1 karl  1.1.2.2 // Copyright (c) 2008 DMTF.  All rights reserved.
  2                  [Version ( "2.20.0" ), 
  3                   UMLPackagePath ( "CIM::User::Privilege" ), 
  4                   Description ( 
  5                      "Privilege is the base class for all types of activities which "
  6                      "are granted or denied by a Role or an Identity. Whether an "
  7                      "individual Privilege is granted or denied is defined using the "
  8                      "PrivilegeGranted boolean. Any Privileges not specifically "
  9                      "granted are assumed to be denied. An explicit deny (Privilege "
 10                      "Granted = FALSE) takes precedence over any granted Privileges. \n"
 11                      "\n"
 12                      "The association of subjects (Roles and Identities) to "
 13                      "Privileges is accomplished using policy or explicitly via the "
 14                      "associations on a subclass. The entities that are protected "
 15                      "(targets) can be similarly defined. \n"
 16                      "\n"
 17                      "Note that Privileges may be inherited through hierarchical "
 18                      "Roles, or may overlap. For example, a Privilege denying any "
 19                      "instance Writes in a particular CIM Server Namespace would "
 20                      "overlap with a Privilege defining specific access rights at an "
 21                      "instance level within that Namespace. In this example, the "
 22 karl  1.1.2.2        "AuthorizedSubjects are either Identities or Roles, and the "
 23                      "AuthorizedTargets are a Namespace in the former case, and a "
 24                      "particular instance in the latter." )]
 25               class CIM_Privilege : CIM_ManagedElement {
 26               
 27                     [Key, Override ( "InstanceID" ), 
 28                      Description ( 
 29                         "Within the scope of the instantiating Namespace, "
 30                         "InstanceID opaquely and uniquely identifies an instance "
 31                         "of this class. In order to ensure uniqueness within the "
 32                         "NameSpace, the value of InstanceID SHOULD be constructed "
 33                         "using the following \'preferred\' algorithm: \n"
 34                         "<OrgID>:<LocalID> \n"
 35                         "Where <OrgID> and <LocalID> are separated by a colon "
 36                         "\':\', and where <OrgID> MUST include a copyrighted, "
 37                         "trademarked or otherwise unique name that is owned by "
 38                         "the business entity creating/defining the InstanceID, or "
 39                         "is a registered ID that is assigned to the business "
 40                         "entity by a recognized global authority. (This is "
 41                         "similar to the <Schema Name>_<Class Name> structure of "
 42                         "Schema class names.) In addition, to ensure uniqueness "
 43 karl  1.1.2.2           "<OrgID> MUST NOT contain a colon (\':\'). When using "
 44                         "this algorithm, the first colon to appear in InstanceID "
 45                         "MUST appear between <OrgID> and <LocalID>. \n"
 46                         "<LocalID> is chosen by the business entity and SHOULD "
 47                         "not be re-used to identify different underlying "
 48                         "(real-world) elements. If the above \'preferred\' "
 49                         "algorithm is not used, the defining entity MUST assure "
 50                         "that the resultant InstanceID is not re-used across any "
 51                         "InstanceIDs produced by this or other providers for this "
 52                         "instance\'s NameSpace. For DMTF defined instances, the "
 53                         "\'preferred\' algorithm MUST be used with the <OrgID> "
 54                         "set to \'CIM\'." )]
 55                  string InstanceID;
 56               
 57                     [Description ( 
 58                         "Boolean indicating whether the Privilege is granted "
 59                         "(TRUE) or denied (FALSE). The default is to grant "
 60                         "permission." )]
 61                  boolean PrivilegeGranted = true;
 62               
 63                     [Description ( 
 64 karl  1.1.2.2           "An enumeration indicating the activities that are "
 65                         "granted or denied. These activities apply to all "
 66                         "entities specified in the ActivityQualifiers array. The "
 67                         "values in the enumeration are straightforward except for "
 68                         "one, 4=\"Detect\". This value indicates that the "
 69                         "existence or presence of an entity may be determined, "
 70                         "but not necessarily specific data (which requires the "
 71                         "Read privilege to be true). This activity is exemplified "
 72                         "by \'hidden files\'- if you list the contents of a "
 73                         "directory, you will not see hidden files. However, if "
 74                         "you know a specific file name, or know how to expose "
 75                         "hidden files, then they can be \'detected\'. Another "
 76                         "example is the ability to define search privileges in "
 77                         "directory implementations." ), 
 78                      ValueMap { "1", "2", "3", "4", "5", "6", "7", "..", "16000.." }, 
 79                      Values { "Other", "Create", "Delete", "Detect", "Read", 
 80                         "Write", "Execute", "DMTF Reserved", "Vendor Reserved" }, 
 81                      ArrayType ( "Indexed" ), 
 82                      ModelCorrespondence { "CIM_Privilege.ActivityQualifiers" }]
 83                  uint16 Activities[];
 84               
 85 karl  1.1.2.2       [Description ( 
 86                         "The ActivityQualifiers property is an array of string "
 87                         "values used to further qualify and specify the "
 88                         "privileges granted or denied. For example, it is used to "
 89                         "specify a set of files for which \'Read\'/\'Write\' "
 90                         "access is permitted or denied. Or, it defines a class\' "
 91                         "methods that may be \'Executed\'. Details on the "
 92                         "semantics of the individual entries in "
 93                         "ActivityQualifiers are provided by corresponding entries "
 94                         "in the QualifierFormats array." ), 
 95                      ArrayType ( "Indexed" ), 
 96                      ModelCorrespondence { "CIM_Privilege.Activities", 
 97                         "CIM_Privilege.QualifierFormats" }]
 98                  string ActivityQualifiers[];
 99               
100                     [Description ( 
101                         "Defines the semantics of corresponding entries in the "
102                         "ActivityQualifiers array. An example of each of these "
103                         "\'formats\' and their use follows: \n"
104                         "- 2=Class Name. Example: If the authorization target is "
105                         "a CIM Service or a Namespace, then the "
106 karl  1.1.2.2           "ActivityQualifiers entries can define a list of classes "
107                         "that the authorized subject is able to create or delete. \n"
108                         "- 3=<Class.>Property. Example: If the authorization "
109                         "target is a CIM Service, Namespace or Collection of "
110                         "instances, then the ActivityQualifiers entries can "
111                         "define the class properties that may or may not be "
112                         "accessed. In this case, the class names are specified "
113                         "with the property names to avoid ambiguity - since a CIM "
114                         "Service, Namespace or Collection could manage multiple "
115                         "classes. On the other hand, if the authorization target "
116                         "is an individual instance, then there is no possible "
117                         "ambiguity and the class name may be omitted. To specify "
118                         "ALL properties, the wildcard string \"*\" should be "
119                         "used. \n"
120                         "- 4=<Class.>Method. This example is very similar to the "
121                         "Property one, above. And, as above, the string \"*\" may "
122                         "be specified to select ALL methods. \n"
123                         "- 5=Object Reference. Example: If the authorization "
124                         "target is a CIM Service or Namespace, then the "
125                         "ActivityQualifiers entries can define a list of object "
126                         "references (as strings) that the authorized subject can "
127 karl  1.1.2.2           "access. \n"
128                         "- 6=Namespace. Example: If the authorization target is a "
129                         "CIM Service, then the ActivityQualifiers entries can "
130                         "define a list of Namespaces that the authorized subject "
131                         "is able to access. \n"
132                         "- 7=URL. Example: An authorization target may not be "
133                         "defined, but a Privilege could be used to deny access to "
134                         "specific URLs by individual Identities or for specific "
135                         "Roles, such as the \'under 17\' Role. \n"
136                         "- 8=Directory/File Name. Example: If the authorization "
137                         "target is a FileSystem, then the ActivityQualifiers "
138                         "entries can define a list of directories and files whose "
139                         "access is protected. \n"
140                         "- 9=Command Line Instruction. Example: If the "
141                         "authorization target is a ComputerSystem or Service, "
142                         "then the ActivityQualifiers entries can define a list of "
143                         "command line instructions that may or may not be "
144                         "\'Executed\' by the authorized subjects. \n"
145                         "- 10=SCSI Command, using a format of \'CDB=xx[,Page=pp]\'. "
146                         "For example, the ability to select the VPD page of the "
147                         "Inquiry command is encoded as \'CDB=12,Page=83\' in the "
148 karl  1.1.2.2           "corresponding ActivityQualifiers entry. A \'*\' may be "
149                         "used to indicate all CDBs or Page numbers. \n"
150                         "- 11=Packets. Example: The transmission of packets is "
151                         "permitted or denied by the Privilege for the target (a "
152                         "ComputerSystem, ProtocolEndpoint, Pipe, or other "
153                         "ManagedSystemElement)." ), 
154                      ValueMap { "2", "3", "4", "5", "6", "7", "8", "9", "10", 
155                         "11", "..", "16000.." }, 
156                      Values { "Class Name", "<Class.>Property", "<Class.>Method", 
157                         "Object Reference", "Namespace", "URL", 
158                         "Directory/File Name", "Command Line Instruction", 
159                         "SCSI Command", "Packets", "DMTF Reserved", 
160                         "Vendor Reserved" }, 
161                      ArrayType ( "Indexed" ), 
162                      ModelCorrespondence { "CIM_Privilege.ActivityQualifiers" }]
163                  uint16 QualifierFormats[];
164               
165                     [Description ( 
166                         "The RepresentsAuthorizationRights flag indicates whether "
167                         "the rights defined by this instance should be "
168                         "interpreted as rights of Subjects to access Targets or "
169 karl  1.1.2.2           "as rights of Subjects to change those rights on/for "
170                         "Targets." )]
171                  boolean RepresentsAuthorizationRights = false;
172               
173               
174               };