RTC: credentials running extensions
I wonder under which credentials are RTC plugins/extensions run.
I mean: if user X (who can or cannot do several operations according to his roles) executes an action and that action triggers a RTC extension, are the operations executed by the extension subject to the role-based limitations? A concrete example: suppose that user X cannot edit attribute A on a work item (because his roles forbid him to do); if the extension triggered by user X tries to update attribute A, will it succeed? I suppose that, if the extension runs with the "current user" credentials it will fail; if, instead, it runs under generic "jazz administrator" (i.e. super user) credentials, it will succeed. I made some tests, and it seems that they run as "current user", but I need a confirmation. My RTC version is 4.0.6 |
Accepted answer
Ralph Schoon (63.5k●3●36●46)
| answered Nov 06 '14, 6:31 a.m.
FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER
Participants/follow up actions, advisors and providers always run with the credentials of the user doing the operation. This has been discussed here several times already actually.
And it is not possible to cheat and gain root permissions. This would breach all security and is not possible. Luca Martinucci selected this answer as the correct answer
|
One other answer
Your answer
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.