You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently people search allows to use the logged in users rights or the proxy user. For the public people search the proxy user is used - this is suboptimal as the proxy user should have rights to attributes and even read to passwords in the password policy and write to certain attributes.
Now if one wants to show only a restricted set of attributes in the public people search and show more based on the logged in user, the rights for the main proxy user get complicated and easily errors happen.
Our usecase for a separate public prople search proxy would be:
simple rights for PWM proxy user
rights to 'public' attributes for "people search proxy user" (e.g. Name, First Name, Mail, Phone, Mobile, Title, etc.)
rights (using groups) to certain users (e.g. managers) to see further attributes (e.g. HomePhone, Private Mobile, Private address, etc).
In such a setup it would be clear where the rights are coming from for the public people search and there is less risk that an admin changes the PWM proxy users rights and too much information is shown in the public pages.
The text was updated successfully, but these errors were encountered:
Currently people search allows to use the logged in users rights or the proxy user. For the public people search the proxy user is used - this is suboptimal as the proxy user should have rights to attributes and even read to passwords in the password policy and write to certain attributes.
Now if one wants to show only a restricted set of attributes in the public people search and show more based on the logged in user, the rights for the main proxy user get complicated and easily errors happen.
Our usecase for a separate public prople search proxy would be:
In such a setup it would be clear where the rights are coming from for the public people search and there is less risk that an admin changes the PWM proxy users rights and too much information is shown in the public pages.
The text was updated successfully, but these errors were encountered: