Storage of operator security attributes
For the system of record, security attributes can be stored and maintained internally or externally to Pega Platform. You can access the operator security attributes that are used in policy conditions in several ways.
- If attributes are stored internally, then it is likely that they are stored in the operator record or a new data class, which makes them already accessible to policy conditions.
- If the attributes are stored externally, then these attributes need to be retrieved during login and stored somewhere in Pega Platform where policy conditions can access them.
Custom authentication allows the policy conditions to access the attributes. Depending on their requirements, users can choose to use the custom authentication activity or the Mapping tab on the Authentication Service form, or they can use both options. For example, mapping can be used to copy data stored in an LDAP directory directly in properties in the Data-Admin-Operator-ID class. If mapping is more complex, then an activity can be used to retrieve the attributes from the external location and copy them to a location within the application created in Pega Platform (for example, a requestor-scoped data page).
- Attribute-based access control
You can restrict the ability of a user to view, modify, and delete instances of classes, or properties within classes. Use attribute-based access control (ABAC) to enforce row-level and column-level security in your application.
- Security attributes markings
Attributes are unique security markings, which are assigned to objects and operators. Each attribute has a value associated with it, which means that a user must possess an attribute value to access an object.