Permission business rules

Table of Content

• Introduction
• List of available permissions
  • Basic permissions
  • Combined permissions
• List of available SDMX artefact types
• Visibility of permission rules

Introduction

Currently, the Data Lifecycle Manager does not include yet user-interface features to manage user access rights to the content of the .Stat Suite data spaces. Therefore, user permissions still need to be entered, updated or deleted using the AuthorisationManagement web service. The following pieces of information give more information on the usage and parameters of this API.

Please see here a Demo version of the AuthorisationManagement web service: http://authz-demo.siscc.org/swagger/index.html User permissions managed in the user interface of the DLM are using the Authorisation Management web service. The following pieces of information provide more details on the permission definitions, and the usage of the API. You can also see a Demo version of the Authorisation Management web service: http://authz-demo.siscc.org/swagger/index.html

Access permissions can be defined individually for the following contexts:

• per user (e-mail, e.g. user@domain.org), group of users (Project_Team) or any user (*)
• per data space (e.g. Dissemination) or for all spaces managed within an instance (*)
• per SDMX artefact type (e.g. Dsd, Dataflow) or any type (0)
• per SDMX artefact maintenance agency (e.g. SDMX, MY_ORG) or any agency (*)
• per SDMX artefact ID (e.g. DATAFLOW_ID) or any ID (*)
• per SDMX artefact version (e.g. 1.0) or any version (*)
• permission type (e.g. 3)

For the list of available Permission types and SDMX artefact types, pleasse see below. For the list of available Permission types and SDMX artefact types, please see below.

In order to be able to use the AuthorisationManagement web service, the user needs to be authenticated and to provide a valid access token. In order to be able to use the AuthorisationManagement web service, the user needs to be authenticated and to provide a valid access token.

List of available permissions

Basic permissions

The basic permissions listed below are permissions associated to a single and specific action.

*Permission id:64 is implemented (as provided by the Eurostat’s source code) but not yet used in the .Stat Suite context.

Note that since release .NET 6.0.0, permission id:0 is no longer supported in .Stat Suite.

Combined permissions

Combined permissions are the combination of several basic permissions.
A combination of permissions must be a combination of basic permissions as described in the table above, obtained by addition. For example, adding together CanReadStructuralMetadata [1] and CanReadData [2] to get 3, will create a combined permission that has the ability to read both structural metadata and data.
Below is a table of the most used combinations, but others are acceptable.

List of available SDMX artefact types

Visibility of permission rules

Using the AuthorizationRules method of the AuthorisationManagement web service:

• A non-admin user (or member of a non-admin group) can only see all those permissions that grant this user with a permission.
• An admin user (or member of an admin group) - with admin permission id:4095 - can see all permissions defined on those spaces on which that user has admin rights.

When a user is individually granted with a specific permission, and this user also belongs to a group which has its own permissions, then the user permissions are cumulative with its individual permissions and the group permissions he belongs to.
User permissions are also cumulative with the generic user permission ("*") if any.

It is important to check that the NSI web service configuration parameters (Authentication, Allow anonymous, Authorisation) correspond to one of the following tryptics, knowing that if they match with one of the bold tryptics, then the specific authorisations won’t be taken into consideration.

Example:

Consider the following fictive users:

Considering the following fictive authorization rules (one per line), the visibility of these rules to each user would be as follow: