1. Abstract
Security management is always a complex subject in big applications with large perimeters, we often need to manage multiple roles and rights for a single user, and the best solution to manage that is via the subscription hub Metadata, let’s see what the advanced options are of this feature
2. Context
In addition to the standard user information (such as Name, Account Name, and Email Address) that you specify when you add a user account, you can create and manage custom user metadata that is unique and meaningful to your organization. For example, you can store information about a user's department, office location, and job role.
The User metadata section in the Subscription Hub allows you to create and manage custom user metadata fields. These fields will appear under the User metadata table in the user profile panel and can also be included in the Enrollment process request form.
The end user will also be able to review or edit this information under the "My Profile" page within the Board platforms he/she can access.
User Metadata can be used to replace User Security Selection which was released by Subscription Hub.
3. Content
Before having the subscription hub, we were often faced with situations where we need to create many security profiles in order to manage the client's needs, sometimes even creating a different security profile for each user.
Now with the subscription hub, it is possible to manage differently this kind of needs
3.1 Managing security on defined entities
Let's see the following use case:
The need is to apply security on the two highlighted entities, TERRITORY LVL 2 and LOBS LVL 1
Before the subscription hub, we had to either (depending on the other needs)
- Create a DB profile for each existing combination (many DB profiles)
- Or apply selections directly as user level
Now with the subscription hub, it is possible to create a single DB profile but with dynamic selections based on the user metadata.
To do so, we need to:
- Step 1: Create two metadata corresponding to the two entities, as shown below:
You may choose the drop-down option to make sure to pick a correct value
- Step 2: Write the following script in either a DB profile or directly in the role.
Attention: This script fails if the metadata field is empty, you must use a different role in case the user does not have a restriction.
- Step 3 : to fill the metadata for the user
3.2 Managing security on undefined entities
Sometimes we face a situation where we need to apply security on multiple undefined entities, for example, the need to apply selections on many hierarchies and at any level of the hierarchy. This case can’t be managed by creating metadata for each entity, we must manage it more dynamically.
- Step 1: Create a generic metadata
Note that you must choose the text type of entry
- Step 2: use the command “SELECT” to define the perimeter. To select multiple members on an entity, use the comma (,) as a separator, no need to put space
- Step 3: Create a generic DB profile with a script as follows. Use the pipe “|” to use selects multiple entities
Remarks :
- After the creation/modification of metadata, a restart of the web server is necessary to apply the new changes
- It is possible to import users from a CSV file, so we can manage all the metadata settings via the CSV file
- Please see the syntax of the import file in case we have a selection of multiple members on an entity (the use of “Select xxx”)
