Single Sign-On for Java 3.3.2 - Administration Guide

Policy XML Descriptor Elements

This section describes the following policy XML descriptor elements:

• role
• include
• exclude
• user
• security-constraint
• web-resource-collection
• auth-constraint

role

The role element defines a security role that may be associated with a set of resources. Membership of the role can include Active Directory groups or principals, or other roles.

If the idm.access.groupsAsRoles option is enabled, role definitions can be used to avoid name clashes with existing Active Directory groups.

Examples

1. Allow the user Alice, and nobody else:

   <role name="TechniciansGroupA">

   <include>

   <user name="Alice"/>

   </include>

   </role>

2. Allow the users Bob and Carol in the ACME domain, and nobody else:

   <role name="TechniciansGroupB">

   <include>

   <user name="Bob@ACME"/>

   <user name="Carol@ACME"/>

   </include>

   </role>

3. Allow all users at the ACME domain and all users at the APEX domain:

   For this example, we use the well-known Active Directory group “Domain Users” to represent all users in a domain.

   <role name="TechniciansAndUnqualified">

   <include>

   <group name="Domain Users@ACME"/>

   <group name="Domain Users@APEX"/>

   </include>

   </role>

4. Allow all users in the ACME domain, except for Alice:

   <role name="AlmostAllTechnicians">

   <include>

   <group name="Domain Users@ACME"/>

   </include>

   <exclude>

   <user name="Alice@ACME"/>

   </exclude>

   </role>

   Note: It is a property of Active Directory that all users belong to the Domain Users group.

5. Allow Dave and Alice in the APEX domain, and Carol in the ACME domain:

   <role name="Unqualified">

   <include>

   <user name="Alice@APEX"/>

   <user name="Dave@APEX"/>

   <user name="Carol"/>

   </include>

   </role>

   Note: The default domain of the role above is ACME.

6. Allow all technicians, except those who may be unqualified:

   <role name="QualifiedTechnicians">

   <include>

   <role name="AllTechnicians"/>

   </include>

   <exclude>

   <role name="Unqualified"/>

   </exclude>

   </role>

include

List of groups, users or roles that are members of a given role.