source: main/waeup.kofa/trunk/docs/source/userdocs/security.rst @ 15730

Last change on this file since 15730 was 15277, checked in by Henrik Bettermann, 6 years ago

Add AccommodationPaymentsExporter which can be used by accommodation officers.

File size: 9.5 KB
Line 
1.. _security_policy:
2
3Security
4********
5
6.. seealso::
7
8   :ref:`Security Doctests <security_txt>`
9
10Kofa has a very efficient security machinery. The machinery does not
11perform authorization checks on the content objects themselves stored
12in the database, but, restricts the usage of views, i.e. web pages and
13forms which are needed to view or edit data. Views are protected by
14permissions the user must have to use the view. Instead of assigning
15permissions seperately to users, permissions are bundled into sets of
16permissions, so-called roles which can be assigned to users through
17the web interface.
18
19It is important to note that permissions do not include other
20permissions. Only roles 'include' permissions. A 'manage' permission,
21for example, does not automatically enable users to open pages which
22merely display the data. These pages have their own 'view'
23permission. Another example is the ManagePortal permission described
24below. The name of the permission may lead to believe that users can
25do everything with this permissions. This is not true. It does only
26give access to certain pages which are dedicated to portal managers
27and must not be accessed by any other user.
28
29.. contents:: Table of Contents
30   :local:
31
32Permissions
33===========
34
35The whole set of permission and role classes are described in the
36:py:mod:`Permissions and Roles Module<waeup.kofa.permissions>`. Here
37we describe only a subset of permission classes which are essential
38for the security settings configuration.
39
40General Permissions
41-------------------
42
43.. autoclass:: waeup.kofa.permissions.Public()
44   :noindex:
45
46.. autoclass:: waeup.kofa.permissions.Anonymous()
47   :noindex:
48
49.. autoclass:: waeup.kofa.permissions.Authenticated()
50   :noindex:
51
52.. autoclass:: waeup.kofa.permissions.ManageUsers()
53   :noindex:
54
55.. autoclass:: waeup.kofa.permissions.EditUser()
56   :noindex:
57
58.. autoclass:: waeup.kofa.permissions.ManagePortal()
59   :noindex:
60
61.. autoclass:: waeup.kofa.permissions.ViewAcademics()
62   :noindex:
63
64.. autoclass:: waeup.kofa.permissions.ManageAcademics()
65   :noindex:
66
67.. autoclass:: waeup.kofa.permissions.ManagePortalConfiguration()
68   :noindex:
69
70.. autoclass:: waeup.kofa.permissions.ManageDataCenter()
71   :noindex:
72
73.. autoclass:: waeup.kofa.permissions.ExportData()
74   :noindex:
75
76.. autoclass:: waeup.kofa.permissions.ImportData()
77   :noindex:
78
79.. autoclass:: waeup.kofa.permissions.TriggerTransition()
80   :noindex:
81
82.. autoclass:: waeup.kofa.permissions.ShowStudents()
83   :noindex:
84
85.. autoclass:: waeup.kofa.permissions.ExportPaymentsOverview()
86   :noindex:
87
88.. autoclass:: waeup.kofa.permissions.ExportBursaryData()
89   :noindex:
90
91.. autoclass:: waeup.kofa.reports.HandleReports()
92   :noindex:
93
94.. autoclass:: waeup.kofa.reports.ManageReports()
95   :noindex:
96
97Accommodation Section Permissions
98---------------------------------
99
100.. autoclass:: waeup.kofa.hostels.permissions.ViewHostels()
101   :noindex:
102
103.. autoclass:: waeup.kofa.hostels.permissions.ManageHostels()
104   :noindex:
105
106.. autoclass:: waeup.kofa.hostels.permissions.ExportAccommodationData()
107   :noindex:
108
109Applicants Section Permissions
110------------------------------
111
112.. autoclass:: waeup.kofa.applicants.permissions.ViewApplication()
113   :noindex:
114
115.. autoclass:: waeup.kofa.applicants.permissions.HandleApplication()
116   :noindex:
117
118.. autoclass:: waeup.kofa.applicants.permissions.ManageApplication()
119   :noindex:
120
121.. autoclass:: waeup.kofa.applicants.permissions.PayApplicant()
122   :noindex:
123
124.. autoclass:: waeup.kofa.applicants.permissions.ViewApplicationStatistics()
125   :noindex:
126
127.. autoclass:: waeup.kofa.applicants.permissions.CreateStudents()
128   :noindex:
129
130Students Section Permissions
131----------------------------
132
133.. autoclass:: waeup.kofa.students.permissions.ViewStudent()
134   :noindex:
135
136.. autoclass:: waeup.kofa.students.permissions.HandleStudent()
137   :noindex:
138
139.. autoclass:: waeup.kofa.students.permissions.ViewStudentsContainer()
140   :noindex:
141
142.. autoclass:: waeup.kofa.students.permissions.ManageStudent()
143   :noindex:
144
145.. autoclass:: waeup.kofa.students.permissions.PayStudent()
146   :noindex:
147
148.. autoclass:: waeup.kofa.students.permissions.HandleAccommodation()
149   :noindex:
150
151.. autoclass:: waeup.kofa.students.permissions.UploadStudentFile()
152   :noindex:
153
154.. autoclass:: waeup.kofa.students.permissions.LoginAsStudent()
155   :noindex:
156
157.. autoclass:: waeup.kofa.students.permissions.EditStudyLevel()
158   :noindex:
159
160.. autoclass:: waeup.kofa.students.permissions.ClearStudent()
161   :noindex:
162
163.. autoclass:: waeup.kofa.students.permissions.ValidateStudent()
164   :noindex:
165
166Global Roles
167============
168
169Global or site roles are assigned portal-wide. In contrast to local
170roles, users have this role in every context.
171
172Many global roles do only bundle one or two permissions. The objective
173behind is to share responsibilities and distribute tasks.
174
175Global roles are being assigned via the user manage form page.
176
177Global General Roles
178--------------------
179
180.. autoclass:: waeup.kofa.permissions.AcademicsOfficer()
181   :noindex:
182
183.. autoclass:: waeup.kofa.permissions.AcademicsManager()
184   :noindex:
185
186.. autoclass:: waeup.kofa.permissions.DataCenterManager()
187   :noindex:
188
189.. autoclass:: waeup.kofa.permissions.ImportManager()
190   :noindex:
191
192.. autoclass:: waeup.kofa.permissions.ExportManager()
193   :noindex:
194
195.. autoclass:: waeup.kofa.permissions.ACManager()
196   :noindex:
197
198.. autoclass:: waeup.kofa.permissions.UsersManager()
199   :noindex:
200
201.. autoclass:: waeup.kofa.permissions.WorkflowManager()
202   :noindex:
203
204.. autoclass:: waeup.kofa.permissions.BursaryOfficer()
205   :noindex:
206
207.. autoclass:: waeup.kofa.reports.ReportsOfficer()
208   :noindex:
209
210.. autoclass:: waeup.kofa.reports.ReportsManager()
211   :noindex:
212
213In contrast to these specialized sets of permissions, there are two
214sets which delegate extensive powers on portal managers.
215
216.. autoclass:: waeup.kofa.permissions.PortalManager()
217   :noindex:
218
219.. autoclass:: waeup.kofa.permissions.CCOfficer()
220   :noindex:
221
222Global Accommodation Section Roles
223----------------------------------
224
225.. autoclass:: waeup.kofa.hostels.permissions.AccommodationOfficer()
226   :noindex:
227
228Global Applicants Section Roles
229-------------------------------
230
231Global Applicants Section Roles are assigned portal-wide (globally)
232but do actually only allocate permissions in the applicants section.
233
234.. autoclass:: waeup.kofa.applicants.permissions.ApplicantRole()
235   :noindex:
236
237.. autoclass:: waeup.kofa.applicants.permissions.ApplicationsOfficer()
238   :noindex:
239
240.. autoclass:: waeup.kofa.applicants.permissions.ApplicationsManager()
241   :noindex:
242
243.. autoclass:: waeup.kofa.applicants.permissions.StudentsCreator()
244   :noindex:
245
246Global Students Section Roles
247-----------------------------
248
249Global Students Section Roles are assigned portal-wide (globally) but
250do actually only allocate permissions in the students section.
251
252.. autoclass:: waeup.kofa.students.permissions.StudentRole()
253   :noindex:
254
255.. autoclass:: waeup.kofa.students.permissions.StudentsOfficer()
256   :noindex:
257
258.. autoclass:: waeup.kofa.students.permissions.StudentsManager()
259   :noindex:
260
261.. autoclass:: waeup.kofa.students.permissions.StudentsClearanceOfficer()
262   :noindex:
263
264.. autoclass:: waeup.kofa.students.permissions.StudentsCourseAdviser()
265   :noindex:
266
267.. autoclass:: waeup.kofa.students.permissions.StudentImpersonator()
268   :noindex:
269
270.. autoclass:: waeup.kofa.students.permissions.TranscriptOfficer()
271   :noindex:
272
273.. autoclass:: waeup.kofa.students.permissions.TranscriptSignee()
274   :noindex:
275
276.. _local_roles:
277
278Local Roles and Dynamic Role Assignment
279=======================================
280
281In contrast to global roles, which are assigned portal-wide, local
282role permissions are gained for a specific context.
283
284Some local roles serve a second purpose. At first glance it appears
285strange that some of these 'odd' roles do not give more permissions
286than the user already has due to other roles. Their real purpose is to
287delegate permissions to the students or applicants section. If a user
288has for example the LocalStudentsManager role described below at
289department level, s/he automatically gets the StudentsManager role for
290those students studying in this department. We call this a **dynamic
291role**. In contrast to static global or local roles, dynamic roles are
292not stored in the database, they are dynamically assigned.
293
294Local roles are assigned either automatically by the system during
295user object setup or manually through the web interface. The
296automatically assigned local roles are:
297
298.. autoclass:: waeup.kofa.permissions.Owner()
299   :noindex:
300
301.. autoclass:: waeup.kofa.applicants.permissions.ApplicationOwner()
302   :noindex:
303
304.. autoclass:: waeup.kofa.students.permissions.StudentRecordOwner()
305   :noindex:
306
307All other local roles must be assigned manually via context manage form pages.
308
309.. autoclass:: waeup.kofa.permissions.ApplicationsManager()
310   :noindex:
311
312.. autoclass:: waeup.kofa.permissions.DepartmentOfficer()
313   :noindex:
314
315.. autoclass:: waeup.kofa.permissions.DepartmentManager()
316   :noindex:
317
318.. autoclass:: waeup.kofa.permissions.Lecturer()
319   :noindex:
320
321The following local roles do also delegate permissions to the student
322section. In other words, dynamic roles are assigned.
323
324.. autoclass:: waeup.kofa.permissions.ClearanceOfficer()
325   :noindex:
326
327.. autoclass:: waeup.kofa.permissions.LocalStudentsManager()
328   :noindex:
329
330.. autoclass:: waeup.kofa.permissions.LocalWorkflowManager()
331   :noindex:
332
333.. autoclass:: waeup.kofa.permissions.UGClearanceOfficer()
334   :noindex:
335
336.. autoclass:: waeup.kofa.permissions.PGClearanceOfficer()
337   :noindex:
338
339.. autoclass:: waeup.kofa.permissions.CourseAdviser100()
340   :noindex:
341
342.. autoclass:: waeup.kofa.permissions.LocalTranscriptOfficer()
343   :noindex:
344
345.. autoclass:: waeup.kofa.permissions.LocalTranscriptSignee()
346   :noindex:
Note: See TracBrowser for help on using the repository browser.