Business Process Choreographer - Human Task Manager & Business Flow Manager
four eyes principle
Business Process Choreographer provides instance- and rule-based authorization for business processes and tasks enabling you to model sophisticated authorization scenarios based on process context, or the four-eyes principle: people are authenticated by WebSphere Application Server and then also authorized by Human Task Manager based on their user IDs. Be aware that authentication and authorization relies on WebSphere Application Server global security.
Architecture overview
1. Business Flow Manager navigates business processes. - WS-BPEL
2. Human Task Manager coordinates human interaction. - Web service
Authorization and staff resolution concepts
Staff Verbs - The authorization rules are defined using so-called staff verbs (also known as people assignment criteria), which are authorization rule templates. Staff verbs are abstract authorization rules for a human task role that can be parameterized and bound to a specific staff repository during business process and human task modeling.
Staff Queries - During deployment, the parameterized staff verbs are transformed into concrete staff queries (also known as people queries) that are specific to the staff repository used to perform the query.
Staff Resolution - Querying a staff repository at run time for people, groups, and their attributes, to evaluate an authorization rule is called staff resolution (also known as people resolution).
Staff Repository - A staff repository (also known as an enterprise, staff, or people directory) is the data store that actually contains the user and group information. The most popular staff repository is the LDAP directory, which is based on the standardized Lightweight Directory Access Protocol.
Context Variables - Context variables are enclosed in percent signs.When staff query parameters contain context variables that are resolved at run time, authorization is then based on process and task instance data; therefore, even though authorization is based on the same rule, the data that determines authorization can be different for each instance of the business process or human task. Be aware that only inline human tasks have access to the process context.
Work Items - Everybody, User, Group
http://www.ibm.com/developerworks/websphere/techjournal/0710_lind/0710_lind.html
分享到：
相关推荐
Doing authorization in a clean way is always tricky, You want a delicate balance between an extreme abstraction and something like embedding roles in-side your compiled code, I have always preferred ...
### Windows XP Professional Resource Kit：Managing Authorization and Access Control 在当今高度数字化的工作环境中，确保系统安全性和资源访问控制是至关重要的。对于使用Windows XP Professional的操作系统而...
This module is based on Spring Authorization Server and contains information on using Spring Security OAuth2
This paper introduces the notion of safety and availability checking for user authorization query processing, and develop a recursive algorithm use the ideas from backtracking-based search techniques ...
Building Secure ASP.NET Applications Authentication, Authorization, and Secure Communication The WhiteBook from microsoft
在IT行业中，授权（Authorization）是网络安全和访问控制的核心概念之一。它涉及到系统确定一个用户或进程是否有权限访问特定资源的过程。"Authorization"这个标题暗示我们将会探讨的是关于权限管理和认证后的授权...
在IT行业中，授权（Authorization）是网络安全和访问控制的核心概念之一。它定义了系统或服务如何确定一个用户或进程是否被允许执行特定的操作。本文将深入探讨授权的概念、类型、流程以及在实际应用中的实现方式。 ...
"MM Authorization"是一个重要的概念，尤其在信息技术领域中，它通常指的是权限管理和访问控制机制。在本文中，我们将深入探讨MM Authorization的相关知识点，包括它的定义、功能、应用场景以及实现技术。 MM ...
关于Basic Authorization 在HTTP中，Basic Authorization基本认证是一种用来允许Web浏览器或其他客户端程序在请求时提供用户名和口令形式的身份凭证的一种登录验证方式。 在发送之前是以用户名追加一个冒号然后串接...
The book lays out the core of ActiveMQ in clear language, starting with the anatomy of a JMS message and moving quickly through connectors, message persistence, authentication and authorization....
解决php获取不到客户端发来的Authorization的header头信息
【ERP信息化专业资料：SAP专业学习资料01_authorization_in_bw.ppt】这份文档主要聚焦于SAP Business Warehouse (BW)系统中的权限管理，即Authorization in BW，这是ERP信息化领域的一个关键知识点。BW是SAP提供的...
在Java Web开发中，JSP（JavaServer Pages）是一种用于创建动态网页的技术，而`<authorization-module>`看起来是一个自定义的JSP标签库，专门设计用于处理权限管理和分页功能。这种标签库使得开发者能够更方便地在...
Unity 中通过UnityWebRequest 以GET形式传authorization 的参数请求数据。 注意： 以Header头文件的形式发送请求，authorization要放入请求头部。 以头文件形式发起请求进行Token验证，token为Authorization中的...
在Laravel框架中，"laravel-authorization"是关于权限管理的一个重要方面。这个主题涉及到如何在应用中安全地控制用户访问不同的资源和执行特定的操作。让我们深入探讨一下Laravel授权的基本概念、工作原理以及如何...
S/4HANA Cloud Partner Authorization & Enablement Framework Roadmap to a flourishing S/4HANA Cloud Partner Business Delivery Accreditation Requirement as part of Sell Authorization
your personal serial and authorization code (use regular chars, email doesn't matter). !!Block network traffic, or disable your network connection (You have to do this or you will not be able ...
Privilege level assignments for commands determine the privilege level a command is executable at, provided that the user has the authorization credentials. That means, If a command is assigned to a ...
Additionally, you'll explore API security with ASP.NET Core identity and authorization policies, and write reliable unit tests using both .NET Core and React before you deploy your app to the Azure ...