Changeset 12847 for main/waeup.kofa/trunk/docs/source/userdocs

Timestamp:

3 Apr 2015, 17:45:48 (10 years ago)

Author:

Henrik Bettermann

Message:

Update security documentation.

File:

• main/waeup.kofa/trunk/docs/source/userdocs/security.rst (modified) (5 diffs)

main/waeup.kofa/trunk/docs/source/userdocs/security.rst

@@ -13 +13 @@
 ===========
 
-The whole set of permissions and roles are described in the :py:mod:`Permissions and Roles Module<waeup.kofa.permissions>`. Here we describe only a subset of permission classes which are essential for the security settings configuration.
+The whole set of permission and role classes are described in the :py:mod:`Permissions and Roles Module<waeup.kofa.permissions>`. Here we describe only a subset of permission classes which are essential for the security settings configuration.
 
 General Permissions
@@ -130 +130 @@
 Many global roles do only bundle one or two permissions. The objective behind is to share responsibilities and distribute tasks.
 
+Global roles are being assigned via the user manage form page.
+
 Global General Roles
 --------------------
@@ -171 +173 @@
 --------------------------------
 
+Global Application Section Roles are assigned portal-wide (globally) but do actually only allocate permissions in the Application Section.
+
 .. autoclass:: waeup.kofa.applicants.permissions.ApplicantRole()
    :noindex:
@@ -183 +187 @@
 ----------------------------
 
+Global Student Section Roles are assigned portal-wide (globally) but do actually only allocate permissions in the Student Section.
+
 .. autoclass:: waeup.kofa.students.permissions.StudentRole()
    :noindex:
@@ -201 +207 @@
    :noindex:
 
-Local Roles
-===========
-
-Dynamic Roles
-=============
+Local Roles and Dynamic Role Assignment
+=======================================
+
+In contrast to global roles, which are assigned portal-wide, local role permissions are gained for a specific context.
+
+Some local roles serve a second purpose. At first glance it appears strange that some of these 'odd' roles do not give more permissions than the user already has due to other roles. Their real purpose is to delegate permissions to the students or application section. If a user has for example the LocalStudentsManager role described below at department level, s/he automatically gets the StudentsManager role for those students studying in this department. We call this a **dynamic role**. In contrast to static global or local roles, dynamic roles are not stored in the database, they are dynamically assigned.
+
+Local roles are assigned either automatically by the system during user object setup or manually through the web interface. The automatically assigned local roles are:
+
+.. autoclass:: waeup.kofa.permissions.Owner()
+   :noindex:
+
+.. autoclass:: waeup.kofa.applicants.permissions.ApplicationOwner()
+   :noindex:
+
+.. autoclass:: waeup.kofa.students.permissions.StudentRecordOwner()
+   :noindex:
+
+All other local roles must be assigned manually via context manage form pages.
+
+.. autoclass:: waeup.kofa.permissions.ApplicationManager()
+   :noindex:
+
+.. autoclass:: waeup.kofa.permissions.DepartmentOfficer()
+   :noindex:
+
+.. autoclass:: waeup.kofa.permissions.DepartmentManager()
+   :noindex:
+
+.. autoclass:: waeup.kofa.permissions.Lecturer()
+   :noindex:
+
+The following local roles do also delegate permissions to the student section. In other words, dynamic roles are assigned.
+
+.. autoclass:: waeup.kofa.permissions.ClearanceOfficer()
+   :noindex:
+
+.. autoclass:: waeup.kofa.permissions.LocalStudentsManager()
+   :noindex:
+
+.. autoclass:: waeup.kofa.permissions.LocalWorkflowManager()
+   :noindex:
+
+.. autoclass:: waeup.kofa.permissions.UGClearanceOfficer()
+   :noindex:
+
+.. autoclass:: waeup.kofa.permissions.PGClearanceOfficer()
+   :noindex:
+
+.. autoclass:: waeup.kofa.permissions.CourseAdviser100()
+   :noindex: