Property scopes
Every property has a scope. The scope defines to which type of entities the property belongs to. The administration of a property also depends on its scope: some property scopes need to be defined as nevisIDM reference data directly in the database; others may be created in the Web GUI. All scopes are described in more detail on the following pages.
onAppGlobal
Definition | Defines a global application attribute. Each application can have a value for this attribute. |
---|---|
Example | Additional application attributes like needs_directory_export or strong_auth_required. |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the database table TIDMA_PROPERTY. |
Scope-ID | 1 |
Usage | Properties with this scope cannot be used by nevisProxy. |
Value administration | Values of this property are displayed in the application administration view of the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. |
The next figure shows an example of a property with scope onAppGlobal. The additional property is listed below the standard properties and, as it is an enumeration type, rendered as a drop-down menu with default value "not set". This property has been added with the following SQL code (note that IDs may have to be adjusted):
INSERT INTO TIDMA_PROPERTY (PROPERTY_ID,NAME,TYPE,SCOPE,ENCRYPTED,PROPAGATED,DESCRIPTION,GUI_PRECEDENCE,STR_MAX_LEN,STR_REGEX,ACCESS_CREATE,ACCESS_MODIFY,APPLICATION_ID,CTL_TCN,CTL_CRE_UID,CTL_CRE_DAT,CTL_MOD_UID,CTL_MOD_DAT) VALUES (100,'Export',1,1,0,0,'Application requires directory export',0,0,null,'rw','rw',null,0,'bootstrap',SYSDATE,'bootstrap',SYSDATE);
INSERT INTO TIDMA_PROPERTY_ALLOWED_VAL (PROPERTY_ALD_VAL_ID,PROPERTY_ID,VALUE,CTL_TCN,CTL_CRE_UID,CTL_CRE_DAT,CTL_MOD_UID,CTL_MOD_DAT) values (100,100,'no',0,'bootstrap',SYSDATE,'bootstrap',SYSDATE);
INSERT INTO TIDMA_PROPERTY_ALLOWED_VAL (PROPERTY_ALD_VAL_ID,PROPERTY_ID,VALUE,CTL_TCN,CTL_CRE_UID,CTL_CRE_DAT,CTL_MOD_UID,CTL_MOD_DAT) values (101,100,'yes',0,'bootstrap',SYSDATE,'bootstrap',SYSDATE);
onUnitGlobal
Definition | Defines a global unit attribute that can be defined separately for each unit. The property can be defined per client by setting the client foreign key or client-independent by setting the client foreign key to NULL. |
---|---|
Example | Alternative unit identification, e.g., alternate_id. |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the table TIDMA_PROPERTY in the database. |
Scope-ID | 2 |
Usage | Properties with this scope cannot be used by nevisProxy. |
Value administration | Values of this property are displayed in the unit administration view of the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. |
INSERT INTO TIDMA_PROPERTY
(PROPERTY_ID,NAME,TYPE,SCOPE,ENCRYPTED,PROPAGATED,DESCRIPTION,GUI_PRECEDENCE,STR_MAX_LEN,STR_REGEX,ACCESS_CREATE,ACCESS_MODIFY,APPLICATION_ID,CTL_TCN,CTL_CRE_UID,CTL_CRE_DAT,CTL_MOD_UID,CTL_MOD_DAT)
VALUES (99999008,'alternate_id',2,2,0,1,'the alternative unit
identification',0,0,null,'rw','rw',null,100,'bootstrap',SYSDATE,'bootstrap',SYSDATE);
onProfileGlobal
Definition | Defines a global profile attribute that can be specified separately for each profile. The property can be defined per client by setting the client foreign key or client-independent by setting the client foreign key to NULL. |
---|---|
Example | Alternative profile identification, e.g., ldap_profile_cn . |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the table TIDMA_PROPERTY in the database. |
Scope-ID | 3 |
Usage | Can be used in nevisProxy via ch.nevis.idm.prof.<property_name> . |
Value administration | Values of this property are displayed in the profile administration view in the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. |
The figure below shows an example of a property with scope onProfileGlobal. The additional property is listed below the standard properties and, as it is a string, rendered as a text field. This property has been added with the following SQL code (note that IDs may have to be adjusted):
INSERT INTO TIDMA_PROPERTY (PROPERTY_ID,NAME,TYPE,SCOPE,ENCRYPTED,PROPAGATED,DESCRIPTION,GUI_PRECEDENCE,STR_MAX_LEN,STR_REGEX,ACCESS_CREATE,ACCESS_MODIFY,APPLICATION_ID,CTL_TCN,CTL_CRE_UID,CTL_CRE_DAT,CTL_MOD_UID,CTL_MOD_DAT) VALUES (120,'ldap_profile_cn',2,3,0,0,'LDAP Profile Common Name',0,80,'','rw','rw',null,0,'bootstrap',SYSDATE,'bootstrap',SYSDATE);
onProfileForAppGlobal
Definition | Defines a global attribute to which you can assign a different value for each combination of profile, application and role (that is, for each authorization). For example, it is possible to assign two different roles of the same application to the same profile. For each of these roles, the properties of the scope OnProfileForAppGlobal can have a different value. Global means that the same custom extension applies to all applications. |
---|---|
Example | A global property appl_uid or appl_usercred , which is applicable to every available application. If you assign two or more different roles of the same application to the same profile, each role can have a different value for the global property appl_uid or appl_usercred . |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in table TIDMA_PROPERTY in the database. |
Scope-ID | 4 |
Usage | Can be used in nevisProxy via ch.nevis.idm.prof.<application_name>.<property_name> . |
Value administration | Values are displayed in the Manage role and property view of the nevisIDM GUI. Refer to chapter 3.4.1.4.1 appl_userid for an example. |
There are two default properties in the nevisIDM reference data with scope onProfileForAppGlobal
. These two properties support the delegation of application-specific user IDs and credentials. They are described in the next chapters: appl_userid
and appl_usercred
.
appl_userid
This property is externalized by nevisAuth to ch.nevis.idm.prof.application.appl_userid
, which is used for back-end login (nevisProxy -> application). It is contained in the default reference data and has been added with the following SQL code (note that IDs may have to be adjusted):
INSERT INTO TIDMA_PROPERTY (PROPERTY_ID,NAME,TYPE,SCOPE,ENCRYPTED,PROPAGATED,DESCRIPTION,GUI_PRECEDENCE,STR_MAX_LEN,STR_REGEX,ACCESS_CREATE,ACCESS_MODIFY,APPLICATION_ID,CTL_TCN,CTL_CRE_UID,CTL_CRE_DAT,CTL_MOD_UID,CTL_MOD_DAT) VALUES (1,'appl_userid',2,4,0,1,'application account user ID',0,0,null,'rw','rw',null,0,'bootstrap',SYSDATE,'bootstrap',SYSDATE);
To administer the property values, go to the profile administration, select an existing role and click on the pencil icon at the end of the line. A view similar to the figure below appears in which you can administer properties with this scope for this profile and application.
Note that you can only administrate this property if the profile has at least one assigned role of this application.
appl_usercred
This property is externalized by nevisAuth to ch.nevis.idm.prof.application.appl_usercred
, which is used for back-end login (nevisProxy -> application). It can be administrated as shown in the figure above.
onProfileForApp
Properties with this scope define a value for a profile on a specific application (contrary to the properties with scope onProfileForAppGlobal
, which apply to all applications). To be able to assign or administrate properties of this scope, a profile must at least have one role of the particular application.
Definition | Defines an attribute within an application that you can specify separately for each individual combination of application/role/profile. This scope is used for application-specific extensions of profiles. |
---|---|
Example | One particular application requires an additional parameter, for example, nevisUserId . Each role of this application includes the parameter nevisUserId . Furthermore, it is possible to assign different roles of this application to one profile, in which case each role can have a different value for the parameter nevisUserId . |
Property administration | Properties of this type can be created and administrated in nevisIDM as described below. |
Scope-ID | 5 |
Usage | Can be used in nevisProxy via ch.nevis.idm.prof.<application_name>.<property_name> . |
Value administration | Values of these properties can also be administrated in nevisIDM as described below. |
For example, to add a property pb_default_country
to the sample application phonebook, click Search and modify application and search for the respective application. A view similar to the figure below appears. Click on the New button in the Properties panel.
A view similar to the figure below enables you to specify the new property. Make sure to select the onProfileForApp
scope in the Scope
field.
After clicking Save, you can define a list of values as shown in the figure below.
To assign a value to the property for a specific profile/role/application, select the relevant application role assigned to the respective profile and click on the pencil icon next to the role (see the figure below).
A view similar to the next figure is now displayed. This view allows you to set the pb_default_country
property by selecting one of the predefined enumerated values. Thus, you assign the property to the TheoTest profile for the phonebook application /phonebookadmin
role.
onRoleForApp
Definition | Defines a role attribute for roles of a specific application. Each role of the specified application can have a different value for this property. |
---|---|
Example | One particular application requires an additional attribute, e.g., nevis-UserId. |
Property administration | Properties with this scope can be created and administrated via application roles in the nevisIDM GUI. |
Scope-ID | 6 |
Usage | Can be used in nevisProxy via the SecurityRoleFilter, for example with the filter parameter RolesRequired. |
Value administration | Property values can be created and administrated via the views application roles > property in the nevisIDM GUI. |
The sample application phonebook in the figure below has two roles, phonebookadmin and phonebookuser, and three properties with the onRoleForApp
scope: view_entries
, modify_entries
and delete_entries
:
A role is an application-specific entity that typically summarizes a set of properties with specified values. The phonebookuser role, for example, defines user access rights for the sample application phonebook. The phonebookuser role only allows viewing phonebook entries, not modifying or deleting them. You specify the property values for a specific role in the Manage roles view (see the figure below).
onUserGlobal
Definition | Defines a global user attribute that can be assigned a different value for each user. The property can be defined per client by setting the client foreign key or client-independent by setting the client foreign key to NULL. |
---|---|
Example | An alternative user identification, e.g., ldap_user_dn . |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the table TIDMA_PROPERTY in the database. |
Scope-ID | 7 |
Value administration | Values of this property are displayed in the user administration view of the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. |
Property scope onUserGlobal
INSERT INTO TIDMA_PROPERTY (PROPERTY_ID,NAME,TYPE,SCOPE,ENCRYPTED,PROPAGATED,DESCRIPTION,GUI_PRECEDENCE,STR_MAX_LEN,STR_REGEX,ACCESS_CREATE,ACCESS_MODIFY,APPLICATION_ID,CTL_TCN,CTL_CRE_UID,CTL_CRE_DAT,CTL_MOD_UID,CTL_MOD_DAT) VALUES (121,'custom_user_tech_id',2,7,0,0,'Custom UserTechId',0,80,'','rw','rw',null,0,'bootstrap',SYSDATE,'bootstrap',SYSDATE);
onEnterpriseRoleGlobal
Definition | Defines a global enterprise role attribute that can be assigned a different value for each enterprise role. The property can be defined per client by setting the client foreign key, or client-independent by setting the client foreign key to NULL. |
---|---|
Example | An additional attribute of the enterprise roles, e.g., "purpose". |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the table TIDMA_PROPERTY in the database. |
Scope-ID | 8 |
Value administration | Values of this property are displayed on the enterprise role administration view of the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. |
onCredentialCertificateGlobal
Definition | Defines a global certificate attribute that can be assigned a different value separately for each certificate credential. The property can be defined per client by setting the client foreign key, or client-independent by setting the client foreign key to NULL. |
---|---|
Example | A required information in the certificate, e.g., SuisseID. |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the table TIDMA_PROPERTY in the database. |
Scope-ID | 20 |
Value administration | Values of this property are displayed in the credential administration view for certificates of the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. |
onCredentialGenericGlobal
Definition | Defines a global generic credential attribute to which you can assign a different value separately for each generic credential. The property can be defined per client by setting the client foreign key, or client independently by setting the client foreign key to NULL . |
---|---|
Example | A required information in the generic credential, e.g., MobileID |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the table TIDMA_PROPERTY in the database. |
Scope-ID | 21 |
Value administration | Values of this property are displayed in the credential administration view for certificates of the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. Web services: createCredential, updateCredential handles genenric credential properties. queryUsers can find users which hold specified values of a specified generic credential property. The credential type "GENERIC" should be set. Otherwise, the search falls back to certificate properties. |
onMobileSignatureGlobal
Definition | Defines a global mobile signature credential attribute to which you can assign a different value separately for each mobile signature credential. The property can be defined per client by setting the client foreign key, or client independently by setting the client foreign key to NULL. |
---|---|
Example | No example available yet. |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the table TIDMA_PROPERTY in the database. |
Scope-ID | 22 |
Value administration | Values of this property are displayed in the credential administration view for mobile signatures of the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. Web services: createCredential and updateCredential handle mobile signature credential properties. queryUsers can find users which hold specified values of a specified mobile signature credential property. |
onSamlFederationGlobal
Definition | Defines a global SAML federation credential attribute to which you can assign a different value separately for each SAML federation credential instance. The property can be defined per client by setting the client foreign key or client independently by setting the client foreign key to NULL. |
---|---|
Example | No example available yet. |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the table TIDMA_PROPERTY in the database. |
Scope-ID | 23 |
Value administration | Values of this property are displayed in the credential administration view for SAML federations of the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. Web services: createCredential and updateCredential handle SAML federation credential properties. queryUsers can find users which hold specified values of a specified SAML federation credential property. |
onSecurityQuestionsGlobal
Definition | Defines a global security question credential attribute to which you can assign a different value separately for each security question credential instance. The property can be defined per client by setting the client foreign key or client independently by setting the client foreign key to NULL. |
---|---|
Example | No example available yet. |
Property administration | Properties of this scope are defined as reference data and cannot be changed in the nevisIDM GUI, but need to be defined directly in the table TIDMA_PROPERTY in the database. |
Scope-ID | 24 |
Value administration | Values of this property are displayed in the credential administration view for security questions of the nevisIDM GUI. If the property is defined as read-write, the value can also be edited. Web services: createCredential and updateCredential handle security question credential properties. queryUsers can find users which hold specified values of a specified security question credential property. |