Authentication and Authorization - Permissions for the JOC Cockpit

Scope

The JobScheduler REST Web Services can be used by any client program or job that has to access JobScheduler objects for operations such as adding an order to a job chain.
The REST Web Services are a replacement for the XML Interface. and require authentication and authorization.
A system administrator would then integrate the permissions necessary to carry out the operations required in the authorization system used by the Web Services API. More information about how this can be done is available in the Authentication and Authorization - Configuration article.

Matrix of Roles and Permissions

The document below shows the example roles and permissions delivered in the JOC Cockpit shiro.ini configuration file. System administrators can define and modify roles and permissions as required.

The purpose of each example role is explained in the notes at the foot of the matrix. Of particular interest is the api_user role that is not intended to use the JOC Cockpit interface but use the JobScheduler Web Services from another application. More information about the Web Services API can be found in the

Document: joc-role-operation-permission.xlsx

Error rendering macro 'viewxls'

com.atlassian.confluence.macro.MacroExecutionException: com.atlassian.confluence.macro.MacroExecutionException: The viewfile macro is unable to locate the attachment "joc-role-operation-permission.xlsx" on this page

The REST Web Services are called by using an HTTP client.
The following REST web service requests are supported:
- The first operation of a client should be call to the joc/api/security/login URL.
  - A valid account and password have to be provided by the client. The account and permissions for the command(s) to be executed are configured with the shiro.ini configuration file. See the Authentication and Authorization - Configuration article and the example api_user configuration for further information.
  - Use the joc/api/security/joc_cockpit_permissions URL to retrieve the permissions for the current user.
- Subsequent commands can be sent by use of the joc/api/jobscheduler/command URL.
- The last operation of a client should be a call to the joc/api/security/logout URL.

Complete List of Permissions

The following table shows the permissions that can be set to allow an API user to address the JobScheduler REST Web Services.

As stated above the permissions included in the shiro.ini file delivered with the JOC Cockpit is a subset of all the permissions that can be set.

The following file shows the full hierarchy of the permissions that can be set for the JOC Cockpit:

The following table lists all the commands that can be executed from the JOC Cockpit alongside the corresponding JobScheduler XML command. A full list of the JobScheduler XML commands with links to all the command reference pages can be found in the JobScheduler Reference Documentation.

Object	Permission	Web Service	Comment
Commands	`sos:products:joc_cockpit:jobscheduler_master:view:status`	`/jobscheduler` `/jobscheduler/cluster/members`
	`sos:products:joc_cockpit:jobscheduler_master:view:parameter`		shows parameters from `scheduler.xml`
	`sos:products:joc_cockpit:jobscheduler_master:execute:restart:terminate`
	`sos:products:joc_cockpit:jobscheduler_master:execute:restart:abort`
	`sos:products:joc_cockpit:jobscheduler_master:execute:pause`
	`sos:products:joc_cockpit:jobscheduler_master:execute:continue`
	`sos:products:joc_cockpit:jobscheduler_master:execute:terminate`
	`sos:products:joc_cockpit:jobscheduler_master:execute:abort`
	`sos:products:joc_cockpit:jobscheduler_master:manage_categories`
	`sos:products:joc_cockpit:jobscheduler_master_cluster:view:status`
	`sos:products:joc_cockpit:jobscheduler_master_cluster:execute:terminate_fail_safe`	`/jobscheduler/cluster/terminate_failsafe`
	`sos:products:joc_cockpit:jobscheduler_master_cluster:execute:restart`
	`sos:products:joc_cockpit:jobscheduler_master_cluster:execute:terminate`	`/jobscheduler/cluster/terminate`
	`sos:products:joc_cockpit:jobscheduler_universal_agent:view:status`	`/jobscheduler/agents`
	`sos:products:joc_cockpit:jobscheduler_universal_agent:execute:restart:abort`	??
	`sos:products:joc_cockpit:jobscheduler_universal_agent:execute:restart:terminate`	??
	`sos:products:joc_cockpit:jobscheduler_universal_agent:execute:abort`	??
	`sos:products:joc_cockpit:jobscheduler_universal_agent:execute:terminate`	??
	`sos:products:joc_cockpit:daily_plan:view:status`
	`sos:products:joc_cockpit:history:view`
	`sos:products:joc_cockpit:order:view:status`
	`sos:products:joc_cockpit:order:view:configuration`
	`sos:products:joc_cockpit:order:view:order_log`
	`sos:products:joc_cockpit:order:change:start_and_end_node`
	`sos:products:joc_cockpit:order:change:time_for_adhoc_orders`	??
	`sos:products:joc_cockpit:order:change:parameter`
	`sos:products:joc_cockpit:order:change:run_time`
	`sos:products:joc_cockpit:order:change:state`
	`sos:products:joc_cockpit:order:change:hot_folder`
	`sos:products:joc_cockpit:order:execute:start`
	`sos:products:joc_cockpit:order:execute:update`
	`sos:products:joc_cockpit:order:execute:suspend`
	`sos:products:joc_cockpit:order:execute:resume`
	`sos:products:joc_cockpit:order:execute:reset`
	`sos:products:joc_cockpit:order:execute:remove_setback`
	`sos:products:joc_cockpit:order:delete:permanent`
	`sos:products:joc_cockpit:order:delete:temporary`
	`sos:products:joc_cockpit:job_chain:view:configuration`
	`sos:products:joc_cockpit:job_chain:view:history`
	`sos:products:joc_cockpit:job_chain:view:status`
	`sos:products:joc_cockpit:job_chain:execute:stop`
	`sos:products:joc_cockpit:job_chain:execute:unstop`
	`sos:products:joc_cockpit:job_chain:execute:add_order`
	`sos:products:joc_cockpit:job_chain:execute:skip_jobchain_node`
	`sos:products:joc_cockpit:job_chain:execute:process_jobchain_node`
	`sos:products:joc_cockpit:job_chain:execute:stop_jobchain_node`
	`sos:products:joc_cockpit:job_chain:change:hot_folder`
	`sos:products:joc_cockpit:job:view:status`
	`sos:products:joc_cockpit:job:view:task_log`
	`sos:products:joc_cockpit:job:view:configuration`
	`sos:products:joc_cockpit:job:view:history`
	`sos:products:joc_cockpit:job:change:run_time`
	`sos:products:joc_cockpit:job:change:hot_folder`
	`sos:products:joc_cockpit:job:execute:start`
	`sos:products:joc_cockpit:job:execute:stop`
	`sos:products:joc_cockpit:job:execute:unstop`
	`sos:products:joc_cockpit:job:execute:terminate`
	`sos:products:joc_cockpit:job:execute:unstop`
	`sos:products:joc_cockpit:job:execute:kill`
	`sos:products:joc_cockpit:job:execute:end_all_tasks`
	`sos:products:joc_cockpit:job:execute:suspend_all_tasks`
	`sos:products:joc_cockpit:job:execute:continue_all_tasks`
	`sos:products:joc_cockpit:process_class:view:status`
	`sos:products:joc_cockpit:process_class:view:configuration`
	`sos:products:joc_cockpit:process_class:modify_hot_folder`
	`sos:products:joc_cockpit:schedule:view:configuration`
	`sos:products:joc_cockpit:schedule:view:status`
	`sos:products:joc_cockpit:schedule:add_substitute`
	`sos:products:joc_cockpit:schedule:modify_hot_folder`
	`sos:products:joc_cockpit:lock:view:configuration`
	`sos:products:joc_cockpit:lock:view:status`
	`sos:products:joc_cockpit:lock:modify_hot_folder`
	`sos:products:joc_cockpit:event:view:statu`s
	`sos:products:joc_cockpit:event:delete`
	`sos:products:joc_cockpit:event_action:view:status"`
	`sos:products:joc_cockpit:event_action:create_event_manually`
	`sos:products:joc_cockpit:holiday_calendar:view:status`
	`sos:products:joc_cockpit:maintenance_window:view:status`
	`sos:products:joc_cockpit:maintenance_window:enable_disable_maintenance_window`

Permission	Reference to XML Interface	Description
`sos:products:commands:jobscheduler_master:view:status`	`<show_state/>`	Retrieves status information about a JobScheduler Master
`sos:products:commands:jobscheduler_master:view:parameter`	`<params.get/>` `<param.get name="..."/>`	Shows parameters from `./config/scheduler.xml`
`sos:products:commands:jobscheduler_master:execute:restart:terminate`	`<terminate restart="yes"/>`	Terminates and restarts a JobScheduler Master
`sos:products:commands:jobscheduler_master:execute:restart:abort`	`<modify_spooler cmd="abort_immediately_and_restart"/>`	Aborts and restarts a JobScheduler Master
`sos:products:commands:jobscheduler_master:execute:pause`	`<modify_spooler cmd="pause"/>`	Pauses a JobScheduler Master
`sos:products:commands:jobscheduler_master:execute:continue`	`<modify_spooler cmd="continue"/>`	Continues operation of the JobScheduler Master after pausing
`sos:products:commands:jobscheduler_master:execute:terminate`	`<terminate/>`	Terminates a JobScheduler Master
`sos:products:commands:jobscheduler_master:execute:abort`	`<modify_spooler cmd="abort_immediately"/>`	Aborts a JobScheduler Master
`sos:products:commands:jobscheduler_master:execute:stop`	`<modify_spooler cmd="stop"/>`	Stops any running tasks in a JobScheduler Master
`sos:products:commands:jobscheduler_master:manage_categories`	`<scheduler_log.log_categories.set/> <scheduler_log.log_categories.show/>` `<scheduler_log.log_categories.reset/>`	Activates, retrieves and resets log categories
`sos:products:commands:jobscheduler_master_cluster:execute:terminate_fail_safe`	`<modify_spooler cmd="continue_exclusive_operation"/>`	Terminates the active JobScheduler cluster member and activates a passive cluster member for fail-over
`sos:products:commands:jobscheduler_master_cluster:execute:restart`	`<terminate restart="yes" all_schedulers="yes"/>`	Terminates and restarts all JobScheduler cluster members
`sos:products:commands:jobscheduler_master_cluster:execute:terminate`	`<terminate all_schedulers="yes"/>`	Terminates all JobScheduler cluster members
`sos:products:commands:history:view`	`<show_history/>`	Retrieve the JobScheduler history
`sos:products:commands:order:view:status`	`<show_order/>`	Retrieve order status information
`sos:products:commands:order:change:start_and_end_node`	`<modify_order state="..." end_state="..."/>`	Modifies the starting and ending states of an order
`sos:products:commands:order:change:time_for_adhoc_orders`	`<modify_order><run_time/></modify_order>`	Modifies the run-time of a temporary ad hoc order
`sos:products:commands:order:change:parameter`	`<modify_order><params><param name="..." value="..."/></params></modify_order>`	Modifies order parameters
`sos:products:commands:order:change:run_time`	`<modify_order><run_time/></modify_order>`	Modifies the run-time of a permanent order
`sos:products:commands:order:change:state`	`<modify_order state="..."/>`	Modifies an order's state
`sos:products:commands:order:change:other`	`<modify_order/>`	Modifies any remaining order attributes not covered by other permissions
`sos:products:commands:order:change:hot_folder`	<`modify_hot_folder><order/></modify_hot_folder`>	Updates an order in the JobScheduler Master `./config/live` directory
`sos:products:commands:order:execute:start`	`<modfiy_order at="now"/>`	Causes an immediate start of the order
`sos:products:commands:order:execute:update`	`<modify_order/>`	Updates order attributes
`sos:products:commands:order:execute:suspend`	`<modify_order suspended="yes"/>`	Suspends an order
`sos:products:commands:order:execute:resume`	`<modify_order suspended="no"/>`	Continues a previously suspended order
`sos:products:commands:order:execute:reset`	`<modify_order action="reset"/>`	Resets an order
`sos:products:commands:order:execute:remove_setback`	`<modify_order setback="no"/>`	Removes a setback setting for an order
`sos:products:commands:order:delete`	`<remove_order/>`	Removes a temporary ad hoc order from the JobScheduler Master
`sos:products:commands:job_chain:view:status`	`<show_state/>`	Retrieves status information about a job chain
`sos:products:commands:job_chain:execute:stop`	`<job_chain.modify state="stopped"/>`	Stops a job chain
`sos:products:commands:job_chain:execute:unstop`	`<job_chain.modify state="running"/>`	Continues a previously stopped job chain
`sos:products:commands:job_chain:execute:add_order`	`<add_order/>`	Add a temporary ad hoc order to a job chain
`sos:products:commands:job_chain:execute:skip_jobchain_node`	`<job_chain_node.modify action="next_state"/>`	Skips a job chain node
`sos:products:commands:job_chain:execute:process_jobchain_node`	`<job_chain_node.modify action="process"/>`	Continues processing of a job chain node that has previously been skipped or stopped
`sos:products:commands:job_chain:execute:stop_jobchain_node`	`<job_chain_node.modify action="stop"/>`	Stops a job chain node
`sos:products:commands:job_chain:change:hot_folder`	<`modify_hot_folder><job_chain/></modify_hot_folder`>	Updates a job chain in the JobScheduler Master `./config/live` directory
`sos:products:commands:job:view:status`	`<show_job/>`	Retrieves status information about a job
`sos:products:commands:job:change:run_time`	`<modify_order><run_time/></modify_order>`	Modifies the run-time of a job
`sos:products:commands:job:change:hot_folder`	<`modify_hot_folder><job/></modify_hot_folder`>	Updates a job in the JobScheduler Master `./config/live` directory
`sos:products:commands:job:execute:start`	`<start_job/>`	Starts a job
`sos:products:commands:job:execute:stop`	`<modify_job cmd="stop"/>`	Stops a job
`sos:products:commands:job:execute:unstop`	`<modify_job cmd="unstop"/>`	Unstops a previously stopped job
`sos:products:commands:job:execute:terminate`	`<modify_job cmd="end"/>`	Terminates a job
`sos:products:commands:job:execute:kill`	`<kill_task/>`	Kills a task that is running for the job
`sos:products:commands:job:execute:end_all_tasks`	`<kill_task immediately="yes" timeout="never"/>`	Sends all running tasks for a job a SIGTERM signal
`sos:products:commands:job:execute:suspend_all_tasks`	`<modify_job cmd="suspend"/>`	Suspends all running tasks for a job
`sos:products:commands:job:execute:continue_all_tasks`	`<modify_job cmd="continue"/>`	Continues all previously suspended tasks for a job
`sos:products:commands:process_class:view:status`	`<show_state/>`	Retrieves status information about process classes
`sos:products:commands:process_class:edit:change`	`<process_class/>`	Modifies a process class
`sos:products:commands:process_class:edit:remove`	`<process_class.remove/>`	Removes a process class
`sos:products:commands:process_class:modify_hot_folder`	<`modify_hot_folder><process_class/></modify_hot_folder`>	Updates a process class in the JobScheduler Master `./config/live` directory
`sos:products:commands:schedule:view:status`	`<show_state/>`	Retrieves status information about schedules
`sos:products:commands:schedule:add_substitute`	<`modify_hot_folder><schedule substitute="..."/></modify_hot_folder`>	Assigns a substitute schedule to an existing schedule
`sos:products:commands:schedule:remove`	`<schedule.remove/>`	Removes a schedule
`sos:products:commands:schedule:modify_hot_folder`	<`modify_hot_folder><schedule/></modify_hot_folder`>	Updates a schedule in the JobScheduler Master `./config/live` directory
`sos:products:commands:lock:view:status`	`<show_state/>`	Retrieves status information about locks
`sos:products:commands:lock:edit:change`	`<lock/>`	Modifies a lock
`sos:products:commands:lock:remove`	`<lock.remove/>`	Removes a lock

Examples

Allow orders to be viewed and executed

Allow orders to be viewed and executed, but not changed

sos:products:commands:order:view, \
sos:products:commands:order:execute, \

Allow all order operations except changing and removing orders

Allow orders to be viewed and executed, but not changed

sos:products:commands:order, \
-sos:products:commands:order:change, \
-sos:products:commands:order:remove, \

Retrieve permissions for the current user

The answer to the joc/api/security/joc_cockpit_permissions request is a JSON object.

The valueOf(permission) function will be evaluated to true/false indicating if the permission is granted.

If the user is assigned a role that includes the permissions specified in brackets then the permission will be granted.

joc/api/security/joc_cockpit_permissions

{
  "isAuthenticated": true,
  "user": "SOS01",
  "accessToken": "dfd96e2c-ef7f-4158-acf3-1af98d4407c4",
  "JobschedulerMaster": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:jobscheduler_master:view:status),
      "mainlog": valueOf(sos:products:joc_cockpit:jobscheduler_master:view:mainlog)
    },
    "pause": valueOf(sos:products:joc_cockpit:jobscheduler_master:pause),
    "continue": valueOf(sos:products:joc_cockpit:jobscheduler_master:continue),
    "restart": {
      "terminate": valueOf(sos:products:joc_cockpit:jobscheduler_master:restart:terminate),
      "abort": valueOf(sos:products:joc_cockpit:jobscheduler_master:restart:abort)
    },
    "terminate": valueOf(sos:products:joc_cockpit:jobscheduler_master:terminate),
    "abort": valueOf(sos:products:joc_cockpit:jobscheduler_master:abort),
    "manageCategories": sos:products:joc_cockpit:jobscheduler_master:manage_categories)
  },
  "JobschedulerMasterCluster": {
    "view": {
      "clusterStatus": valueOf(sos:products:joc_cockpit:jobscheduler_master_cluster:view:cluster_status)
    },
    "terminateFailSafe": valueOf(sos:products:joc_cockpit:jobscheduler_master_cluster:terminate_fail_safe),
    "restart": valueOf(sos:products:joc_cockpit:jobscheduler_master_cluster:terminate_cluster_member:restart),
    "terminate": valueOf(sos:products:joc_cockpit:jobscheduler_master_cluster:terminate_cluster_member:terminate)
  },
  "JobschedulerUniversalAgent": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:jobscheduler_universal_agent:view:status)
    },
    "terminate": valueOf(sos:products:joc_cockpit:jobscheduler_universal_agent:terminate),
    "abort": valueOf(sos:products:joc_cockpit:jobscheduler_universal_agent:abort),
    "restart": {
      "terminate": valueOf(sos:products:joc_cockpit:jobscheduler_universal_agent:restart:terminate),
      "abort": valueOf(sos:products:joc_cockpit:jobscheduler_universal_agent:restart:abort)
    }
  },
  "DailyPlan": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:daily_plan:view_status)
    }
  },
  "History": {
    "view": valueOf(sos:products:joc_cockpit:history:view)
  },
  "Order": {
    "view": {
      "configuration": valueOf(sos:products:joc_cockpit:order:view:configuration),
      "orderLog": valueOf(sos:products:joc_cockpit:order:view:order_log),
      "status": valueOf(sos:products:joc_cockpit:order:view:status)
    },
    "change": {
      "startAndEndNode": valueOf(sos:products:joc_cockpit:order:change:start_and_end_node),
      "timeForAdhocOrder": valueOf(sos:products:joc_cockpit:order:change:time_for_adhoc_orders),
      "parameter": valueOf(sos:products:joc_cockpit:order:change:parameter)
    },
    "start": valueOf(sos:products:joc_cockpit:order:start),
    "update": valueOf(sos:products:joc_cockpit:order:update),
    "suspend": valueOf(sos:products:joc_cockpit:order:suspend),
    "resume": valueOf(sos:products:joc_cockpit:order:resume),
    "delete": {
      "temporary": valueOf(sos:products:joc_cockpit:order:delete:temporary)
      "permanent": valueOf(sos:products:joc_cockpit:order:delete:permanent)
      }
    },
    "removeSetback": valueOf(sos:products:joc_cockpit:order:remove_setback)
  },
  "JobChain": {
    "view": {
      "configuration": valueOf(sos:products:joc_cockpit:job_chain:view:configuration),
      "history": valueOf(sos:products:joc_cockpit:job_chain:view:history),
      "status": valueOf(sos:products:joc_cockpit:job_chain:view:status)
    },
    "stop": valueOf(sos:products:joc_cockpit:job_chain:stop),
    "unstop": valueOf(sos:products:joc_cockpit:job_chain:unstop),
    "addOrder": valueOf(sos:products:joc_cockpit:job_chain:add_order),
    "skipJobChainNode": valueOf(sos:products:joc_cockpit:job_chain:skip_jobchain_node),
    "unskipJobChainNode": valueOf(sos:products:joc_cockpit:job_chain:unskip_jobchain_node),
    "stopJobChainNode": valueOf(sos:products:joc_cockpit:job_chain:stop_jobchain_node),
    "unstopJobChainNode": valueOf(sos:products:joc_cockpit:job_chain:unstop_jobchain_node)
  },
  "Job": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:job:view:status),
      "taskLog": valueOf(sos:products:joc_cockpit:job:view:task_log),
      "configuration": valueOf(sos:products:joc_cockpit:job:view:configuration),
      "history": valueOf(sos:products:joc_cockpit:job:view:history)
    },
    "start": {
      "task": valueOf(sos:products:joc_cockpit:job:start:task),
      "taskImmediately": valueOf(sos:products:joc_cockpit:job:start:task_immediately)
    },
    "stop": valueOf(sos:products:joc_cockpit:job:stop),
    "unstop": valueOf(sos:products:joc_cockpit:job:unstop),
    "terminate": valueOf(sos:products:joc_cockpit:job:terminate),
    "kill": valueOf(sos:products:joc_cockpit:job:kill)
  },
  "ProcessClass": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:process_class:view:status),
      "configuration": valueOf(sos:products:joc_cockpit:process_class:view:configuration)
    }
  },
  "Schedule": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:schedule:view:status),
      "configuration": valueOf(sos:products:joc_cockpit:schedule:view:configuration)
    },
    "edit": valueOf(sos:products:joc_cockpit:schedule:edit),
    "addSubstitute": valueOf(sos:products:joc_cockpit:schedule:add_substitute)
  },
  "Lock": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:lock:view:status),
      "configuration": valueOf(sos:products:joc_cockpit:lock:view:configuration)
    }
  },
  "Event": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:event:view:status)
    },
    "delete": valueOf(sos:products:joc_cockpit:event:delete)
  },
  "EventAction": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:event_action:view:status)
    },
    "createEventsManually": valueOf(sos:products:joc_cockpit:event_action:create_event_manually)
  },
  "HolidayCalendar": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:holiday_calendar:view:status)
    }
  },
  "MaintenanceWindow": {
    "view": {
      "status": valueOf(sos:products:joc_cockpit:maintenance_window:view:status)
    },
    "enableDisableMaintenanceWindow": valueOf(sos:products:joc_cockpit:maintenance_window:enable_disable_mainenance_window)
  },
  "SOSPermissionRoles": {
    "SOSPermissionRole": [
      "application_manager"
    ]
  }
}

References

JobScheduler REST Web Services

Space shortcuts

Page tree