Page History

...

Architecture

The JobScheduler/ JOC Cockpit architecture allows Authentication and Authorization provided by the JOC Cockpit is provided independently of any JobScheduler instances and this functional independence allows, for example, scalability (see the JOC Cockpit Clusters section below) as well as enabling individual JobScheduler Masters and/or Agents to be used for individual clients and a . A more detailed description of the JobScheduler / JOC Cockpit architecture is provided in the JOC Cockpit - Architecture article.

The authentication and authorization introduced with the JOC Cockpit also Authentication and Authorization allows an extremely flexible set of permissions to be configured for Users.:

• Users User Accounts are allocated one or more Roles, with each Role containing a set of predefined Permissions that specify the operations that can be carried out within the role.
• Roles can be configured for individual JobScheduler Masters.
• In addition, the objects within a JobScheduler Master configuration that can be accessed by a Role can also be configured. For example, one Role may be allowed to view the status of Jobs and Orders in Folders A and B, another Role may be allowed to change the state and modify the run times of the Jobs and Orders in all Folders. This approach may be contrasted with other systems that allocate rights and permissions purely according to resources such as files or folders.

The This use of role-based permissions brings a number of significant advantages:

• It simplifies administration in complex environments. Whilst the administration of the permissions of several hundred folders in a multi-client system is manageable, the administration of several thousand requires brings an extremely high administrative requirement and error susceptibility.
• Role-based permissions allow the permissions for individual clients to be managed separately.
• The clear separation of permissions also simplifies meeting compliance requirements.

JOC Cockpit Clusters

Multiple instances of the JOC Cockpit can be synchronized to provide a high availability, active, cluster that is transparent to the user. Cluster members then share Authentication and Authorization information.

A more detailed description of JOC Cockpit clusters can be found in the JOC Cockpit - Clustering article.

Implementation

• The JOC Cockpit uses Apache Shiro to authenticate and authorize users.
• Authentication and Authorization information can be read by Shiro from a number of separate resources. These are:
  • a local configuration (shiro.ini) file that may include both authentication and authorization information, depending on the methods of authentication and authorization configured;
  • a authentication service that provides an LDAP interface such as Microsoft Active Directory and
  • a database containing both authentication and authorization information and which complies with the Shiro data model requirements. This database will be managed (and populated) by a system administrator.

Authentication

• The JOC Cockpit / Web services accepts the user name and password from the login screen and, depending on the configuration in the shiro.ini file, either:
  • tries to verify the credentials against information stored in the shiro.ini file,
  • tries to login to the LDAP directory service with the given credentials or
  • checks the credentials against information stored in a Shiro compliant database.
• The authentication credentials are subsequently used for HTTP Authentication with each HTTP request that is created by the JOC Cockpit for the JobScheduler Web Services.
  • Browsers may cache credentials during a session, i.e. they are re-used for single sign-on when opening the JOC Cockpit in a new browser tab. The credentials cache is cleared on termination of the browser.
  • This behavior might vary depending on the browser and version.

...

This view is read-only for all users - changes can only be made by a system administrator either: modifying the roles and permissions as described in the Authentication and Authorization - Configuration article.

Note that this view shows the permissions for the operations that can be carried out within the Roles allocated to the user. The folders permissions allocated to these Roles can be easily viewed in the folder trees in the Job Chains and Jobs views

...