Administering access control list entries

Edit online

You must create an ACL object before you can administer ACL entries for the object.

To create an ACL object, see ivadmin_acl_create().

The administration API can be used to specify entries for each of the following ACL entry types:

  • Users
  • Groups
  • User any-other (also known as any-authenticated)
  • User unauthenticated

The type any-other applies to any user that already is authenticated into the Verify Identity Access secure domain but that does not have a separate entry in the ACL. The type unauthenticated applies to all user identities that are unknown to Verify Identity Access. Unknown users cannot authenticate in the Verify Identity Access secure domain.

PDAclEntryUser
An ACL entry that applies to a particular user.
PDAclEntryGroup
An ACL entry that applies to all members of a particular group.
PDAclEntryAnyOther
The ACL entry that applies to any other authenticated users. Any user that is already authenticated into the Verify Identity Access secure domain, but is not covered by a separate user or group entry in the access control list, is allowed the permissions that are specified by this ACL entry.
PDAclEntryUnAuth
The ACL entry that applies to unauthenticated users. Any user that is not already authenticated is allowed the permissions that are specified by this ACL entry.

Be sure that you understand ACL entry syntax, ACL entry types, ACL ID attributes, and ACL permission (action) attributes before you use the administration API functionsmethods in this section.

Verify Identity Access supports 18 default actions. For a list of the default Verify Identity Access actions, see the section about default Verify Identity Access permissions for actions in the IBM Verify Identity Access for Web: Administration Guide.

For more information, see the section about ACL entry syntax in the IBM Verify Identity Access for Web: Administration Guide.

Table 1 lists the methods for administering ACL entries.

Table 1. Administering access control list entries
FunctionsMethods Description
ivadmin_acl_getanyother()PDAcl object.getPDAclEntryAnyOther Returns the actions that are defined in the entry for the user type any-other in the specified ACL.Returns the PDAclEntryAnyOther object that is associated with the ACL.
ivadmin_acl_getunauth()PDAcl object.getPDAclEntryUnAuth Returns the actions (permissions) defined in the entry for the user type unauthenticated in the specified ACL.Returns the PDAclEntryUnAuth object that is associated with the ACL.
ivadmin_acl_getuser()PDAcl object.getPDAclEntriesUser Returns the actions (permissions) defined in the entry for the specified user in the specified ACL.Returns a Java™ HashMap of the PDAclEntryUser objects that are associated with the ACL.
ivadmin_acl_setuser()PDAcl object.getPDAclEntriesGroup Returns the actions (permissions) defined in the entry for the specified group in the specified ACL.Returns a Java HashMap of the PDAclEntryGroup objects that are associated with the ACL.
ivadmin_acl_removeanyother()

PDAcl.removePDAclEntryAnyOther
PDAcl object.removePDAclEntryAnyOther

 Removes the ACL entry for the any-other user from the specified ACL.
ivadmin_acl_removegroup()

PDAcl.removePDAclEntryGroup
PDAcl object.removePDAclEntryGroup

 Removes the ACL entry for the specified group from the specified ACL.
ivadmin_acl_removeunauth()

PDAcl.removePDAclEntryUnAuth
PDAcl object.removePDAclEntryUnAuth

 Removes the ACL entry for the unauthenticated user from the specified ACL.
ivadmin_acl_removeuser()

PDAcl.removePDAclEntryUser
PDAcl object.removePDAclEntryUser

 Removes the ACL entry for the specified user from the specified ACL.
ivadmin_acl_setanyother()

PDAcl.setPDAclEntryAnyOther
PDAcl object.setPDAclEntryAnyOther

 Sets or modifies the ACL entry for the any-other user in the ACL.

Call this function to specify permissions for all authenticated users who do not have a separate user or group entry in the specified ACL.
ivadmin_acl_setgroup()

PDAcl.setPDAclEntryGroup
PDAcl object.setPDAclEntryGroup

 Sets or modifies the ACL entry for the specified group in the specified ACL.
ivadmin_acl_setunauth()

PDAcl.setPDAclEntryUnAuth
PDAcl object.setPDAclEntryUnAuth

 Sets the ACL entry for the unauthenticated user in the specified ACL.

Call this function to specify permissions for those users that are not already authenticated.
ivadmin_acl_setuser()

PDAcl.setPDAclEntryUser
PDAcl object.setPDAclEntryUser

 Sets the entry for the specified user in the specified ACL. Use this function to specify the actions that a user is permitted to perform.

For detailed reference information about these methods, see the Javadoc HTML documentation.