Standard policies are created in the context of a single policy domain. Large production environments can contain thousands of domains. For these environments, it can be useful to define types of behavior (represented by policies) that are common for many domains. Using standard policies, the same policy must be recreated for each domain that requires the same behavior. The global policies allow you to configure policies (and their associated rules and responses) as system level objects, that are applied across all domains.
The following terms are used for discussing global policies:
An access rule allows or denies access to a resource. The global policies do not include access rules. Only event rules are added to global policies.
An event rule is invoked when an authentication or authorization event occurs. Behaviors that are commonly implemented across all domains are associated with event rules, and can be included in global policies.
A policy which is defined as a system object.
A rule which is defined as a system object.
A response which is defined as a system object.
A logical entity that is used for policy definition. This entity consists of a rule- response pair. A policy can contain one or more policy links.
The following sections discuss the characteristics of global policy objects, outlining the basic similarities and differences when compared to their standard (nonglobal) counterparts.
Differences:
Similarities:
Differences:
Differences:
Note: Any Individual domains can be explicitly enabled or disabled for global policy processing.
Similarities:
When the global policy is processing, the responses that are defined for the fired global rules are added to the list of other responses. A global rule fires when the following conditions are true:
Important! Standard policies take precedence over global policies when the following conditions are met:
The product uses a policy-based access control model. A policy defines the type of access a user has to a particular resource and what happens when the user accesses the resource. Each standard policy is a linkage between a set of users and a set of resources. Policies are designed to protect resources by binding together users, rules, and responses. Every policy must specify the users or groups of users to which the policy applies. Users can be either included or excluded from the policy.
A standard policy must contain at least one rule or rule group. Rules determine which resources are protected the type of action that causes a rule to fire. A rule identifies a resource or resources that are included in the policy using a combination of a string-based resource filter and action. The filter in turn consists of realm filter and rule filter.
Policy objects can be of two types: system level and domain level. In a standard (non‑global) policy, all policy objects must be created in the context of a specific domain. However, global policies are system level policies that can apply across all domains in a product deployment. An administrator with system level privileges can define global policies, that include global rules and global responses. These global policies can be applied to any resource in any domain.
The global objects are similar to their standard, domain-specific counterparts. The roles of global objects in a global policy definition are different from domain-specific policy objects. However, there are no global domain or global realm objects.
Any global rules that are contained in global policies fire when the following conditions are met:
Whenever an authentication or an authorization event happens, the defined responses for the fired global rules are added to the list of other responses.
|
Copyright © 2014 CA.
All rights reserved.
|
|