...
| Excerpt |
|---|
The JOC Cockpit brings user authentication and authorization to the JobScheduler. Authentication can either take place against an Apache ShiroTM compliant configuration file, an LDAP compliant directory service or information stored in a database. Authorization is defined in roles Roles - an example set of roles Roles is provided with the JOC Cockpit installation archive and system administrators are able to define roles Roles for their usersUsers. The JOC Cockpit is able to handle authentication of multiple users and their authorization for multiple JobSchedulers simultaneously and includes an editor - in the Manage Accounts view - for the configuration of authentication and authorization. |
...
The JobScheduler/ JOC Cockpit architecture allows individual JobScheduler Masters and/or Agents to be used for individual clients , and is an overview is described provided in the JOC Cockpit - Architecture article. The authentication and authorization introduced with the JOC Cockpit also allows an extremely flexible set of permissions to be configured for Users.
- Users are allocated one or more roles Roles, with each role Role containing a set of predefined permissions Permissions that specify the operations that can be carried out within the role.
- Roles can be configured for individual JobScheduler Masters.
- In addition, the objects within a JobScheduler Master configuration that can be accessed by a role Role can also be configured. For example, one role Role may be allowed to view the status of Jobs and Orders in Folders A and B, another role Role may be allowed to change the state and modify the run times of the Jobs and Orders in all the Folders. This approach may be contrasted with other systems that allocate rights and permissions purely according to resources such as files or folders.
The use of role-based permissions brings a number of significant advantages:
- It simplifies their administration in complex environments. Whilst the administration of the permissions of several hundred folders in a multi-client system is manageable, the administration of several thousand requires brings an extremely high administrative requirement and error susceptibility.
- Role-based permissions allow the permissions for individual clients to be managed separately.
- The clear separation of permissions also simplifies meeting compliance requirements.
...