Security Area Support Use Cases › Use Cases: Asset Groups › Use Case: Add a Computer to an Asset Group

Use Case: Add a Computer to an Asset Group

Scenario:

A user wants to add a computer to the group where the user is member of only one security profile.

Pre-Conditions:

• The asset group exists.
• The computer exists.

Action:

The user adds a computer to a group; inheritance is enabled for the group.

Post-Conditions:

• The computer is linked to the group.
• If it is not an inheritance group, then nothing is done. If it is an inheritance group, then the object_ace is calculated based on the object_ace of the parent group.
• The area-code is set as follows:
  • If the computer is only a member of only one asset group, the area_ace is the same as the area_ace of the asset group.
  • If the computer is a member of multiple asset groups, the area_aces of the parent groups are OR'ed and assigned to the secured object.

Variants:

If the area permission of the computer is set to creation_user level or global default level before adding to the group, then the area permission is set to the area permissions of the group.

If the area permission of the computer is set to object_level before adding to the group, then the area permissions are not set to group level. The user must use the REVERT function to re-calculate the area permissions to conform to the group.

Area permissions must not change if a permission inheritance is disabled.

Note: The same is valid in case of a dynamic group and the engine doing the group evaluation. In this case the engine links the member to the group.