RoleAssignmentsAccessModifier Class

The access modifier controls access to resource assignment data objects. A resource assignment is accessible for a user if: - It belongs to his own identity (if ACCESSMODE=SELF) - He is manager of the identity which the resource assignment is for (if ACCESSMODE contains MANAGER) - He owns a context which the resource assignment is granted for (if ACCESSMODE contains OWNEDCONTEXTS) - He is owner of the role which the resource assignment is for (if ACCESSMODE contains ROLEOWNER) - He is owner of the system which the assigned resource belongs to (if ACCESSMODE contains SYSTEMOWNER) - ACCESSMODE is set to ALL

The following only applies if ACCESSMODE=ALL: The SYSTEM user have READ+UPDATE access to all role assignments. Members of the built-in Administrators group by default have READ+UPDATE access to all role assignments as well. This can, however, be changed by using the ADMINGROUPS parameter. All others (non-admins) have only READ access (in case they have access at all).

The access modifier supports the parameter STATUS. The value of STATUS must be a comma delimited string with one or more of these values: PENDING, INACTIVE, ACTIVE, REJECTED, OBSOLETE, DISABLED, LOCKED, ALL If STATUS is not specified it is treated as ALL.

The access modifier supports the parameter ACCESSMODE. The value of ACCESSMODE must be a comma delimited string with one or more of these values: SELF, MANAGER, OWNEDCONTEXTS, ROLEOWNER, SYSTEMOWNER, ALL If ACCESSMODE is not specified it is treated as ALL.

--- ADMINGROUPS is deprecated! Use the RoleAssignmentsAccessModifier authorization element to control permissions --- The following only applies if ACCESSMODE=ALL: The access modifier supports the parameter ADMINGROUPS which can be used to specify a number of user groups who's members should have READ+UPDATE access to all role assignments. The value of ADMINGROUPS must be a comma delimited string with user group uids. If ADMINGROUPS is not specified then the value defaults to the built-in Administrators group. If ADMINGROUPS is specified then the built-in Administrators group must be included in order to have READ+UPDATE access. --- ADMINGROUPSKEY is deprecated! Use the RoleAssignmentsAccessModifier authorization element to toggle Admin permissions --- The access modifier also supports the parameter ADMINGROUPSKEY which works in the same way except that the value must be the key of a customer setting which holds a comma delimited string with user group uids.

--- ADMINGROUPS is deprecated! Use the RoleAssignmentsAccessModifier authorization element to control permissions --- The following only applies if ACCESSMODE=ALL: The access modifier supports the parameter READERGROUPS which can be used to specify a number of user groups who's members should have READ access to all identities. The value of READERGROUPS must be a comma delimited string with user group uids. --- READERGROUPSKEY is deprecated! Use the RoleAssignmentsAccessModifier authorization element to toggle Read permissions --- The access modifier also supports the parameter READERGROUPSKEY which works in the same way except that the value must be the key of a customer setting which holds a comma delimited string with user group uids.