042-role-reviewer.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2019 Evolveum and contributors
  ~
  ~ This work is dual-licensed under the Apache License 2.0
  ~ and European Union Public License. See LICENSE file for details.
  -->
<role oid="00000000-0000-0000-0000-00000000000b"
      xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3">
    <name>Reviewer</name>
    <description>Role authorizing users to make decisions on certification cases.</description>
    <assignment>
        <targetRef oid="00000000-0000-0000-0000-000000000320" type="ArchetypeType"/> <!-- System role -->
    </assignment>
    <authorization>
        <name>gui-reviewer-access</name>
        <description>
            Allow access to list of certification cases in GUI. Allow access to pages that show object details,
            so the reviewer may examine data related to the request.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#certificationDecisions</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#userDetails</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#roleDetails</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgUnit</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#service</action>
    </authorization>
    <authorization>
        <name>read-and-make-decisions</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#readOwnCertificationDecisions</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#recordCertificationDecision</action>
    </authorization>
    <authorization>
        <name>users-read</name>
        <description>
            Allow to read basic user properties.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>UserType</type>
        </object>
        <item>name</item>
        <item>givenName</item>
        <item>familyName</item>
        <item>fullName</item>
        <item>employeeType</item>
        <item>employeeNumber</item>
    </authorization>
    <authorization>
        <name>roles-read</name>
        <description>
            Allow to read basic role properties.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>RoleType</type>
        </object>
        <item>name</item>
        <item>displayName</item>
        <item>identifier</item>
        <item>description</item>
        <item>riskLevel</item>
        <item>roleType</item>
    </authorization>
    <authorization>
        <name>orgs-read</name>
        <description>
            Allow to read basic org properties.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>RoleType</type>
        </object>
        <item>name</item>
        <item>displayName</item>
        <item>identifier</item>
        <item>description</item>
        <item>riskLevel</item>
        <item>orgType</item>
    </authorization>
    <authorization>
        <name>services-read</name>
        <description>
            Allow to read basic service properties.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ServiceType</type>
        </object>
        <item>name</item>
        <item>displayName</item>
        <item>identifier</item>
        <item>description</item>
        <item>riskLevel</item>
        <item>serviceType</item>
    </authorization>
</role>