Limit access to Views and actions - Activity
The activity-based configuration is based on a two-part configuration scheme where individual activities are defined by the controller and action names. A Controller essentially represents a menu item on the Control Panel, and an action is functionality available for user to perform. The following activities are available for configuration.
*.*All permissions*.AdminAdmin permissions*.EditEdit permissions*.ViewView permissionsApiManagement.*APIs All permissionsApiManagement.ViewAPIs View permissionsApiManagement.EditAPIs Edit permissionsProcess.*Process All permissionsProcess.ViewProcess View permissionsProcess.EditProcess Edit permissionsProcess.DeployProcess DeployProcess.StartProcess Run onceProcessinstance.*Process Instance All permissionsProcessinstance.ViewProcess Instance View permissionsProcessinstance.EditProcess Instance Edit (terminating and deleting instances, acknowledging errors) permissionsEnvironment.*Environment All permissionsEnvironment.EditEnvironment Edit permissionsEnvironment.AdminEnvironment Admin permissionsTask.*Task All permissionsTask.ViewTask View permissionsTask.EditTask Edit permissionsMonitoringRules.*Monitoring rules All permissionsMonitoringRules.ViewMonitoring rules View permissionsMonitoringRules.EditMonitoring rules Edit permissionsEnvironmentVariables.EditEnvironment Variables Edit permissionsUserManagement.AdminUser management Admin permissionsApiKeyManagement.AdminAPI Keys Admin permissionsCommon.ViewCommon View permissions
Following wildcards are supported for activities
*.* - match all activities
*.{action} - match all actions with given name in every controller
{controller}.* - match all actions for given controller
Order of the activities being authorized
Explicitly allowed activity (e.g. Process.Start)
Explicitly denied activity (e.g. Process.Deploy)
Wildcard allowed activity (e.g. Process.*)
Wildcard denied activity (e.g. *.Edit)
Full allow wildcards (*.*)
Full deny wildcards (*.*)
This means that if activity has been configured with explicit allow option, then it cannot be overridden by any following value.
When creating a new role, you should always add the "Common.View" rule, as it is required when, for example, seeing the navigation menu as well as other common views.
Example
Developer that can view everything and edit Processes and start Processes. But the users of this role can not e.g. acknowledge errors due lack of Processinstance.Edit rule.
The next article is Introduction to Limit access to only specific Processes - Tag