase/articles/security/pega-security-advisory-c20-hotfix
Areteans
NZ
@Eric Rietveld Thanks for the details. Those helped in answering my queries.