Front cover - IBM Redbooks

564 Lotus Security Handbook
external control. See the WebSphere Portal Server product documentation and
Help files for detailed instructions on using this portlet.
Note: When giving a user permission to deploy portlets, ensure that the user
is also in the WebSphere Application Server Administrative Role. It is possible
to add the user to a group that is in the Administrative Role, or it is possible to
add the user to this role under Security Center in the Administration Console
for Application Server.
Access rights
There are five simple permissions that can be assigned to resources. One of
these, DELEGATE, is the permission that permits an authorized person to
change access controls. The others are: VIEW, EDIT, MANAGE, and CREATE.
For more complete information about these permissions, and for examples of
how each permission limits control to a resource, see the WebSphere
Application Server documentation. Some particularly important access rights
topics are covered here.
DELEGATE permissions
DELEGATE permission is required for an administrator or subadministrator. A
user, or group of users, with DELEGATE permission for a resource, such as a
portlet or place, can grant users permission for that resource. Users may only
grant the same level or a lower of permission (VIEW, EDIT, MANAGE, CREATE)
for a resource that they themselves have for that resource. DELEGATE
permission does not imply other access rights. Users with DELEGATE cannot
assign a permission higher than they hold. For example, if Sandy has EDIT and
DELEGATE on the Financial page and DELEGATE on the user group of which
Fred is a member, then Sandy can assign VIEW or EDIT permissions for the
Financial page to Fred or any other user in the same group as Fred. However,
Sandy cannot assign MANAGE for that page because Sandy herself does not
have MANAGE permission for that page.
Access levels
Newly created resources have a very specific initial access control state. Only
the user who created the resource has any permissions for that resource.
Likewise, the creator always has MANAGE and DELEGATE permissions for the
new resource. If the creator also has access to the Access Control List portlet,
that user can then grant other users access to that portlet within the restrictions
discussed in the previous section. Portal administrators can also see the new
resource and, if necessary, can grant themselves permissions which then allow
them to share that resource with other users. Users must have the appropriate
active or current minimum permission to access a resource. Active permissions
can be inherited from the groups to which a user or user group belongs. Current