Library Browser › Working with Objects and Folders › Edit an Object › Determine When to Select Run as Owner

Determine When to Select Run as Owner

CA Process Automation provides fine-grained access control to operations on specific automation objects such as processes, datasets, and schedules. Access control includes not only traditional read and write rights but also rights to start a process and monitor its instances. Access to other objects such as child processes, datasets, or calendars is also controlled. The access rights are enforced at all external interfaces, including the UIs and Web Services.

Consider the following example with these assumptions:

• Process P1 has a child process P2.
• Owner X owns P1 and P2.
• P1 requires access to other elements that Owner X does not want to expose directly to other users.
• The default access is that a process runs as the user who starts the process.

If User A starts a P1 instance, P1 can start P2 only if User A is authorized to start P2 directly. To protect automation objects from exposure, Owner X can require process P1 (or any of its child processes or operators) to run as owner, that is, to run under the identity of Owner X. When Owner X configures a process to Run as Owner, owner X is authorizing other users to run process P1 without granting them access to the elements P1 needs.

Similarly, Owner X can force operators to run under the identity of the user who started the process instance. Although process P1 is configured to Run as Owner, Owner X can force the child process P2 to run under the identity of the user who directly or indirectly starts process P1. In this case, CA Process Automation uses the identity of the originating user to validate access to child process P2.

Consider this scenario: A DBA user creates a database administration process that requires externalizing the DBA credentials to a named Dataset. The DBA configures this process to run as the owner. Run as Owner grants instances of the process access to the dataset that stores the DBA credentials. The DBA authorizes selected users to execute a specific DBA process, without granting these users direct access to the DBA credentials.

In summary, a running process instance has two related identities:

• The real user who starts the process instance from the UI, an agenda, or a web service.
• The effective user who is determined by how Run as Owner is applied to process definitions and operators in those processes.

  Note: The identity of the current, effective user is used to validate access to child processes, operators, and datasets.

More information:

Guidelines for Setting Runtime Security for a Process