Permissions Configuration
Overview
In version 3.0 and previous of iSymphony, permissions were defined for 'permissible' objects in the system - each object that could be controlled via permissions (extensions, queues, other users, etc) would store a list of the users allowed to perform actions on it, and which actions each was allowed to perform. Beginning in version 3.1 of iSymphony, the situation has been reversed, to make it easier to administer permissions and hopefully less confusing. Permissions are defined for each user or user group in the system, in a cascading manner. They are evaluated in order of decreasing specificity, and in the case of a conflicting tie, the action is allowed. This must be considered when using the REST system to define permissions. See the documentation for permissions for more details.
Defaults
By default, all users in the system are allowed to perform all actions. Therefore, if a specific permission key has not been defined for a user (either on the user itself, or one of the groups it is a member of), that action should be considered allowed. When defining a permission, the default policy is also allowed, unless the allowed flag is set to false.
Exceptions
The heart of the permission system lies in the exceptions to the rules. This allows for powerful combinations to be achieved. Generally, the objects defined by their UUIDs in the exceptions field will be allowed to perform an action if the allowed flag is false, and prevented from performing that action if the allowed flag is true. That is, they will follow the opposite of the general policy for that definition.
Special Values
There are a few special predefined values that are used by the permission system. They are:
- All Users Group: The all users group is hard-coded into iSymphony to contain all users. You can use this to set global permissions on the clients. The UUID for the 'All Users' group is 21d97061-ff6a-11e1-a21f-0800200c9a66.
- 'Owned' permission target: In many cases, an administrator may want to defined that users only have access to their "own" objects: their user, their extensions, their phone numbers, etc. In this case, setting the permission to 'Deny', with the special exception df41edec-2707-46eb-8b8f-146b01d9b29e will only give users access to their own objects.
Root Resource Paths
JSON Representation
"permissionsEnabled": false
}
Note: the above object is only used to enable or disable permissions. See the page on the core server configuration itself to query the status of the permissions.
"key": "cellPhoneOriginateTo",
"allowed": false,
"exceptions": [
"df41edec-2707-46eb-8b8f-146b01d9b29e"
],
"inherited": false
}
Property | Type | Description |
|---|---|---|
key | String | The key used for this permission configuration. |
allowed | Boolean | Whether the action should be generally allowed or not. |
exceptions | Array of Strings (UUID) | The objects defined in the exceptions will be granted or denied access as exceptions to the general rule. |
inherited | Boolean | Used internally. Should never be true when using the REST system. |
Resource Paths
communication_manager/api/resource/core/{core_server_id}/permissions | |
|---|---|
Description | Specifies whether permissions should be enabled or disabled for the entire core server. When disabled, no permission checks will be performed, so the rest of the settings specified in the permissions system will have no effect. Note that you must have a supported license installed to enable permissions. Parameters:
Errors:
|
PUT | Sets whether permissions are enabled or disabled globally on the core server. |
communication_manager/api/resource/core/{core_server_id}/permissions/userGroup/{user_group_id} | |
Description | Retrieves permissions for the user group identified by the {user_group_id} path parameter. Parameters:
Errors:
|
GET | Retrieves all permissions defined for the user group. |
communication_manager/api/resource/core/{core_server_id}/permissions/userGroup/{user_group_id}/{key} | |
Description | Retrieves or updates a specific permission for a user group. Parameters:
Errors:
|
GET | Retrieves a specific permission for the user group. Errors:
|
PUT | Sets the permission definition for the user group with the specified key. The key defined in the permission definition body must match the key used in the URL. Errors:
|
DELETE | Clears the specific permission definition for the user group. Errors:
|
communication_manager/api/resource/core/{core_server_id}/permissions/user/{user_id} | |
Description | Retrieves permissions for the user group identified by the {user_id} path parameter. Parameters:
Errors:
|
GET | Retrieves all permissions defined for the user. |
communication_manager/api/resource/core/{core_server_id}/permissions/user/{user_id}/{key} | |
Description | Retrieves or updates a specific permission for a user group. Parameters:
Errors:
|
GET | Retrieves a specific permission for the user. Errors:
|
PUT | Sets the permission definition for the user with the specified key. The key defined in the permission definition body must match the key used in the URL. Errors:
|
DELETE | Clears the specific permission definition for the user. Errors:
|
Curl Examples
Get all defined permissions for the 'All Users' group
Get all defined permissions for a specific user
Deny the 'passwordChange' permission for the above user
Remove the 'passwordChange' permission for the above user
Note: this will not prevent the user from changing their password. It will cause the user to inherit the permission of any user groups they are a part of.