Stanford Authorization Existing mainframe based authority –homegrown, in operation since the 80’s –primarily for financial and personnel authority for tightly coupled mainframe systems - what, by whom, how much Moving toward distributed systems and need a more general authority model, including services as well as applications Kerberos authentication infrastructure

Directory based authority Privilege groups are stored in the LDAP based directory for access by services and applications Initial groups were –Stanford Community (sw licensing, etc) –Academic (sw licensing) –Leland full (eligible for all distributed services) –Leland base (authentication only)

Directory based Authority Adding additional privilege groups –Faculty \ –Student > (finer grain service authority) –Staff / –Others specific to Core Fin requirements Services and applications do directory lookup based on Kerberos principle Groups currently apply to person, not account

Distributed Financial Authority Oracle Core Financials application needed rules based authority Two types of authority - transaction and approval Currently implemented only on the user level, not group

Reports Applications Signature Authority Transaction Authority Approver List Maintenance Forms Rules Data Structure Authority Engine - General rules - User rules Report Views Validate Authority Function Validate Transaction Authority F. Approver List Function Reports Function

Authority Engine Authority rules –general rules (restrictions on process) –user rules (restrictions on actions) Transaction metadata –transactions –objects –object attributes

Example Object is purchase requisition line item. Transaction is purchase requisition. Object attributes are item, purchase requisition line ID, amount. User is Joe Smith. User transactions shows that Joe Smith has access to purchase requisitions. Authority entity shows that Joe Smith has access to view purchase requisitions. Constraints entity further restricts this privilege by representing the cost centers that Joe Smith can access.

Rules Maintenance App. Maintain metadata through 10SC app. –data about users –delegation of authority –reports Web screen for delegation Reports Initial metadata loaded from mainframe

Transaction routing Custom web-based application Provides information to originator for routing of transaction from information in rules engine

Future Authority engine developed to meet Core Financials requirements only How can it be applied to the general case for future applications? More capabilities in directory based authority?