Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding clarification that sub-admin roles should not be able to change their own privileges #1451

Merged
merged 1 commit into from
Feb 28, 2024
Merged

Adding clarification that sub-admin roles should not be able to change their own privileges #1451

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions modules/ROOT/pages/authentication-authorization/access-control.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,10 +224,14 @@ Then you need to *deny* the two specific actions this role is not supposed to pe
* Read any patients' social security number (`SSN`).
* Submit medical diagnoses.

As well as the ability for the `itadmin` to amend their own privileges.

[source, cypher, role=systemcmd]
----
DENY READ {ssn} ON GRAPH healthcare NODES Patient TO itadmin;
DENY CREATE ON GRAPH healthcare RELATIONSHIPS DIAGNOSIS TO itadmin;
DENY ROLE MANAGEMENT ON DBMS TO itadmin;
DENY PRIVILEGE MANAGEMENT ON DBMS TO itadmin;
----

The complete set of privileges available to users assigned the `itadmin` role can be viewed using the following command:
Expand All @@ -253,6 +257,8 @@ SHOW ROLE itadmin PRIVILEGES AS COMMANDS;
| "GRANT ALL DBMS PRIVILEGES ON DBMS TO `itadmin`" |
| "DENY READ {ssn} ON GRAPH `healthcare` NODE Patient TO `itadmin`" |
| "DENY CREATE ON GRAPH `healthcare` RELATIONSHIP DIAGNOSIS TO `itadmin`" |
| "DENY ROLE MANAGEMENT ON DBMS TO `itadmin`" |
| "DENY PRIVILEGE MANAGEMENT ON DBMS TO `itadmin`" |
+-------------------------------------------------------------------------+
----

Expand Down
Loading