Page Comparison

The Austin Active Directory schema has been extended with the utexasEduAustinAuxClass and utexasEduAzureAuxClass auxiliary classes. These auxiliary classes add additional attributes to existing classes and allow additional information to be stored on objects in the Austin Active Directory. The attribute permission groups need to address multiple items:

1. Must use "ControlAccess" due to confidential attributes
2. The standard No Access vs. Read vs. Write
3. The ability to address record restrictions for future directory services work

Current proposal is AUSTINenable granular access to the attributes with easy-to-read group names.

Permission Group Naming Convention

Each attribute permission group follows the [auxiliary-class-type]-[short-object-type]-[short-attribute-name]-[permission-codelabel]. The "short object type" is the shortened string of the AD object class pattern. The pattern is comprised of the following components:

• [auxiliary-class-type] - AUSTIN for attributes in the utexasEduAustinAuxClass and AZURE for attributes in the utexasEduAzureAuxClass 

• [short-object-type] -  the shortened name of the object that the attribute permission group applies to (ex. User,

...

• Group, Computer,

...

• A - Access - User is allowed to read the attribute but can be blocked by record restrictions
• B - Bypass - User is allowed to read the attribute regardless of record restrictions
• C - Change - User is allowed to read and write the attribute

...

• OU)

• [short-attribute-name] - the shortened name of the attribute that the attribute permission group applies to (ex. Single1, Multi2, Bool3, Time4)

• [permission-label] - the permission label for the permissions granted to the attribute permission group (see below)

Permission Labels

Example attribute permission groups

The current permission codes would result in the following example attribute permission groups:

• AUSTIN-User-Single11-

  A

  Read - the members are allowed to read the utexasEduAustinSingle11 attribute on users

• AUSTIN-OU-Multi12-

  C

  Write - the members are allowed to read and write the utexasEduAustinMulti12 attribute on OUs

...