15.3.3.1. Procedure – Configuring authorization policies

1. Create an Authorization policy on the Policies tab of the Zorp ZMC component. Click on New, select Authorization policy from the Policy type combobox, and enter a name for the policy into the Policy textbox.

   

   Figure 15.26. Creating authorization policies

2. Select the authorization model to use in the policy from the Class combobox. The following models are available:

   

   Figure 15.27. Selecting an authorization model

   • BasicAccessList: Authorize only users meeting a set of authorization conditions, for example, certain users, users belonging to specified groups, or any combination of conditions using the other authorization models.

   • NEyesAuthentication: The client trying to access the service has to be authorized by one (or more) authorized clients. This model can be used to implement 4-eyes authorization solutions.

   • PairAuthentication: Authorize only userpairs — single users cannot access a service, that is, only two different users (with different usernames) can access the service.

     Tip
     NEyesAuthentication and PairAuthentication are useful when the controlled access to sensitive (for example, financial) data has to be ensured and audited.

   • PermitGroup: Authorize only the members of the listed usergroups. This is a simplified version of the BasicAccessList model.

   • PermitUser: Authorize only the listed users. This is a simplified version of the BasicAccessList model.

   • PermitTime: Authorize any user but only in the set time interval. This authorization model does not require authentication.

     Tip
     Use the BasicAccessList authorization model to combine user authentication with time-based authentication. For example, create a policy consisting of two Required policies: PermitTime and PermitUser.

3. Configure the parameters of the selected authorization class. See Section 15.3.3.2, Authorization models of Zorp for the detailed description of the classes.

   

   Figure 15.28. Configuring authorization policies

4. Navigate to the Instances tab of the Zorp ZMC component, and select the service that will use the authorization policy.

   

   Figure 15.29. Using authorization policies in Zorp services

5. In the Service parameters section, select the Authorization policy to use from the combobox.