MaskingMapping
Class IBMTSDS_Privilege


CIM_ManagedElement
\_CIM_Privilege
  \_CIM_AuthorizedPrivilege


Description

Privilege is the base class for all types of activities which are granted or denied by a Role or an Identity. Whether an individual Privilege is granted or denied is defined using the PrivilegeGranted boolean. Any Privileges not specifically granted are assumed to be denied. An explicit deny (Privilege Granted = FALSE) takes precedence over any granted Privileges.The association of subjects (Roles and Identities) to Privileges is accomplished using policy or explicitly via the associations on a subclass. The entities that are protected (targets) can be similarly defined.Note that Privileges may be inherited through hierarchical Roles, or may overlap. For example, a Privilege denying any instance Writes in a particular CIM Server Namespace would overlap with a Privilege defining specific access rights at an instance level within that Namespace. In this example, the AuthorizedSubjects are either Identities or Roles, and the AuthorizedTargets are a Namespace in the former case, and a particular instance in the latter.

Subclasses


Referenced By

IBMTSDS_AuthorizedSubject IBMTSDS_AuthorizedTarget IBMTSDS_ConcreteDependencyPrivilege

Properties

IdTypeRangeDescription
Key
InstanceID string
Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. In order to ensure uniqueness within the NameSpace, the value of InstanceID SHOULD be constructed using the following'preferred'algorithm:<OrgID>:<LocalID>Where<OrgID>and<LocalID>are separated by a colon':', and where<OrgID>MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the<Schema Name>_<Class Name>structure of Schema class names.) In addition, to ensure uniqueness<OrgID>MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in InstanceID MUST appear between<OrgID>and<LocalID>.<LocalID>is chosen by the business entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above'preferred'algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance's NameSpace. For DMTF defined instances, the'preferred'algorithm MUST be used with the<OrgID>set to'CIM'.The format for InstanceID is IBMTSDS:<SystemName>-<WWPN>-<ID
Read Only
Activities uint16
Other1
Create2
Delete3
Detect4
Read5
Write6
Execute7
DMTF Reserved..15999
Vendor Reserved16000..
An enumeration indicating the activities that are granted or denied. This value indicates that the existence or presence of an entity may be determined, but not necessarily specific data (which requires the Read privilege to be true). This activity is exemplified by'hidden files'- if you list the contents of a directory, you will not see hidden files. However, if you know a specific file name, or know how to expose hidden files, then they can be'detected'. Another example is the ability to define search privileges in directory implementations.
PrivilegeGranted boolean
Boolean indicating whether the Privilege is granted (TRUE) or denied (FALSE). The default is to grant permission.
Read Write
 
Inherited from class CIM_ManagedElement
Caption, Description, ElementName
 
Inherited from class CIM_Privilege
Activities, ActivityQualifiers, PrivilegeGranted, QualifierFormats, RepresentsAuthorizationRights
 

Method Summary

NameDescription
 

Method Detail