Fusion Security Manager (FR V11) - Revision history

Vmurrell at 10:25, 6 October 2025

2025-10-06T10:25:01Z

Vmurrell: /* Security Groups */

2024-11-04T11:04:54Z

‎Security Groups

Plazarou: /* Security Groups */

2023-10-03T10:17:43Z

‎Security Groups

Plazarou: /* Read Rules */

2023-08-24T13:39:18Z

‎Read Rules

Plazarou: /* Read Rules */

2023-08-24T13:38:27Z

‎Read Rules

Vmurrell: Vmurrell moved page Fusion Registry 11 Security to Fusion Security Manager (FR V11): title too vague

2023-08-16T14:12:32Z

Vmurrell moved page Fusion Registry 11 Security to Fusion Security Manager (FR V11): title too vague

Vmurrell at 14:06, 16 August 2023

2023-08-16T14:06:01Z

Vmurrell: /* Rule Behaviour */

2023-05-31T16:00:46Z

‎Rule Behaviour

Mnelson: /* Datapoint Read Rules */

2023-02-08T11:52:29Z

‎Datapoint Read Rules

Mnelson: /* Dataset Write Rules */

2023-02-08T11:52:06Z

‎Dataset Write Rules

← Older revision		Revision as of 10:25, 6 October 2025
Line 1:		Line 1:
	[[Category:Fusion Security Manager]]		[[Category:Fusion Security Manager]]
−	~~[[Category:RegistrySecurity]]~~

	= Overview =		= Overview =

@@ Line 37: / Line 37: @@
 | Public || Allow G1 || The user can not see the resource as they do not belong to the Group which is allowed to see the resource
 |-
-| Public, G1 || Allow G1, Deny Public || The can see the resource as belong to the Group G1 which is allowed to see the resource
+| Public, G1 || Allow G1, Deny Public || The user can see the resource as belong to the Group G1 which is allowed to see the resource
 |}

@@ Line 12: / Line 12: @@
 = Security Groups =
-The Fusion Security Manager enables Groups to be defined.  Fusion Registry no longer supports assigning users to Groups, instead it will get the Group information from the Authentication service, for example Active Directory supports assigning Groups to users, and the Fusion Registry will map any Group that the AD User belongs to, with it's own Groups.  In short, if the AD Group ID matches a Group ID in the Fusion Security Manager, then the Fusion Registry user assumes that Group.  The user can be long to one or more Groups.
+The Fusion Security Manager enables Groups to be defined.  Fusion Registry no longer supports assigning users to Groups, instead it will get the Group information from the Authentication service, for example Active Directory supports assigning Groups to users, and the Fusion Registry will map any Group that the AD User belongs to, with it's own Groups.  In short, if the AD Group ID matches a Group ID in the Fusion Security Manager, then the Fusion Registry user assumes that Group.  The user can belong to one or more Groups.
 By default there is a Group called 'Public'.  This Group can not be deleted, and all users belong to the Public Group, even if they are not logged into the system.  The Public Group provides a mechanism for granting unrestricted access to resources.

@@ Line 72: / Line 72: @@
   TODO
-Example #1:
+==== Example #1: ====
-* Allow public visibility of all structural metadata except for one particular agency ("ACY1")
+Allow public visibility of all structural metadata except for one particular agency ("ACY1")
 In Fusion Security Manager, under "Structure Read" set up 2 rules:
 # Structure Type: Any, Agency: *, ID: *, Version: *, Groups: PUBLIC
 == Write Rules ==

@@ Line 70: / Line 70: @@
 = Structure Security =
 == Read Rules ==
   TODO
 == Write Rules ==

← Older revision	Revision as of 14:12, 16 August 2023
(No difference)

← Older revision		Revision as of 14:06, 16 August 2023
Line 1:		Line 1:
		+	[[Category:Fusion Security Manager]]
	[[Category:RegistrySecurity]]		[[Category:RegistrySecurity]]

← Older revision		Revision as of 16:00, 31 May 2023
Line 141:		Line 141:
	=== Rule Behaviour ===		=== Rule Behaviour ===
	When writing the Dataset to the user, if the Series Attribute or Observation Attribute matches the rule, and the user does not have permission to read it, the Attribute will not be included in the output dataset.		When writing the Dataset to the user, if the Series Attribute or Observation Attribute matches the rule, and the user does not have permission to read it, the Attribute will not be included in the output dataset.
		+
		+	== Fusion Data Browser ==
		+	In order to use Fusion Data Browser (FDB) you '''must''' configure Fusion Security Manager appropriately otherwise even users logging on to FDB as the Root user will not be able to see any data in Fusion Data Browser.

@@ Line 111: / Line 111: @@
 '''Note:''' A user who has Dataset Write access does not automatically get Dataset Read access, the two access types are separate and have to be managed as separate rules.
-== Datapoint Read Rules ==
+== Data Point Read Rules ==
 === Rule Description ===
 [[File:Datapoint Read Rule.png|thumb|Datapoint Read Rule denying access to OBS_CONF=C]]
@@ Line 118: / Line 118: @@
 === Rule Information ===
-The Datapoint Read Rule requires the Component ID (this refers to either the Attribute ID or Dimension ID) and the Component Value (the reported value to Deny or Allow access to).  An example of a restriction is: Component ID=OBS_CONF, Component Value=C. This rule would match any Series or Observation which is reporting OBS_CONF="C".
+The Data Point Read Rule requires the Component ID (this refers to either the Attribute ID or Dimension ID) and the Component Value (the reported value to Deny or Allow access to).  An example of a restriction is: Component ID=OBS_CONF, Component Value=C. This rule would match any Series or Observation which is reporting OBS_CONF="C".
 Other optional values on this rule are the Dataflow Agency, Id, and Version which this rule is applicable for.  If the rule is applicable for all Dataflows, these values do not need to be reported.  The Agency, Id, and Version act as a filter on Dataflows, for example it is possible to just fill in the Agency ID, which would ensure the rule was only applicable for data reported against Dataflows whose Agency matches the value defined in the rule.

@@ Line 107: / Line 107: @@
 == Dataset Write Rules ==
-TODO
+See the description for Dataset Read Rule.  The dataset write rule follows the same behaviour, but is applicable when authorising a data publication, as opposed to a data read.
 == Datapoint Read Rules ==