Question
ING Bank
NL
Last activity: 21 Sep 2020 9:19 EDT
setActiveAccessGroup method when AG is not added to operator profile
Dear Community,
I have a requirement to switch AGs at run-time even if its not added to the operator profile via an activity. I realize that this can be done by using setActiveAccessGroup method (and passing an additional parameter as 'true'), however, this doesnt seem to be working.
It appears that I have to add the AG to the operator record, save it in the Db, and then use the above method to switch. The additional 'true' parameter doesn't seem to be doing anything (in v8.2.3 at least) which is strange. I do not want to update and save the operator record everytime we need to switch.
Does someone already know how the additional save can be avoided?
Thanks in advance!
Proximus
BE
Hello,
your AG is the security part allowing your users to do/access something and to avoid an unauthorized access.
I don't understand the use case of allowing to switch to an AG that the operator has not previously received.
You shouldn't be hidingly allowed to use an AG not linked to your operator.
This would mean that any security restriction can be by-passed during processing time.
That a read-only operator can secretly be acting as an admin.
When we change the AG of an operator during processing, we first save the operator record.
We can then audit the operators changes.
Our operators having several AG can switch to any of them since it's linked to their operator records.
I would be surprised you can do this without saving the operator record and it would be a major security issue :)
Regards
Anthony