Authorization Manager

Authorization Manager provides a flexible framework for integrating role-based access control into applications. It enables administrators who use those applications to provide access through assigned user roles that relate to job functions.

Authorization Manager applications store authorization policy in the form of authorization stores that are stored in Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), XML files, or Microsoft SQL Server databases. These polices are then applied at run time.

  • Overview of Authorization Manager

  • What's New in Authorization Manager

  • Checklist: Before You Start Using Authorization Manager

  • Using and Managing the Authorization Manager Snap-In

  • Managing Authorization Stores

  • Managing Applications and Scopes

  • Managing Groups, Roles, and Tasks

  • Controlling Authorization by Using Authorization Rules and Business Rules

  • Troubleshooting Authorization Manager

  • Resources for Authorization Manager

  • User Interface: Authorization Manager


Overview of Authorization Manager

Role-based access control enables you to assign users to roles and to keep track of what permissions have been given to each role. You can also apply very specific control by using scripts called authorization rules. Authorization rules enable you to control the relationship between access control and the structure of your organization.

Authorization Manager can help provide effective control of access to resources in many situations. Generally, two categories of roles often benefit from role-based administration: user authorization roles and computer configuration roles.

  • User authorization roles are based on a user's job function. You can use authorization roles to authorize access, to delegate administrative privileges, or to manage interaction with computer-based resources. For example, you might define a Treasurer role that includes the right to authorize expenditures and audit account transactions.

  • Computer configuration roles are based on a computer's function. You can use computer configuration roles to select features that you want to install, to enable services, and to select options. For example, computer configuration roles for servers might be defined for Web servers, domain controllers, file servers, and custom server configurations that are appropriate to your organization.

Using developer mode and administrator mode in Authorization Manager

With Authorization Manager, you can use the following two modes:

  • Developer mode. In developer mode, you can create, deploy, and maintain applications. You have unrestricted access to all Authorization Manager features.

  • Administrator mode. This is the default mode. In administrator mode, you can deploy and maintain applications. You have access to all Authorization Manager features, but you cannot create new applications or define operations.

Commonly, Authorization Manager is used by custom applications written for a specific purpose in your environment. These applications usually create, manage, and use an authorization store by calling the Authorization Manager application programming interfaces (APIs). In that case, you do not need to use developer mode. For more information about using Authorization Manager programmatically, see Resources for Authorization Manager.

When you use developer mode, it is recommended that you run Authorization Manager in developer mode only until the authorization store, application, and other necessary objects are created and configured. After you initially set up Authorization Manager, run Authorization Manager in administrator mode. For more information about using developer or administrator mode, see Set Authorization Manager Options.

Comparing Authorization Manager to other management tools

You can use Authorization Manager to implement multiple configuration and permission changes at once. Other management tools available with this version of Windows can also be used to configure access permissions, sometimes in ways comparable to Authorization Manager. These include:

  • Access control lists. Access control lists (ACLs) on the Security properties tab can be used to manage access control policy for objects stored in Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), and Windows objects. Authorization Manager differs from the Security properties tab by letting you base your access control on roles (usually based on particular job tasks), not just on group membership, and by tracking the permissions that have been granted.

  • Delegation of Control Wizard. The Delegation of Control Wizard also sets multiple permissions automatically; however, unlike Authorization Manager, it does not provide a method to track or remove permissions that have been granted.

Additional references

  • Resources for Authorization Manager

  • What's New in Authorization Manager

  • Checklist: Before You Start Using Authorization Manager


What's New in Authorization Manager

In Windows Server 2008, several new features were introduced in Authorization Manager. These include:

  • Authorization Manager stores can be stored in Microsoft SQL Server databases, Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), or XML files. For more information, see Connect to an SQL-based Authorization Store.

  • Support for business rule groups (groups whose membership is determined at run time by a script) is available. For more information, see Create an Application Group within an Authorization Store.

  • Support is available for custom object pickers, so that application administrators can use Authorization Manager for applications that use AD LDS or SQL user accounts. For more information about using a custom object picker, see Choose Users or Groups with a Custom Object Picker.

Many additional improvements and changes were made to Authorization Manager. Some of these are:

  • Improvements were made to the Authorization Manager application programming interface (API), including optimization of common functions and the introduction of simpler, faster versions of commonly used methods, such as AccessCheck.

  • LDAP queries are not limited to only user objects.

  • Additional events are recorded in the log if auditing is active.

  • The use of business rules and authorization rules is controlled by a registry setting. In Windows Server 2008 R2 and Windows Server 2008, rules are disabled by default. In earlier versions of Windows, rules were enabled by default.


Checklist: Before You Start Using Authorization Manager

Before using Authorization Manager, review the following items.

Step References

Review fundamental security concepts.

For more information about security information for developers, see the Security Developer Center (http://go.microsoft.com/fwlink/?LinkId=65843).

For more general security information, see Security Central (http://go.microsoft.com/fwlink/?LinkId=64028).

Read background material about Authorization Manager.
  • Overview of Authorization Manager

  • What's New in Authorization Manager

  • Resources for Authorization Manager

Read about the difference between administrator mode and developer mode in Authorization Manager.

Set Authorization Manager Options

Learn about authorization stores and applications, and about the difference between authorization stores that are stored as XML files, authorization stores that are stored in Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS), and authorization stores that are stored in a Microsoft SQL Server database.

Understanding Authorization Manager Stores

(For developers) Review the latest information about Authorization Manager and authorization-related application programming interfaces (APIs) in the Platform SDK.

For more information, see Authorization (http://go.microsoft.com/fwlink/?LinkId=64031).

Before you can use Authorization Manager for authorization stores that are stored in AD DS, you must raise the domain functional level to Windows Server 2003 or newer.

Raising the domain functional level is an irreversible step.

For more information, see Raise the domain functional level (http://go.microsoft.com/fwlink/?linkid=64029)

Start Authorization Manager.

Start Authorization Manager


Using and Managing the Authorization Manager Snap-In

The Authorization Manager console is a Microsoft Management Console (MMC) snap-in. You can run the Authorization Manager console as a stand-alone console, or add it to any MMC console.

This section contains:

  • Add the Authorization Manager Snap-In to MMC

  • Start Authorization Manager

  • Set Authorization Manager Options

  • Synchronize the Authorization Manager Console


Add the Authorization Manager Snap-In to MMC

The Authorization Manager console is a Microsoft Management Console (MMC) snap-in. You can run the Authorization Manager console as a stand-alone console, or add it to any MMC console.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

Add the Authorization Manager snap-in to MMC

  1. Click Start, type mmc in the Start Search box, and press ENTER.

  2. If the User Account Control dialog box appears, verify the information presented, and then provide the requested permission or credentials.

  3. On the File menu, click Add/Remove Snap-in.

  4. In the Available snap-ins box, click Authorization Manager, and then click Add.

  5. Click OK.

Additional considerations

  • Depending on the configuration of your computer, the User Account Control dialog box may or may not appear. It will not appear if you are logged in with the built-in Administrator account (the local Administrator account is disabled by default in this version of Windows).

  • By default, members of the local Administrators group have sufficient rights and privileges to complete this task. In your environment, security may be managed so that non-administrators have additional rights.

  • If User Account Control is enabled, it can be configured to allow non-administrators to enter the credentials of an administrator to complete administrative tasks without being a member of the Administrators group.

Additional references

  • Start Authorization Manager

  • Set Authorization Manager Options


Start Authorization Manager

Authorization Manager can be run as a stand-alone console or as a snap-in added to a Microsoft Management Console (MMC).

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To start Authorization Manager

  1. Click Start, type azman.msc in the Start Search box, and then press ENTER.

  2. If the User Account Control dialog box appears, provide the requested permission or credentials.

Additional considerations

  • Authorization Manager opens without a default authorization store. To use Authorization Manager, you need to create or open an authorization store.

  • You can configure your own MMC that includes Authorization Manager as part of that console. For more information, refer to "Additional references" in this topic.

  • Authorization Manager opens with the same configuration as at the time you closed the console.

  • Depending on the configuration of your computer, the User Account Control dialog box may or may not appear. It will not appear if you are logged in with the built-in Administrator account (the local Administrator account is disabled by default in this version of Windows).

  • By default, members of the local Administrators group have sufficient rights and privileges to complete this task. In your environment, security may be managed so that non-administrators have additional rights.

  • If User Account Control is enabled, it can be configured to allow non-administrators to enter the credentials of an administrator to complete administrative tasks without being a member of the Administrators group.

Additional references

  • Add the Authorization Manager Snap-In to MMC


Set Authorization Manager Options

Authorization Manager can operate in two modes: developer mode and administrator mode.

Administrator mode is the default, but before you can effectively use administrator mode, you need to define an application that includes all of the necessary group, role, operation, and task definitions. You do this in developer mode.

After you set up an application in developer mode, you do not have to use Authorization Manager in developer mode for that application.

To complete the following tasks, you must be in developer mode:

  • Create new authorization stores

  • Create new applications

  • Define or modify operations

  • Change an application name

  • Change the version information for an application

To change between administrator mode and developer mode, use the Options dialog box.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

Set Authorization Manager options

  1. If necessary, start Authorization Manager.

  2. In the console tree, select the Authorization Manager node (the root node).

  3. On the Action menu, click Options.

  4. Click either Developer mode or Administrator mode.

  5. Click OK.

Additional considerations

  • By default, members of the local Administrators group have sufficient rights and privileges to complete this task. In your environment, security may be managed so that non-administrators have additional rights.

Additional references

  • Start Authorization Manager


Synchronize the Authorization Manager Console

If more than one user or process is modifying an authorization store, you will not see changes immediately in all instances of the Authorization Manager console. This occurs because the Authorization Manager console keeps a cached copy of the authorization store in memory.

Two commands are available to synchronize the view seen in the Authorization Manager console: refresh and reload.

  • The refresh command synchronizes the console view with the cached copy.

  • The reload command synchronizes the cached copy with the actual authorization store, and synchronizes the console view with the new cached copy.

Any account that can run the Authorization Manager console can complete this task.

Refresh the Authorization Manager console

  • In the console tree, right-click the item that you want to refresh, and then click Refresh.
Reload an authorization store

  • In the console tree, right-click the name of the authorization store, and then click Reload.

Additional references

  • Checklist: Before You Start Using Authorization Manager

  • Understanding Authorization Manager Stores

  • Start Authorization Manager


Managing Authorization Stores

Before you can use Authorization Manager to control access to resources, you must create the definitions required to describe the environment you want to create. All of these settings are kept in one or more authorization stores.

An authorization store is sometimes called a policy store or an authorization policy store.

This section contains:

  • Create an Authorization Store

  • Change the Properties of an Authorization Store

  • Allow Other Users to Administer an Authorization Store

  • Activate Auditing for an Authorization Store

  • Connect to an SQL-based Authorization Store

  • Understanding Authorization Manager Stores

  • Understanding Authorization Manager Store Limits


Create an Authorization Store

Before you can use Authorization Manager to control access to resources, you must create an authorization store.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To create an authorization store

  1. Open Authorization Manager.

  2. If necessary, switch to developer mode by changing the Authorization Manager options.

  3. In the console tree, right-click Authorization Manager, and then click New Authorization Store.

  4. In the New Authorization Store dialog box, click Active Directory, XML file, or Microsoft SQL.

  5. In Store name, type the authorization store name or click Locations to find the authorization store. You cannot use Locations to browse for a computer running Microsoft SQL Server. You must know the location you want to use to create a store in SQL Server.

  6. (Optional) In Description, type a description for the new authorization store.

  7. Click OK.

Additional considerations

  • To perform this procedure, you must be working in developer mode.

  • To create an authorization store that is stored in Active Directory Domain Services (AD DS), use the Lightweight Directory Access Protocol (LDAP) name (for example, CN=myStore,CN=Program Data,DN=nwtraders,DN=com). A store may be created in an AD DS partition or in an Active Directory Lightweight Directory Services (AD LDS) partition. AD LDS was formerly known as Active Directory/Application Mode (ADAM).

  • Any user or group who is assigned to the Policy Administrator, Policy Reader, or Policy Delegated User role at any level (store, application, or scope) for an Authorization Manager store that is stored in an AD LDS partition must also be added to the AD LDS Reader role of that AD LDS partition.

  • To create an XML-based authorization store, use a path and file name that is valid at run time (for example, C:\AuthStores\MyStore.xml).

  • To create an SQL-based authorization store, use a URL beginning with the protocol prefix MSSQL://. See "Additional references" for details on how to format an SQL connection string as a URL.

  • By default, members of the local Administrators group have sufficient rights and privileges to complete this task. In your environment, security may be managed so that non-administrators have additional rights.

  • If User Account Control is enabled, it can be configured to allow non-administrators to enter the credentials of an administrator to complete administrative tasks without being a member of the Administrators group.

  • If the store is being created on another computer, you must ensure that you have sufficient permissions to access and create the appropriate type of resources on that other computer.

Additional references

  • Start Authorization Manager

  • Understanding Authorization Manager Stores

  • Set Authorization Manager Options

  • Connect to an SQL-based Authorization Store


Change the Properties of an Authorization Store

Each authorization store has a number of properties that can be changed. To view or change the properties of an authorization store, use the following procedure.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

To edit the properties of an authorization store

  1. Open Authorization Manager.

  2. In the console tree, right-click the authorization store that you want to edit, and then click Properties.

  3. In the Properties dialog box, modify the settings that you want to change. For information about each property setting, see "Additional references" in this topic.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility. For more information, see "Additional references" in this topic.

Additional references

  • Understanding Authorization Manager Stores

  • <Store Name> Property Sheet: General Tab

  • <Store Name> Property Sheet: Limits Tab

  • <Store Name> Property Sheet: Security Tab

  • <Application or Store Name> Property Sheet: Auditing Tab

  • Start Authorization Manager


Allow Other Users to Administer an Authorization Store

You may want to allow additional people to manage your authorization store without granting them additional rights in the operating system. To do so, use the following procedure.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

Allow other users to administer an authorization store

  1. If necessary, open Authorization Manager.

  2. If necessary, create or open an authorization store.

  3. In the console tree, right-click the authorization store, and then click Properties.

  4. In the Properties dialog box, click the Security tab.

  5. Under Authorization Manager user role, click Administrator.

  6. Under Users and groups that are assigned to this role, click Add or Remove to add or remove users and groups to which you want to assign the Administrator role.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility. For more information, see "Additional references" in this topic.

  • Any user or group who is assigned to the Policy Administrator, Policy Reader, or Policy Delegated User role at any level (store, application, or scope) for an Authorization Manager store that is stored in an Active Directory Lightweight Directory Services (AD LDS) partition must also be added to the AD LDS Reader role of that AD LDS partition. AD LDS was formerly known as Active Directory/Application Mode (ADAM).

Additional references

  • <Store Name> Property Sheet: Security Tab

  • Understanding Authorization Manager Stores

  • Understanding Authorization Manager Applications

  • Start Authorization Manager


Activate Auditing for an Authorization Store

To control which Authorization Manager actions or activities are audited, use the following procedure.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

Activate auditing for an authorization store

  1. If necessary, open Authorization Manager.

  2. In the console tree, right-click the authorization store that you want to audit, and then click Properties.

  3. In the Properties dialog box, click the Auditing tab, and then do one or both of the following:

    • To audit run-time application initialization, select the Runtime application initialization auditing check box.

    • To audit authorization store changes, select the Authorization store change auditing check box.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility. For more information, see "Additional references" in this topic.

Additional references

  • Understanding Authorization Manager Stores

  • <Application or Store Name> Property Sheet: Auditing Tab

  • <Store Name> Property Sheet: Security Tab

  • Start Authorization Manager


Connect to an SQL-based Authorization Store

You can use a Microsoft SQL Server database as the repository for your authorization store. In order to connect to a SQL Server store, use the following procedure.

You must be a member of the Authorization Manager Administrator role to complete this procedure. By default, Administrators is the Windows group membership required to do so. Review the details in "Additional considerations" in this topic.

Connecting to an SQL-based authorization store

When creating or opening an authorization store, type a URL beginning with the protocol prefix MSSQL://.

The syntax for the URL is:

mssql://<connection string>/<database name>/<policy store name>

where:

  • <connection string> is any valid SQL Server connection string,

  • <database name> is the name of the database where the store will be saved, and

  • <policy store name> is the name of the particular store.

Examples

mssql://dsn=MyTestDataSource;/AzManDB/MyTestStore

mssql://Driver={SQL Server};Server={server1-test};/AzManDB/MyTestStore

Note

Connections to a SQL store are not encrypted unless you explicitly set up SQL encryption for the connection or set up encryption of the network traffic that uses Internet Protocol security (IPsec). For information about configuring SQL encryption or configuring IPsec, see SQL Server product documentation (http://go.microsoft.com/fwlink/?LinkId=131607).

Additional considerations

  • If the instance of SQL Server doesn't have the named Authorization Manager database, Authorization Manager will create a new database of this name. Otherwise, the new store will be created within the same named database.

  • The database administrator responsible for the computer running SQL Server must configure security on the computer to allow the Authorization Manager database to be created and maintained.

  • If you are not familiar with connection string syntax, see the documentation provided with Microsoft SQL Server 2008 or Microsoft SQL Server 2005, or visit the Microsoft Web site and see Connection String Syntax (http://go.microsoft.com/fwlink/?LinkId=69663).

Additional references

  • Understanding Authorization Manager Stores

  • What's New in Authorization Manager


Understanding Authorization Manager Stores

With Authorization Manager, you can provide authorization services to administrators that you support by creating Authorization Manager applications that access authorization stores.

In Authorization Manager, there is neither a default authorization store nor a default application. To create an authorization store, you must work in the Authorization Manager developer mode. For more information about working in developer mode, see Set Authorization Manager Options.

You can store authorization stores in either XML files, Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), or in Microsoft SQL Server databases.

The following table compares the different authorization store types.

Authorization store type Delegation support Authorization store is specified by Requirements

AD DS or AD LDS

Supported at the authorization store, application, and scope levels

A URL, beginning with the protocol prefix MSLDAP:// or an LDAP distinguished name (for example, CN=myStore,CN=Program Data,DN=nwtraders,DN=com)

The domain functional level must be Windows Server 2003 or higher.

Note

In Windows 2000, Active Directory does not support authorization stores.

XML

Not supported

The XML file is secured as a whole by its NTFS file system access control entries (ACEs).

A URL beginning with the protocol prefix MSXML:// or a path (for example, C:\Temp\MyStore.xml or \\ServerName\ShareName\MyStore.xml)

Any NTFS partition

SQL Server

Supported at the authorization store, application, and scope levels

A URL beginning with the protocol prefix MSSQL:// followed by a connection string, database name, and policy store name, in the format: MSSQL://<connection string>/<database name>/<policy store name>

At least Microsoft SQL Server 2000

An application is specific to an authorization store, and it is always located directly under its parent authorization store in Authorization Manager. For more information, see Create an Authorization Manager Application.

Scopes, roles, tasks, and operations are always specific to an application. For more information, see Understanding Authorization Manager Scopes and Understanding Authorization Manager Role, Task, and Operation Definitions.

Using application groups

An application group is a group of users of an Authorization Manager application. You can create application groups at any of the three levels in the Authorization Manager console. The following table lists the different Authorization Manager levels where you can create application groups.

Level | Application group can be used in
Authorization store | The authorization store, and applications and scopes within it
Application | The application and scopes within it
Scope | The scope

For more information about application groups, see Understanding Authorization Manager Application Groups.

Delegating authorization stores and applications

Authorization stores that are stored in AD DS, AD LDS, or SQL Server support delegation. This means that you can authorize other people to administer those authorization stores or applications contained in those authorization stores.

For more information about performing delegation, see Allow Other Users to Administer an Authorization Store.


Understanding Authorization Manager Store Limits

You can configure each Authorization Manager store with several specific limits. This allows you to fine-tune the performance of Authorization Manager in your own environment. The default values are recommended unless you have a specific requirement.

You can configure limits on authorization rules and on Lightweight Directory Access Protocol (LDAP) query timeouts.

Authorization rule limits

You can choose to disable all authorization rules. If rules are enabled, you can specify a timeout value to limit the amount of time the system will wait for an authorization rule or business rule script to complete.

If you disable authorization rules by using this setting, all clients using this Authorization Manager store are affected. Individual clients are also affected by the registry setting described in Understanding Authorization Rules and Business Rules.


Managing Applications and Scopes

You can use Authorization Manager applications and scopes to group related definitions together and to limit how particular policies are applied.

This section contains:

  • Create an Application Group within an Authorization Store

  • Change the Properties of a Group within an Authorization Store

  • Create an Authorization Manager Application

  • Understanding Authorization Manager Applications

  • Understanding Authorization Manager Scopes

  • Understanding Authorization Manager Auditing


Create an Application Group within an Authorization Store

Before you can effectively use Authorization Manager to control access to resources, you must define groups of users. To define an application group, use the following procedure.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

To create a group within an authorization store

  1. If necessary, open Authorization Manager.

  2. In the console tree, right-click Groups, and then click New Application Group.

  3. In the New Application Group dialog box, in Name, type a name for the group.

  4. In Description, type a description for the group.

  5. In Group type, click Basic Application Group, LDAP Query Application Group, or Business Rule Application Group. (For more information about the types of groups you can create, see "Additional references" in this topic.)

  6. Click OK.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility.

Additional references

  • Understanding Authorization Manager Application Groups

  • <Store Name> Property Sheet: Security Tab

  • Start Authorization Manager


Change the Properties of a Group within an Authorization Store

The properties of a group define the group and its membership. To view or change the properties of a group, use the following procedure.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

Change the properties of a group within an authorization store

  1. If necessary, open Authorization Manager.

  2. In the console tree, right-click the group that you want to edit, and then click Properties.

  3. In the Properties dialog box, modify the settings that you want to change. (For more information about the properties you can change, see "Additional references.")

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility.

Additional references

  • Understanding Authorization Manager Application Groups

  • <Store Name> Property Sheet: Security Tab

  • <Group Name> Property Sheet: General Tab

  • <Group Name> Property Sheet: Exclusions Tab

  • <Group Name> Property Sheet: Members Tab

  • <Group Name> Property Sheet: Query Tab


Create an Authorization Manager Application

An authorization store can contain authorization policy information for many applications in a single policy store. All applications in one authorization store can access all of the groups defined at the store level.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

Create an Authorization Manager application

  1. If necessary, open Authorization Manager.

  2. If necessary, open or create an authorization store.

  3. If Authorization Manager is in administrator mode, switch to developer mode.

  4. In the console tree, right-click the name of the authorization store, and then click New Application.

  5. In the Name box, type a name for your application.

  6. If desired, type a description and version information.

  7. Click OK.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility. For more information, see Allow Other Users to Administer an Authorization Store.

Additional references

  • Understanding Authorization Manager Applications

  • <Application Name> Property Sheet: General Tab


Understanding Authorization Manager Applications

With Authorization Manager, you can manage application tasks and data access by creating Authorization Manager applications that access authorization stores.

An application is specific to an authorization store, and it is always located directly under its parent authorization store in Authorization Manager.

A single authorization store can contain authorization policy information for many applications. All applications in one authorization store can access all of the groups defined at the store level.

An authorization policy store must contain at least one application. For example, you may create one application to control access to a Web site and another application to control access to functions in a particular line-of-business software program. However, because both of these applications are used in the same company and may have similar requirements, it may make sense to include both applications in one authorization store.

You can control auditing at the application level. For more information, see "Additional references" in this topic.

Additional references

  • Understanding Authorization Manager Stores

  • Create an Authorization Manager Application

  • Understanding Authorization Manager Auditing


Understanding Authorization Manager Scopes

A scope is a virtual subdivision within an application that separates some resources from other resources that are used by that application. You can use scopes to prevent unintended resource sharing and to support auditing and delegation. You do not have to use scopes.

A scope can represent a folder, a container in Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS), a file-masked collection of files (for example, *.doc), a URL, or any item that can be accessed by the application and its underlying authorization store. However, a scope is an abstraction; it is a definition created in Authorization Manager, but it is not a physical folder in the file system or an actual container in AD DS, for example.

If you have Authorization Manager groups, role assignments, role definitions, or task definitions that you do not want to apply to an entire application, you can create them at the scope level. The application that contains the scope must be able to recognize the scope name. For example, file-based applications might have scope names that include file names or paths. Web-based applications might have URL-based scope names. Registry applications might have scope names based on registry hives, and Active Directory scope names could specify organizational units. You cannot define operations at the scope level.

Auditing scopes

You cannot control Authorization Manager run-time auditing at the scope level. You can control Authorization Manager authorization store-change auditing on scopes contained in authorization stores that are stored in AD DS. For more information, see Understanding Authorization Manager Auditing.

Delegating scopes

You can delegate the administration of scopes to other people if both of the following conditions are met:

  • The authorization store must be stored in AD DS, AD LDS, or Microsoft SQL Server.

  • Authorization rules are not used in any task or role definitions defined within the scope you want to delegate.


Understanding Authorization Manager Auditing

Monitoring the access to controlled resources and any changes to an authorization policy gives you a way to track potential security problems, helps to ensure user accountability, and provides evidence in the event of a security breach.

Types of auditing

With Authorization Manager, you can use two kinds of auditing: run-time auditing and authorization store change auditing.

Run-time auditing

There are two aspects to run-time auditing:

  • Run-time application initialization auditing, which generates audits when an application is opened.

  • Run-time client context and access check auditing, which generates audits when a client context is created and each time that the client calls for an access check. Access checks are based on the AccessCheck method described in the Authorization section of the Platform SDK. For more information about authorization-related application programming interfaces (APIs), see Authorization (http://go.microsoft.com/fwlink/?linkid=64031).

You can configure run-time auditing to log successes, failures, or both successes and failures.

Authorization store change auditing

When you enable authorization store change auditing, audits are generated every time the authorization store is modified. The audit logs all events, successes, and failures.

For authorization store change auditing, Authorization Manager supports the NTFS file system (for XML-based authorization stores), Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), and Microsoft SQL Server.

Locating audit events

To view audit events generated by Authorization Manager, view the event logs on the appropriate computer:

  • Run-time auditing events are in the security log of the client computer where the application is running.

  • Authorization store change auditing events are in the security log of the computer where the store resides.

    • In the case of an XML-based authorization store, the audit records will be found in the Event Viewer of the computer where the XML file is stored.

    • In the case of an authorization store that uses AD DS or AD LDS, audit records will be found on the Event Viewer of the domain controller or AD LDS server being accessed.

    • In the case of a SQL-based authorization store, audit records will be found in the Event Viewer of the computer hosting SQL Server.

Auditing availability

The availability of auditing depends on the following:

  • Whether the authorization store is based on AD DS, AD LDS, XML, or SQL.

  • Whether auditing is configured at the authorization store level, the application level, or the scope level.

The following table describes the availability of the two auditing types.

Level Run-time auditing is available in Run-time auditing can be configured at this level in Authorization store change auditing is available in

Authorization store
  • XML

  • AD DS and AD LDS

  • SQL Server
  • XML

  • AD DS and AD LDS

  • SQL Server
  • XML

  • AD DS and AD LDS

  • SQL Server

Application
  • XML

  • AD DS and AD LDS

  • SQL Server
  • XML

  • AD DS and AD LDS

  • SQL Server
  • AD DS and AD LDS

  • SQL Server

Scope
  • XML

  • AD DS and AD LDS

  • SQL Server

Not available (configured at the application level)
  • AD DS and AD LDS

  • SQL Server

To use auditing, you have to select the appropriate check box on the Auditing tab. To enable run-time auditing, select the Runtime application initialization auditing check box. To enable authorization store change auditing, select the Runtime client context and access check auditing check box.

Configuring the system to allow auditing

Before you implement auditing, you must decide on an auditing policy. An auditing policy specifies categories of security-related events that you want to audit. By default, when Windows is first installed, all auditing categories are disabled.

In order to configure which application and scopes are to be audited, you must have the Manage auditing and security log privilege on the computer where the authorization store resides. This is usually accomplished by being logged on as a member of the built-in Administrators group, or providing an administrator's password when prompted.

If the authorization store is based on XML, you have to specify object access auditing. If the authorization store is based on AD DS or AD LDS, you have to specify directory service access auditing.

In order to generate run-time client context and access check audits, users of applications that use Authorization Manager must be granted the Generate security audits privilege. If users of the application do not hold this privilege, no audit events will be recorded.

Enabling object access auditing

By default, object access auditing is turned off. To turn it on, you need to use Group Policy at the domain, domain controller, or other applicable organizational-unit level in AD DS or AD LDS. You can also use the local security policy.

If the XML-based authorization store is located on a domain controller, the Default Domain Controllers Policy Group Policy object (GPO) is the most appropriate place to turn on object access auditing. If the XML-based authorization store is located on a workstation or member server, you can edit the local GPO for that computer to set the local security policy, but those settings will only apply until the next refresh of Group Policy security settings. This may be useful if you are only generating the audits one time. However, if you plan to generate security audits regularly you should edit another GPO that applies to the computer through AD DS.

To enable object access auditing, configure the following objects:

  • For a local computer

    1. Open the Local Group Policy Editor.

    2. In the console tree, double-click Computer Configuration, Windows Settings, Security Settings, Local Policies, and Audit Policy.

    3. Click Audit object access.

    4. In the details pane, select the Define these policy settings check box, select the Success check box, and then select the Failure check box.

  • For only domain controllers

    1. Click Start, click All Programs, click Administrative Tools, and then double-click Domain Controller Security Policy .

    2. In the console tree, double-click Computer Configuration, Windows Settings, Security Settings, Local Policies, and Audit Policy.

    3. Click Audit object access.

    4. In the details pane, select the Define these policy settings check box, select the Success check box, and then select the Failure check box.

  • For a domain or organizational unit

    1. Open the Group Policy Management Console (GPMC).

    2. Right-click the GPO that you want to audit, and then click Edit.

    3. In the console tree, double-click Computer Configuration, Policies, Security Settings, Local Policies, and Audit Policy.

    4. Click Audit object access.

    5. In the details pane, select the Define these policy settings check box, select the Success check box, and then select the Failure check box.

Additional considerations

  • You must install the GPMC to edit domain-based policy settings. The GPMC is an additional feature of Windows Server 2008 that you can install by using Server Manager.

  • If you are editing the local GPO, the Define these policy settings check box does not appear in the Local Group Policy Editor. It only appears if you are editing GPOs that are stored in AD DS.

  • If the Success and Failure auditing check boxes are unavailable, the Define these policy settings check box has probably been selected through security policy that is acting at a higher level in the AD DS structure. In this situation, you need to find out where the Define these policy settings check box is selected and clear this setting. To find this setting, look in the GPOs that affect this computer.

Enabling directory access auditing

By default, directory service access auditing is turned off. To turn it on, you need to use Group Policy at the domain, domain controller, or other applicable organizational unit level in AD DS.

To enable object access auditing, expand the following nodes: Computer Configuration, Windows Settings, Security Settings, Local Policies, Audit Policy, and then double-click Audit directory service access.

Select the Define these policy settings check box, select the Success check box, and then select the Failure check box.

Additional considerations

  • If the Success and Failure auditing check boxes are unavailable, the Define these policy settings check box has probably been selected through a security policy that is acting at a higher level in AD DS. In this situation, you need to find out where the Define these policy settings check box is selected and clear the check box. To find this setting, look in the GPOs that affect the domain controller.

  • After editing the GPOs, run the gpupdate command to ensure that the changes take effect immediately.

Auditing that is enabled by inheritance

Any auditing obtained through inheritance takes place regardless of the local setting. For example, in the case of an authorization store that is stored in AD DS, auditing policy can be inherited from a parent organizational unit in AD DS. In the case of an XML-based authorization store, audit policy on the folder containing the XML file is applicable.


Managing Groups, Roles, and Tasks

In order to effectively use Authorization Manager for role-based access control, you must be familiar with groups, roles, tasks, and operations.

This section includes:

  • Assign a Windows User or Group to a Role

  • Assign an Application Group to a Role

  • Choose Users or Groups with a Custom Object Picker

  • Define an Operation in Authorization Manager

  • Understanding Authorization Manager Application Groups

  • Understanding Authorization Manager Role, Task, and Operation Definitions

  • Understanding Authorization Manager Role Assignments


Assign a Windows User or Group to a Role

To effectively use Authorization Manager to control access to resources, you must define which groups of users are associated with which roles. To assign a Windows user or group to a role, use the following procedure.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

Assign a Windows user or group to a role

  1. If necessary, open Authorization Manager.

  2. If necessary, open or create an authorization store.

  3. In the console tree, right-click Role Assignments, under either an application or a scope, and click New role assignment. The Role Assignments folder is used as a container to link groups to roles. Not all roles have groups associated with them because roles can be combined into larger roles.

  4. Select the role to which you want to assign groups by selecting the check box beside the name of the appropriate role definition, and then click OK. The same role definition can be added to the Role Assignments container more than once. This allows flexibility in managing your assignments.

  5. If desired, change the display name of the role assignment by right-clicking it in the list of role assignments, click Properties, and type the new display name.

  6. In the list of role assignments, right-click the role assignment from the previous steps, point to Assign Users and Groups, and then click From Windows and Active Directory.

  7. In the Enter the object names to select box, type the user names of the desired members. Alternatively, you can search Active Directory Domain Services (AD DS) by clicking Advanced.

  8. Click OK.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility. For more information, see "Additional references" in this topic.

Additional references

  • Understanding Authorization Manager Role Assignments

  • Assign an Application Group to a Role

  • Understanding Authorization Manager Application Groups


Assign an Application Group to a Role

To effectively use Authorization Manager to control access to resources, you must define which groups of users are associated with which roles. To assign an application group to a role, use the following procedure.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

Assign an application group to a role

  1. If necessary, open Authorization Manager.

  2. If necessary, open or create an authorization store.

  3. In the console tree, right-click Role Assignments, under either an application or a scope, and click New role assignment. The Role Assignments folder is used as a container to link groups to roles. Not all roles have groups associated with them because roles can be combined into larger roles.

  4. Select the role to which you want to assign groups by selecting the check box beside the name of the role definitions, and then click OK. The same role definition can be added to the Role Assignments container more than once. This allows flexibility in managing your assignments.

  5. If desired, change the display name of the role assignment by right-clicking it in the list of role assignments, click Properties, and type the new display name.

  6. In the list of role assignments, right-click the role assignment from the previous steps, point to Assign Users and Groups, and then click From Authorization Manager.

  7. Select the desired members from the Add Groups dialog box by selecting the check box beside each desired member.

  8. Click OK.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility. For more information, see "Additional references" in this topic.

Additional references

  • Understanding Authorization Manager Role Assignments

  • Assign a Windows User or Group to a Role

  • Understanding Authorization Manager Application Groups


Choose Users or Groups with a Custom Object Picker

With Authorization Manager, you can include users or groups from any source that can be defined or referenced by the Authorization Manager application programming interface (API). In order to include users and groups from external sources, you must write or acquire a custom object picker. A custom object picker is a software component that can be installed on your system to allow an Authorization Manager administrator to access data stored in an external application.

For more information, see Authorization Manager Model (http://go.microsoft.com/fwlink/?linkid=64027).

The permissions required to perform this task will vary for each custom object picker.

Choose users or groups with a custom object picker

  1. Install the custom object picker according to the instructions provided with the non-Microsoft software.

  2. The custom object picker will be added to the Assign users and groups from menu choices under the Role Assignments node and to the drop-down list in the Members and Exclusions tab of the properties sheet for basic application groups. Choose the entry installed by the custom object picker installation process.

  3. Select users from the external source, according to the instructions provided with the custom object picker.

Additional references

  • Resources for Authorization Manager


Define an Operation in Authorization Manager

An operation is a particular action or access that needs to be controlled or restricted by Authorization Manager. Operations are defined at the application level. Operations are combined into tasks at either the application or scope level.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

Define an operation in Authorization Manager

  1. If necessary, open Authorization Manager.

  2. If necessary, open or create an authorization store that contains an application.

  3. In the console tree, expand the application, and then expand Definitions.

  4. Right-click Operation Definitions, and click New Operation Definition.

  5. Define the operation by providing a name, description, and operation number. The name and description are for your convenience. The operation number must be used by the calling program. The operation number is called an OperationID in the application programming interface (API). The number must be a positive integer, greater than zero (0). For more information, see "Additional references" in this topic.

  6. Click OK.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility. For more information, see Allow Other Users to Administer an Authorization Store.

  • To define an operation by using the Authorization Manager console, you must use developer mode.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions

  • Set Authorization Manager Options

  • New Operation Definition Dialog Box


Understanding Authorization Manager Application Groups

In Authorization Manager, recipients of authorization policy are represented by the following different kinds of groups:

  • Windows users and groups. These groups include users, computers, and built-in groups for security principals. Windows users and groups are used throughout Windows, not only in Authorization Manager.

  • Application groups. These groups include basic application groups and Lightweight Directory Access Protocol (LDAP) query groups. Application groups are specific to Authorization Manager role-based administration.

Important

An application group is a group of users, computers, or other security principals. An application group is not a group of applications.

  • LDAP query groups. Membership in these groups is dynamically calculated as needed from LDAP queries. An LDAP query group is a type of application group.

  • Basic application groups. These groups are defined in terms of LDAP query groups, Windows users and groups, and other basic application groups. A basic application group is a type of application group.

  • Business rule application group. These groups are defined by a script written in either VBScript or JScript, and result in group membership being determined dynamically at run time according to criteria you define.

Windows users and groups

For more information about groups in Active Directory Domain Services (AD DS), see Role-Based Access Control for Multi-tier Applications Using Authorization Manager (http://go.microsoft.com/fwlink/?LinkId=64287). For more information about security principals that are not stored in AD DS, see the Security Principals Technical Reference (http://go.microsoft.com/fwlink/?LinkId=129213).

Application groups

When you create a new application group, you need to determine whether you want it to be an LDAP query group or a basic application group. For Authorization Manager role-based applications, any authorization you can do with Windows users and groups can also be done with application groups.

Circular membership definitions are not allowed, and result in the error message "Cannot add <Group name>. The following problem occurred: A loop has been detected."

LDAP query groups

In Authorization Manager, you can use LDAP queries to find objects in AD DS, Active Directory Lightweight Directory Services (AD LDS), and other LDAP-compliant directories.

You can use an LDAP query to specify an LDAP query group by typing the desired LDAP query in the space provided on the Query tab of the Properties dialog box of the application group.

Authorization Manager supports two types of LDAP queries that can be used to define an LDAP query group: Authorization Manager version 1 queries and LDAP URL queries.

  • Authorization Manager version 1 LDAP queries

    Version 1 LDAP queries provide limited support for the LDAP URL query syntax described in RFC 2255. These queries are limited to querying the attribute list of the user object specified in the current client context.

    For example, the following query finds everyone except Andy:

    (&(objectCategory=person)(objectClass=user)(!cn=andy)).

    This query evaluates if the client is a member of the StatusReports alias at northwindtraders.com:

    (memberOf=CN=StatusReports,OU=Distribution Lists,DC=nwtraders,DC=com)

    Authorization Manager continues to support version 1 queries so that solutions developed by using earlier versions of Authorization Manager can be upgraded with less effort.

  • LDAP URL queries

    In order to remove limitations on objects and attributes that can be searched, Authorization Manager supports an LDAP URL query syntax based on RFC 2255. This allows you to create LDAP query groups that use directory objects other than the current user object as the root of the search.

    An LDAP URL begins with the protocol prefix "ldap" and follows this format:

Note

Distinguished name is also known as DN.

ldap://<server:port>/<baseObjectDN>?<attributes>?<queryScope>?<Filter>

Specifically, the following grammar is supported:

       ldapurl    = scheme "://" [hostport] ["/"
                    [dn ["?" [attributes] ["?" [scope]
                    ["?" [filter]]]]]]
       scheme     = "ldap"
       attributes = attrdesc *("," attrdesc)
       scope      = "base" / "one" / "sub"
       dn         = distinguishedName
       hostport   = hostport
       attrdesc   = AttributeDescription
       filter     = filter

For example, the following query returns users whose company attribute is set to "FabCo," from the LDAP server running on port 389 on a host named "fabserver":

ldap://fabserver:389/OU=Customers,DC=FABCO-PN,DC=com?*?sub?(&(company=FabCo)(objectClass=user)(objectCategory=user))

When using an LDAP URL query, you can use the special placeholder value %AZ_CLIENT_DN%. This placeholder is replaced with the distinguished name (DN) of the client making the access check. This allows you to construct queries which return objects from the directory based on their relationship to the distinguished name of the client making the request.

In this example, the LDAP query tests whether the user is a member of the "Customers" OU:

ldap://server:<port>/OU=Customers,DC=FABCO-PN,DC=com?(objectclass=*)?sub?(& (objectClass=user)(objectCategory=user) (distinguishedName= %AZ_CLIENT_DN% ))

In this example, the LDAP query tests whether the user is a direct report of a manager named "SomeManager" and that the "searchattribute" of SomeManager is equal to the particular value "searchvalue":

ldap://server:port/Cn=SomeManager,OU=Users,DC=FABCO-PN,DC=com?(objectclass=*)?base?(&(searchattribute= searchvalue) (directreports = %AZ_CLIENT_DN%))

For more information about the syntax of an LDAP URL query, refer to the text of RFC 2255 (http://go.microsoft.com/fwlink/?linkid=65973).

Important

If the LDAP query starts with "ldap," it is treated as an LDAP URL query. If it starts with anything else, it is treated as a version 1 query.

Basic application groups

Basic application groups are specific to Authorization Manager.

To define basic application group membership, you need to:

  1. Define who is a member.

  2. Define who is not a member.

Both of these steps are carried out in the same way:

  • First, you specify zero or more Windows users and groups, previously defined basic application groups, or LDAP query groups.

  • Second, the membership of the basic application group is calculated by removing any nonmembers from the group. Authorization Manager does this automatically at run time.

Important

Non-membership in a basic application group takes precedence over membership.

Business rule application groups

Business rule application groups are specific to Authorization Manager.

To define business rule application group membership, you must write a script in either VBScript or JScript. The script source code is loaded from a text file on the Properties page of the business rule application group.


Understanding Authorization Manager Role, Task, and Operation Definitions

To use Authorization Manager effectively to control access to resources, you must first define roles, tasks, and operations.

  • A role is a set of permissions that a user must have to do a job. Well-designed roles should correspond to a job category or responsibility (for example, receptionist, hiring manager, or archivist) and be named accordingly. With Authorization Manager, you can add users to a role to authorize them for the job.

  • A task is a collection of operations and sometimes other tasks. Well-designed tasks are inclusive enough to represent work items that are recognizable (for example, "change password" or "submit expense").

  • An operation is a set of permissions that you associate with system-level or API-level security procedures such as WriteAttributes or ReadAttributes. You use operations as building blocks for tasks.

You can define roles, tasks, and operations only in developer mode, not in administrator mode. To set developer mode, see Set Authorization Manager Options.

Role definitions

Creating appropriate role definitions depends on the structure and goals of your organization. Roles support inheritance from other roles.

To define a role, you specify a name, a friendly description, and some specific tasks, roles, and operations that are part of the role. This provides a mechanism for role inheritance. For example, a Helpdesk role might include a Product Support role.

You can specify an authorization rule, which may be either VBScript or JScript. For more information, see VBScript (http://go.microsoft.com/fwlink/?linkid=65964) and JScript (http://go.microsoft.com/fwlink/?LinkId=65963).

If there are several authorization rules associated with a role definition (for example, the role definition has several subroles and tasks), the authorization rules run synchronously. In Authorization Manager, the order has no effect on authorization.

Task definitions

A task definition is smaller than a role definition and can be used to define roles and other tasks.

With Authorization Manager, you associate tasks with roles in an intuitive way. For example, the Recruiter role might include the Interview task.

Tasks, like roles, are defined in a way that is appropriate to the organization. To define a task, you specify a name, a description, and some specific tasks and operations that are part of the task. You can also specify a VBScript or JScript authorization rule.

Operation definitions

Operations are small computer-level actions that are used to define tasks and usually are not relevant to an administrator. You define operations only in developer mode.

You can set operation definitions at the application level, but not at the authorization store level or the scope level.

An operation definition includes a name, a description, and an operation number. The operation number X must be an integer from 1 to 2,147,483,647 (that is, 1 ≤ X ≤ 2^31 - 1). The operation number is used by the application to identify the operation, so entering a wrong operation number will result in access being granted or denied incorrectly. This, in turn, could lead to security violations or undesired behavior of the client application.


Understanding Authorization Manager Role Assignments

A role assignment is a virtual container for application groups whose members are authorized for the role. A role assignment is based on a single role definition, and a single role definition can be the basis of many role assignments.

The most common procedure that administrators carry out is the assignment of application groups, or Windows users and groups, to a role. For step-by-step instructions, see Assign a Windows User or Group to a Role or Assign an Application Group to a Role.

Note

If you have installed a custom object picker, additional choices will be available. For more information, see "Additional references" in this topic.

Additional references

  • Assign a Windows User or Group to a Role

  • Assign an Application Group to a Role

  • Choose Users or Groups with a Custom Object Picker


Controlling Authorization by Using Authorization Rules and Business Rules

Authorization Manager allows you to use authorization rules as part of your role-based authorization control strategy.

This section includes the following topics:

  • Add an Authorization Rule to a Task Definition

  • Add an Authorization Rule to a Role Definition

  • Understanding Authorization Rules and Business Rules


Add an Authorization Rule to a Task Definition

Authorization rules can be used to define a task or a role. For information about using rules, see "Additional references" in this topic.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

Add an authorization rule to a task definition

  1. If necessary, open Authorization Manager.

  2. If necessary, open or create an authorization store containing an application.

  3. In the console tree, expand the application, expand the Definitions folder, and then click Task Definitions. Rules may be used with either application-level or scope-level tasks.

  4. In the list of tasks, right-click a task, and click Properties.

  5. In the property sheet, click the Definition tab.

  6. Click Authorization Rule.

  7. In the Script path box, type the location and name of a text file containing the source code for the script you want to load, or click Browse to locate the file.

  8. Click either VBScript or Jscript as the Script type.

  9. Click Reload Rule into Store.

  10. Click OK.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility. For more information, see Allow Other Users to Administer an Authorization Store.

  • To perform this procedure by using the Authorization Manager snap-in, you must be using developer mode.

Additional references

  • Understanding Authorization Rules and Business Rules

  • Understanding Authorization Manager Role, Task, and Operation Definitions


Add an Authorization Rule to a Role Definition

Authorization rules can be used to define a task or a role. For information about using rules, see "Additional references" in this topic.

You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional considerations" in this topic.

Add an authorization rule to a task definition

  1. If necessary, open Authorization Manager.

  2. If necessary, open or create an authorization store containing an application.

  3. In the console tree, expand the application, expand the Definitions folder, and then click Role Definitions. Rules may be used with either application-level or scope-level roles.

  4. In the list of tasks, right-click a role, and click Properties.

  5. In the property sheet, click the Definition tab.

  6. Click Authorization Rule.

  7. In the Script path box, type the location and name of a text file containing the source code for the script you want to load, or click Browse to locate the file.

  8. Click either VBScript or Jscript as the Script type.

  9. Click Reload Rule into Store.

  10. Click OK.

Additional considerations

  • To perform this procedure, you need to have access to an authorization store. By default, members of the Administrators group have the required access, but Authorization Manager allows you to delegate responsibility. For more information, see Allow Other Users to Administer an Authorization Store.

  • To perform this procedure by using the Authorization Manager snap-in, you must be using developer mode.

Additional references

  • Understanding Authorization Rules and Business Rules

  • Understanding Authorization Manager Role, Task, and Operation Definitions


Understanding Authorization Rules and Business Rules

Authorization rules are scripts written in VBScript or JScript that you can include in role definitions and task definitions. An authorization rule determines whether the role or task is allowed.

By using authorization rules, you can base authorization decisions on any condition that a script can test. These may include privileges and permissions, time of day, billable expense limits, account balances, or other criteria.

Authorization Manager is not designed for writing or debugging authorization rules. You can write your scripts in a text editor (for example, Notepad), in an integrated development environment such as Visual Studio .NET, or in another application of your choice. Authorization rules are usually written by professional developers.

More information about creating authorization rules and using the Authorization Manager application programming interfaces (APIs, see Authorization Manager Model (http://go.microsoft.com/fwlink/?linkid=64027). For additional suggested links, see Resources for Authorization Manager.

Controlling the use of business rules and authorization rules

Controlling use on each client

Beginning with Windows Server 2008, the use of business rules and authorization rules can be controlled by a registry setting. Rules are disabled by default. Previous versions of Windows did not support this functionality.

Generally, you will use a setup program or a script run by the operating system to enable authorization rules and business rules if they are in use in your environment.

Important

This setting is controlled individually for each Authorization Manager application on each client.

The following is a sample script that enables or disables business rules and application rules for an application:

'

' Enabling or disabling BizRules for an application

' This script uses Authorization Manager Administrative interfaces to enable or disable

' BizRules for a specified Authorization Manager application in a specified Authorization Manager policy store

On Error Resume Next

Set objArgs = WScript.Arguments

If objArgs.count <> 3 then

wscript.echo "Usage: SetBizRule ""AzManStoreURL"" ""AzApplicaitonName"" True/False"

wscript.echo "Example: SetBizRule ""msxml://d:\inetpub\wwwroot\AzStore.xml"" ""MyApp"" True"

wscript.echo "Run with 'cscript' command in cmd.exe to avoid msg boxes"

Else

' VBScript source code

Dim AzStoreObj

Dim AzManStoreURL : AzManStoreURL = objArgs(0)

Dim AzManAppName : AzManAppName = objArgs(1)

Dim BizRulesEnabled : BizRulesEnabled = objArgs(2)

' create azman object

Set AzStoreObj = CreateObject("AzRoles.AzAuthorizationStore")

If Err.Number > 0 Then

WScript.Echo "Can not create AzRoles.AzAuthorizationStore. Check Authorization Manager installation"

WScript.Quit

End If

' initialize store for Administration

' assumes store exists - if store is being created (e.g. an installing applicaion)

' use the value 3 instead of 2 in the call to IAzAuthorizationStore::initialize

Err.Clear

AzStoreObj.Initialize 2, AzManStoreURL

If Err.Number <> 0 Then

WScript.Echo "AzRoles.AzAuthorizationStore failed to initialize. Check store URL"

WScript.Quit

End If

' open applicaion

set AzApp = AzStoreObj.OpenApplication(AzManAppName)

If Err.Number <> 0 Then

WScript.Echo "AzRoles.AzAuthorizationStore failed to open application: " + AzManAppName + ". Check application Name."

WScript.Quit

End If

' set BizRulesEnabled property

WSCript.Echo "App BizRule Before:" & AzApp.BizRulesEnabled

AzApp.BizRulesEnabled = BizRulesEnabled

WSCript.Echo "App BizRule After:" & AzApp.BizRulesEnabled

If Err.Number = 0 Then

WScript.Echo "BizRulesEnabled is updated successfully."

Else

WScript.Echo "BizRulesEnabled is NOT updated successfully."

End If

End if

Controlling use for the entire authorization store

By configuring the authorization rule limits on the Limits tab of the authorization store properties sheet, you can:

  • Disable authorization rules and business rules for the store.

  • Set a timeout value to limit the maximum length of time to allow a script to run.

  • Allow scripts to run with no timeout.

For more information, see Understanding Authorization Manager Store Limits.

VBScript example

The following is a VBScript authorization rule that always grants permission:

AzBizRuleContext.BusinessRuleResult = True

For more information about VBScript, see VBScript (http://go.microsoft.com/fwlink/?linkid=65964).

JScript example

The following is a JScript authorization rule that always grants permission:

AzBizRuleContext.BusinessRuleResult = true;

For more information about JScript, see JScript (http://go.microsoft.com/fwlink/?linkid=65963).


Troubleshooting Authorization Manager

Authorization Manager is used in conjunction with custom code created specifically for your environment. Therefore, troubleshooting Authorization Manager is a matter of troubleshooting and debugging that application.

For more information about the specific interfaces available and how they function, see the references listed in Resources for Authorization Manager.


Resources for Authorization Manager

Authorization Manager deployments can be simple or complex. In most cases, Authorization Manager is used in conjunction with custom code written specifically for your purposes.

In creating your solution, you may want to refer to some of the following resources:

  • Role-Based Access Control for Multi-tier Applications Using Authorization Manager (http://go.microsoft.com/fwlink/?LinkId=64287)

  • Authorization Manager Model (http://go.microsoft.com/fwlink/?linkid=64027)

  • Using Dynamic Business Rules in Windows Server 2003 Authorization Manager (http://go.microsoft.com/fwlink/?LinkId=65965)

  • Dynamic Groups in Windows Server 2003 Authorization Manager (http://go.microsoft.com/fwlink/?linkid=16262)

  • Use Role-Based Security in Your Middle Tier .NET Apps with Authorization Manager (http://go.microsoft.com/fwlink/?LinkId=65966)


User Interface: Authorization Manager

  • Add Definition Dialog Box: Roles Tab

  • Add Definition Dialog Box: Tasks Tab

  • Add Definition Dialog Box: Operations Tab

  • Add Groups Dialog Box

  • <Application Name> Property Sheet: General Tab

  • <Application or Store Name> Property Sheet: Auditing Tab

  • <Authorization Rule or Business Rule> Property Sheet

  • <Group Name> Property Sheet: General Tab

  • <Group Name> Property Sheet: Exclusions Tab

  • <Group Name> Property Sheet: Members Tab

  • <Group Name> Property Sheet: Query Tab

  • New Application Dialog Box

  • New Application Group Dialog Box

  • New Authorization Store Dialog Box

  • New Operation Definition Dialog Box

  • New Role Definition Dialog Box

  • New Scope Dialog Box

  • New Task Dialog Box

  • Open Authorization Store Dialog Box: Active Directory Browse

  • Open Authorization Store Dialog Box

  • <Operation Name> Properties Dialog Box

  • Options Dialog Box

  • <Role Name> Property Sheet: General Tab

  • <Role Name> Property Sheet: Definition Tab

  • <Role Assignment> Property Sheet

  • <Scope Name> Property Sheet

  • <Store Name> Property Sheet: General Tab

  • <Store Name> Property Sheet: Limits Tab

  • <Store Name> Property Sheet: Security Tab

  • <Task Name> Definition Property Sheet: General Tab

  • <Task Name> Definition Property Sheet: Definition Tab


Add Definition Dialog Box: Roles Tab

A role can include other roles. For example, the role of "shapes" might include the role of "square" along with the role of "triangle" and the role of "circle."

The following table describes the UI elements for this dialog box.

Item Description

Select the role definitions to add

Lists the roles defined in the authorization store.

To include a defined role, select the check box beside an existing role definition.

Note

A role cannot be added to itself, either directly or indirectly. If you try to add a role to itself, you will receive an error message.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


Add Definition Dialog Box: Tasks Tab

A role can include tasks. A task can include other tasks. This tab shows the tasks defined in the application store.

The following table describes the UI elements for this dialog box.

Item Description

Select the task definitions to add

Lists the tasks defined in the authorization store.

To include a defined task, select the check box beside an existing task definition.

Note

A task cannot be added to itself, either directly or indirectly. If you try to add a task to itself, you will receive an error message

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


Add Definition Dialog Box: Operations Tab

A role or task can include operations. This tab shows the operations defined in the application store.

The following table describes the UI elements for this dialog box.

Item | Description
Select the operation definitions to add | Lists the operations defined in the authorization store. To include a defined operation, select the check box beside an existing operation definition.

To include operations, select the check box beside an existing definition.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


Add Groups Dialog Box

The following table describes the UI elements for this dialog box.

Item Description

Select the groups to add

Lists the available groups that you can add.

Note

A group cannot be added to itself, either directly or indirectly. If you try to add a group to itself, you will receive an error message.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions

  • User Interface: Authorization Manager


<Application Name> Property Sheet: General Tab

This dialog box allows you to view and configure the properties of the Authorization Manager application.

The following table describes the UI elements for this property sheet.

Item | Description
Name | Specifies the name of the application, and provides a space for you to type the name (for example, expense reporting or information management). The name will be used to initialize Authorization Manager. The application name must be unique to the authorization store, and cannot contain any of the characters \ / : * ? " < > | and [Tab]. The name has a maximum size limit of 512 bytes.
Description | Specifies the description of the application, and provides a space for you to type the description. The description does not affect the functionality of Authorization Manager. Choose a description that is meaningful to you. The description has a maximum size limit of 1,024 bytes.
Version Information | Specifies the version of the application, and provides a space for you to type the version. The version is optional text that specifies the version of the application.

Additional references

  • Understanding Authorization Manager Applications


<Application or Store Name> Property Sheet: Auditing Tab

The following table describes the UI elements for this dialog box that you can enable when you configure auditing of an Authorization Manager store.

Item | Description
Runtime application initialization auditing | Specifies whether run-time auditing is enabled. When you select this check box, the applications within the store generate both success audits and failure audits when they use policy from the store.
Authorization store change auditing | Specifies whether policy store change auditing is enabled. When you select this check box, only modifications to the authorization store itself are audited. The use of the policy does not generate an audit. Success and failure audits are both requested.

The following table describes the UI elements for this dialog box that you can enable when you configure auditing of an Authorization Manager application.

Item | Description
Runtime client context and access check auditing | Specifies whether run-time auditing is enabled. When you select this check box, Authorization Manager asks the application to generate both success and failure audits for each time client contexts are initialized or deleted, and for each time a client application calls for an access check.

Additional references

  • Understanding Authorization Manager Auditing


<Authorization Rule or Business Rule> Property Sheet

The following table describes the UI elements for this dialog box.

Item | Description
Script source code | Shows the source code for the rule. You cannot edit the code in this field, so you must write your scripts in a text editor and then upload them.
Script path | Provides a space for you to type the path to a file containing the script code for the rule. Once you load the script into the authorization store, its source code will be displayed.
Browse | Opens the Browse dialog box so that you can browse to the file containing the script for the rule.
Script type | Specifies the scripting language used to create the rule. VBScript Specifies that the VBScript language is being used for the rule. For example, the following VBscript code always grants permission: AzBizRuleContext.BusinessRuleResult = True JScript Specifies that the JScript language is being used for the rule. For example, the following JScript always grants permission: AzBizRuleContext.BusinessRuleResult = true;
Reload Rule into Store | Reloads the rule into the store from the file provided in the Script path, and displays the source code.
Clear Rule from Store | Removes the rule from the store.

Additional considerations

  • When used to define members of an application group, a script is called a business rule. When used to define a role or task, a script is called an authorization rule.

  • The use of business rules and authorization rules on each client computer is controlled by a registry setting. In this version of Windows, rules are disabled by default. In versions of Windows earlier than Windows Server 2008, they are enabled by default. For more information, see Controlling Authorization by Using Authorization Rules and Business Rules.

  • In addition, you can also disable rules entirely for an authorization store on the Limits tab of the authorization store properties sheet. For more information, see Understanding Authorization Manager Store Limits

Additional references

  • Understanding Authorization Rules and Business Rules

  • Controlling Authorization by Using Authorization Rules and Business Rules

  • Understanding Authorization Manager Store Limits


<Group Name> Property Sheet: General Tab

The following table describes the UI elements for this property sheet.

Item Description

Name

Specifies the name of the application group, and provides a space for you to type the name.

An application group is a group of users of the application. An application group can be composed of security groups, Lightweight Directory Access Protocol (LDAP) query groups, and other application groups.

The application group name must be unique to the authorization store, and cannot contain any of the characters \ / : * ? " < > | and [Tab]. The name of a group has a maximum size limit of 64 bytes.

Description

Specifies the description of the application group, and provides a space for you to type the description.

The description does not affect the functionality of Authorization Manager. Choose a description that is meaningful to you. The description has a maximum size limit of 1,024 bytes.

Group Type

Specifies the application group type:

  • A basic group is defined by a list of members and a list of nonmembers, which are excluded from the application group.

  • An LDAP query group is built from a query in Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS).

  • A business rule application group has membership defined by a script written in either VBScript or JScript.

Additional references

  • Understanding Authorization Manager Application Groups


<Group Name> Property Sheet: Exclusions Tab

You can use this property page to exclude specific users or groups from an Authorization Manager group.

Note

This tab only appears for basic groups.

The following table describes the UI elements for this property sheet.

Item Description

Users and groups that are excluded from this group

Lists the users and groups that are excluded from this application group. Each user and group is listed with name, type, and description.

Important

Exclusion takes precedence over inclusion.

Remove

To remove a user or group from the exclusion list, select the user or group, and click Remove.

Important

Removing a user from the exclusion list will add them to the group only if they are included on the Members tab. Clicking Remove removes them from the exclusion list, not from the group.

Select additional members from

Specifies the source of members:

  • Security principals from the computer or from Active Directory Domain Services (AD DS)

  • Other groups defined in Authorization Manager

Select

Click to open a dialog box and select specific member objects.

Additional references

  • Understanding Authorization Manager Application Groups


<Group Name> Property Sheet: Members Tab

The following table describes the UI elements for this property sheet.

Item Description

Users and groups that are members of this group

Lists the users and groups that are members of this group by name, type, and description.

Remove

Removes the selected user, group, or application group.

To make the Remove button available, select an item in the list.

Select additional members from

Specifies the source of members:

  • Security principals from the computer or from Active Directory Domain Services (AD DS)

  • Other groups defined in Authorization Manager

Note

If you have installed a custom object picker, additional choices will be available. For more information, see "Additional references" in this topic.

Select

Click to open a dialog box and select specific member objects.

Additional references

  • Choose Users or Groups with a Custom Object Picker

  • Understanding Authorization Manager Application Groups


<Group Name> Property Sheet: Query Tab

You can use this property tab to define the Lightweight Directory Access Protocol (LDAP) query used by an LDAP group in Authorization Manager.

Note

The Query tab only appears for LDAP groups.

The following table describes the UI elements for this property sheet.

Item | Description
LDAP query that defines the members of this group | Lists the LDAP query or queries that define the members of this application group. You can type or paste an LDAP query into this box.

Additional references

  • Understanding Authorization Manager Application Groups


New Application Dialog Box

The following table describes the UI elements for this dialog box.

Item Description

Name

Provides a space for you to type the name of the new application (for example, "expense reporting" or "information management"). The name will be used to initialize Authorization Manager. It must be the name that the managed application uses when initializing Authorization Manager. The application name has a maximum size limit of 512 bytes. It must be unique to the authorization store, and cannot contain any of the characters \ / : * ? " < > | and [Tab].

Note

The application name specified here must be the name that the managed application uses when initializing Authorization Manager.

Description

Provides a space for you to type a description of the new application. The description does not affect the functionality of Authorization Manager and should be meaningful to you.

The description has a maximum size limit of 1,024 bytes.

Version information

Provides a space for you to type the version of the new application. The version is an optional text string that allows you to specify different versions.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions

  • User Interface: Authorization Manager


New Application Group Dialog Box

The following table describes the UI elements for this dialog box.

Item Description

Name

Provides a space for you to type the name of the new application group. An application group is a group of users of the application (for example, "Building 40 Users").

An application name must not already exist in the authorization store. It has a maximum size limit of 512 bytes. It cannot contain any of the characters \ / : * ? " < > | and [Tab].

Description

Provides a space for you to type the description of the new application group. The description does not affect the functionality of Authorization Manager and should be meaningful to you. The description has a maximum size limit of 1,024 bytes.

Group Type

Basic Application Group

Specifies that the new application group is of the basic type. The basic type of application group is based on Windows users and groups, which might include local groups, and global or universal groups that are stored in Active Directory Domain Services (AD DS).

LDAP Query Application Group

Specifies that the new application group is defined by a Lightweight Directory Access Protocol (LDAP) query. LDAP queries are used to find objects in (AD DS) and other LDAP-compliant directories. For example, the query (&(objectCategory=person)(objectClass=user)(!cn=andy)) finds everyone except Andy. The query (memberOf=CN= StatusReports,OU=Distribution Lists,DC=northwindtraders,DC=com) finds all members of the StatusReports alias at northwindtraders.com.

Business Rule Application Group

Specifies that the new application group will be defined by a business rule. Business rules are created by writing a script in VBScript or JScript.

Additional references

  • Understanding Authorization Manager Application Groups


New Authorization Store Dialog Box

This dialog box allows you to create a new authorization policy store.

The following table describes the UI elements for this dialog box.

Item Description

Select the authorization store type

Active Directory

Specifies that the new authorization store is in Active Directory Domain Services (AD DS). This type of authorization store is specified with a Lightweigt Directory Access Protocol (LDAP) distinguished name such as CN=myStore,CN=Program Data,DN=nwtraders,DN=com. You can also use a URL beginning with MSLDAP:// or MSXML://.

XML file

Specifies that the new authorization store is an XML file.

Note

XML stores do not support delegation.

Microsoft SQL

Specifies that the store is in a Microsoft SQL Server database. SQL Server database stores are specified with a URL beginning with the protocol prefix MSSQL:// followed by a connection string, database name, and policy store name in the format:

MSSQL://<connection string>/<database name>/<policy store name>

Authorization store schema

Selects between a version 1.0 schema and a version 2.0 schema. If you have client applications that have been written for version 1, you should select Schema version 1.0. For more information about schema differences, see What's New in Authorization Manager.

Store Name

Provides a space for you to type the store name.

  • If the store is an XML file, the current working directory is displayed (for example, C:\My Documents) and you can type the rest of the path and file name. If you do not type the .xml extension, it is appended when saved.

  • If the store is in AD DS, type the LDAP distinguished name (for example, CN=myStore,CN=Program Data,OU=sales,DC=northwindtraders,DC=com). The distinguished name must be valid in AD DS. You can also use a URL beginning with MSLDAP:// or MSXML://.

  • If the store is in an SQL Server database, type the URL used to access the database, in the format:

    mssql://<connection string>/<database name>/<policy store name>

Locations…

Click to browse to an authorization store location.

Additional references

  • Create an Authorization Store

  • Connect to an SQL-based Authorization Store

  • Understanding Authorization Manager Stores


New Operation Definition Dialog Box

This dialog box allows you to define a new operation. The following table describes the UI elements for this dialog box.

Item Description

Name

Provides a space for you to type the name of the new operation definition (for example, "Read Attributes").

Operations are permissions associated with security procedures. Operations are meaningful to authorization application developers, but might not be meaningful to administrators.

You are prevented from entering a name that already exists in this scope or that is too long. An operation name has a maximum size limit of 64 bytes. It cannot contain any of the characters \ / : * ? " < > | and [Tab].

Description

Provides a space for you to type the description of the new operation definition.

The description does not affect the functionality of Authorization Manager and should be meaningful to you.

You are prevented from entering a description that is too long. A description has a maximum size limit of 1,024 bytes. It cannot contain any of the characters \ / : * ? " < > | and [Tab].

Operation Number

Provides a space for you to type the operation number of the new operation definition.

The valid range of values is 0 through 2,147,483,647. The application uses the operation number to identify the operation.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


New Role Definition Dialog Box

The following table describes the UI elements for this dialog box.

Item | Description
Name | Provides a space for you to type the name of the new role definition (for example, Account Manager). A role definition is a collection of permissions in tasks and operations. You are prevented from entering a name that already exists in this scope. It cannot contain any of the characters \ / : * ? " < > | and [Tab]. The name of a role definition has a maximum size limit of 64 bytes.
Description | Provides a space for you to type the description of the new role definition. The description does not affect the functionality of Authorization Manager and should be meaningful to you. The description has a maximum size limit of 1,024 bytes.
Add | Adds a task to the role definition (for example, "Change Password"). A task is a collection of operations required to do specific types of work that are meaningful to the administrator.
Remove | Removes the selected task or role from the definition. To make this button available, click an item in the list.
The tasks and lower-level roles that define this role | Lists the tasks and specific roles that define this role. For example, a task called "Reset Password" might be part of a role called "Account Manager."
Authorization Rule | Click to create an authorization rule for the role definition. An authorization rule is written in VBscript or JScript, and makes an authorization decision based on application group membership and the application-specific data that is relevant and current when the script is run.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


New Scope Dialog Box

A scope is a collection of objects or resources with their own authorization policy. A scope is used within an application to limit authorization policy.

The following table describes the UI elements for this dialog box.

Item Description

Name

Provides a space for you to type the name of the new scope (for example, *.txt, C:\temp, or Computers in Sales Department).

The scope name must be recognized by the application and must be resolvable by the application at the time of the access check. The name must contain only printable characters.

Scope names can be very long (maximum limit of 64 KB of information). Because scopes cannot be nested, some developers use a naming convention for scopes that results in long names.

However, if you try to enter a name that is longer than 64 KB, you will receive an error. In addition, the name cannot be a name that is already used by the application.

Description

Provides a space for you to type the description of the new scope.

The description does not affect the functionality of Authorization Manager and should be meaningful to you.

The description has a maximum size limit of 1,024 bytes.

Additional references

  • Understanding Authorization Manager Scopes


New Task Dialog Box

A task is a collection of operations or other tasks that are meaningful to an administrator as a unit of work requiring authorization. By contrast, operations might be meaningful only to application developers.

The following table describes the UI elements for this dialog box.

Item | Description
Name | Provides a space for you to type the name of the new task. You are prevented from entering a name that already exists in this scope. It cannot contain any of the characters \ / : * ? " < > | and [Tab]. The name of a task has a maximum size limit of 64 bytes.
Description | Provides a space for you to type the description of the new task. The description does not affect the functionality of Authorization Manager and should be meaningful to you. The description has a maximum size limit of 1,024 bytes.
The operations and lower-level tasks that define this task | Lists the operations and specific tasks that define this task.
Add | Adds a task to the list.
Remove | Removes the selected task or operation from the list. To make this button available, select an item in the list.
Authorization Rule | Click to set an authorization rule for the task definition. An authorization rule determines whether the task is allowed. For example, the following VBScript always grants permission: AzBizRuleContext.BusinessRuleResult = True

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


Open Authorization Store Dialog Box: Active Directory Browse

This dialog box displays the Authorization Manager stores available in Active Directory Domain Services (AD DS).

Note

In Authorization Manager, there is neither a default authorization store nor a default application.

Select the desired store, and click OK.

Additional references

  • Understanding Authorization Manager Stores


Open Authorization Store Dialog Box

The following table describes the UI elements for this dialog box.

Item | Description
Select the authorization store type | Specifies the format of the authorization policy store to be opened. Authorization Manager supports the use of authorization policy stores based on Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), XML files, or Microsoft SQL Server databases.
Store Name | Specifies the URL or file system path to the authorization policy store to be opened.
Browse | Allows you to locate or choose a store if the store type supports browsing.

Additional references

  • Understanding Authorization Manager Stores


<Operation Name> Properties Dialog Box

Operations are permissions that are associated with security procedures. Operations are meaningful to authorization application developers, but might not be meaningful to administrators (for example, to read or write attributes of an object).

The following table describes the UI elements for this dialog box.

Item | Description
Name | Provides a space to type the name of the operation definition. The operation name must be unique to the authorization store. The name of an operation has a maximum size limit of 64 bytes.
Description | Provides a space to type the description of the operation. The description does not affect the operation of Authorization Manager, so you should enter text that is meaningful to you.
Operation number | Provides a space to type the operation number of the operation definition. The application uses the operation number to identify the operation. The value can range from 1 to 2,147,483,647.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


Options Dialog Box

The Authorization Manager console operates in either developer mode or administrator mode. Administrator mode is the default.

Before you can use administrator mode, you need to provide an application that supports roles, includes all of the necessary operation and task definitions, includes its own authorization store, and is ready for use in Authorization Manager.

After you set up an application in developer mode, you do not have to use Authorization Manager in developer mode for that application.

Developer mode

In developer mode, you can create, deploy, and maintain applications. With developer mode, you have unrestricted access to all features.

You must be in developer mode to do any of the following tasks:

  • Create new authorization stores

  • Create new applications

  • Define or modify operations

  • Change an application name

  • Change the version information for an application

  • Delete an application

Administrator mode

In administrator mode, you can deploy and maintain applications.

Additional references

  • Set Authorization Manager Options

  • Overview of Authorization Manager


<Role Name> Property Sheet: General Tab

The following table describes the UI elements for this dialog box.

Item Description

Name

Provides a space for you to type the name of the role definition.

You are prevented from entering a name that already exists in this scope or that is too long. A role name has a size limit of 64 bytes.

Description

Provides a space for you to type the description of the role definition.

The description does not affect the functionality of Authorization Manager and should be meaningful to you.

A description has a size limit of 1,024 bytes. You are prevented from entering a description that is too long.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


<Role Name> Property Sheet: Definition Tab

The following table describes the UI elements for this dialog box.

Item | Description
The tasks and lower-level roles that define this role | Lists the tasks and specific roles that define this role.
Add | Adds a task to the list.
Remove | Removes the selected task or role from the list. To make this button available, click an item in the list.
Authorization Rule | Allows you to set an authorization rule for the role definition. An authorization rule determines whether the role is allowed (for example, the following VBScript always grants permission: AzBizRuleContext.BusinessRuleResult = True)

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


<Role Assignment> Property Sheet

The following table describes the UI elements for this dialog box.

Item Description

Name

Provides a space for you to type the name of the role assignment.

The name does not affect the functionality of Authorization Manager and should be meaningful to you.

A role assignment name has a size limit of 64 bytes. You are prevented from entering a name that is too long.

Description

Provides a space for you to type the description of the role assignment.

The description does not affect the functionality of Authorization Manager and should be meaningful to you.

A description has a size limit of 1,024 bytes. You are prevented from entering a description that is too long.

Additional references

  • Understanding Authorization Manager Role Assignments


<Scope Name> Property Sheet

A scope is used within an application to limit authorization policy if that authorization policy should not be used outside the scope.

The following table describes the UI elements for this dialog box.

Item Description

Name

Provides a space for you to type the name of the scope (for example, "*.txt, C:\temp, and Computers in Sales Department").

The scope name must be recognized by the application and must be resolvable by the application at the time of the access check. The name must contain only printable characters.

Scope names can be very long. They have a maximum size limit of 64 KB.

Because scopes cannot be nested, some developers use a naming convention for scopes that results in long names. However, if you try to enter a name that is longer than 64 KB, you will receive an error.

The name also cannot be already in use in the application.

Description

Provides a space for you to type the description of the scope.

The description does not affect the functionality of Authorization Manager. Choose a description that is meaningful to you. The description has a maximum size limit of 1,024 bytes.

Additional references

  • Understanding Authorization Manager Scopes


<Store Name> Property Sheet: General Tab

The following table describes the UI elements for this dialog box.

Item Description

Name

Shows the name and location of the authorization store.

If the store is an XML file, the full path is displayed. If the store is in Active Directory Domain Services (AD DS), the Lightweight Directory Access Protocol (LDAP) distinguished name of the store is displayed. If the store is a Microsoft SQL Server store, the path to the store is displayed as a URL beginning with MSSQL://.

Description

Provides a space for you to type a description of the authorization store.

The description does not affect the functionality of Authorization Manager. Choose a description that is meaningful to you.

Store Type

Shows the store type.

  • XML stores are file-based and do not support delegation.

  • AD DS stores keep their data in AD DS and are specified with an LDAP distinguished name or a URL beginning with MSLDAP://.

  • SQL-based stores keep their data in a Microsoft SQL Server database and are specified with a URL beginning with MSSQL://

Store schema version

Shows the schema version of the store. Version 2.0 was introduced in Windows Server 2008.

Applications written for version 1.0 cannot use authorization stores with schema version 2.0.

Applications written for version 2.0 can use older schemas as well.

If the store is a version 1.0 store, you can upgrade the schema from version 1.0 to version 2.0.

Upgrade Schema Version

Allows you to upgrade the schema of the store to version 2.0.

Caution

A schema upgrade cannot be reversed.

Note

This button does not appear if the store is already a schema version 2.0 store.

Additional references

  • Understanding Authorization Manager Stores

  • What's New in Authorization Manager

  • Change the Properties of an Authorization Store


<Store Name> Property Sheet: Limits Tab

The following table describes the UI elements for this dialog box.

Item Description

Authorization rules

Allows you to specify the behavior of authorization rules defined in this store.

You can choose to disable all authorization rules. If rules are enabled, you can specify a timeout value to limit the amount of time the system will wait for an authorization rule script to complete. The following settings are available:

  • Disable

  • Enable with no timeout value

  • Enable with specified timeout value

Authorization rule timeout

Specifies the authorization rule timeout, and provides a space for you to type the authorization rule timeout.

The value is specified in milliseconds. The value can range from 5,000 to 2,147,483,647. The default value of 45,000 milliseconds (45 seconds) or less is recommended.

Note

If you set the authorization rule timeout to 0, Authorization Manager will not use any authorization rules.

Maximum number of cached authorization rules

Specifies the maximum number of cached authorization rules, and provides a space for you to type the maximum number of cached authorization rules. The value can range from 0 to 2,147,483,647. The default value of 120 is recommended.

LDAP query timeout

Specifies the Lightweight Directory Access Protocol (LDAP) query timeout, and provides a space for you to type the LDAP query timeout. The value is specified in milliseconds. The value can range from 500 to 2,147,483,647. The default value of 15,000 milliseconds (15 seconds) is recommended.

Use Default values

Sets the LDAP query timeout, the authorization rule timeout, and the maximum number of cached authorization rules to their default values.

Additional references

  • Understanding Authorization Manager Stores

  • Understanding Authorization Manager Store Limits


<Store Name> Property Sheet: Security Tab

The following table describes the UI elements for this dialog box.

Item Description

Authorization Manager user role

Click the arrow to choose either Administrator or Reader. The property sheet will then show the users and groups assigned as either Administrator or Reader for this store.

Readers can read the store and its attributes, and can perform access checks by using the data in the authorization store.

Administrators can do everything Readers can do, and they can also change the authorization store contents and content attributes.

Users and groups that are assigned to this role

Lists the users and groups that are assigned to this role.

Add

Click to add users or groups.

You can select security principals (users, security groups, and computers) from the local computer, the Active Directory forest, or other trusted domains.

Remove

Click to remove the selected user or group.

To make the Remove button available, click an item in the list.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions

  • User Interface: Authorization Manager


<Task Name> Definition Property Sheet: General Tab

The following table describes the UI elements for this dialog box.

Item | Description
Name | Provides a space for you to type the name of the task. You are prevented from entering a name that already exists in this scope. The name of a task has a maximum size limit of 64 bytes.
Description | Provides a space for you to type the description of the task. The description does not affect the functionality of Authorization Manager. Choose a description that is meaningful to you. The description has a maximum size limit of 1,024 bytes.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


<Task Name> Definition Property Sheet: Definition Tab

The following table describes the UI elements for this dialog box.

Item | Description
The operations and lower-level tasks that define this task | Lists the operations and specific tasks that define this task.
Add | Click to add a task. A task is a collection of operations required to do work that requires authorization.
Remove | Click to remove the selected task or operation. To make the Remove button available, click an item in the list.
Authorization Rule | Click to set the authorization rule for the task.
OK | Click to close the dialog box and save any changes you have made.
Cancel | Click to close the dialog box without saving any changes you have made.
Apply | Click to save all the changes you have made without closing the dialog box.

Additional references

  • Understanding Authorization Manager Role, Task, and Operation Definitions


Command-line syntax notation

The following table describes the notation used to indicate command-line syntax.

Notation | Description
Text without brackets or braces | Items you must type as shown
<Text inside angle brackets> | Placeholder for which you must supply a value
[Text inside square brackets] | Optional items
{Text inside braces} | Set of required items; choose one
Vertical bar (|) | Separator for mutually exclusive items; choose one
Ellipsis (…) | Items that can be repeated