Defining the authorization scheme

Review the following tasks for the solution:

Assign Access Groups and roles

This task involves assigning Access Groups and roles for an application.

System-generated roles

The New Application wizard creates a DeliveryService:Administrator / DeliveryService:Authors role and two user roles: DeliveryService:User and DeliveryService:Manager.

Users with the DeliveryService:User role can open any Case in the application and perform any Assignment. In the user-specific role, you can provide the ability to create and update reports, delegated Rules, and Work Groups.

Create delivery service Personas

When you create Personas associated with the Delivery service, the system automatically creates corresponding Access Groups and Access Roles.

Create the following Personas; permissions and privileges are granted based on the Personas. Save the roles to the DeliveryService Ruleset.

1. DeliveryService:User4 is dependent on MDC:User4
2. MDC:User4 is dependent on PegaRULES:User4
3. DeliveryService:Guest is dependent on MDC:Guest
4. MDC:Guest is dependent on PegaRules:Guest

Create MDC Delivery Service Work Groups

Create the following Workgroups for each department because work is often assigned to them. Save the Work Groups to the DeliveryService Ruleset.

Update the Personas with the corresponding Work Groups.

Use attribute-based access control (ABAC) to configure your authorization scheme. 

Restrict access to financial information by using ABAC

To restrict access to the financial information as described in the scenario, perform the following actions:

• Create IsAccountant and IsCityManager Access When records to test if a user belongs to the Accountant or CityManager Access Group.
• Create a CityManagerAndAccountant access control policy condition that references your new Access When records.
• Create a RestrictFinancialInformation read properties access control policy that references your new access control policy condition. Users defined in the RestrictFinancialInformation access control policy condition can view the invoice data records.

Create City Manager and Accountant Access When records

1. In the Records Explorer, expand the Security category.
2. Select the Access When record type.
3. Click Create.
4. On the new record form, enter the following information:
   1. In the Label field, enter IsCityManager.
   2. In the Apply to list, enter MDC.
   3. In the Add to ruleset field, enter DeliveryServiceAuthorization.
5. Click Create and open to create the new Access When record.
6. On the Conditions tab, enter the following When expression:

   pxThread.pxCurrentAccessGroup = "DeliveryService:CityManager".

   The following figure shows the completed Conditions tab:

   
7. Save the new IsCityManager access When record.
8. Repeat steps 1-3.
9. On the new record form, enter the following information:
   1. In the Label field, enter IsAccountant.
   2. In the Apply to list, enter MDC.
   3. In the Add to ruleset field, enter DeliveryServiceAuthorization.
10. Click Create and open to create the new access when record.
11. On the Conditions tab, enter the following When expression:

    pxThread.pxCurrentAccessGroup = "DeliveryService:Accountant"

    The following figure shows the completed Conditions tab:

12. Save the new IsAccountant Access When record.

Create an CityManagerAndAccountant access control policy condition

1. Open the Records Explorer.
2. Expand the Security category.
3. Select Access Control Policy Condition record types.
4. Click Create.
5. On the new record form, enter the following information:
   1. In the Label field, enter CityManagerAndAccountant.
   2. In the Apply to list, enter MDC-Data-Invoice.
   3. In the Add to ruleset field, enter DeliveryServiceAuthorization.
6. Click Create and open to create the new CityManagerAndAccountant access control policy condition.
7. On the Definition tab of the access control policy condition, in the Conditional Logic section, add the IsCityManager and IsAccountant Access When records that you created.
8. Optional: In the Policy Conditions section, specify a condition that always returns false to ensure that access is only provided if one of the Access When Rules evaluates to true.
9. Save the new CityManagerAndAccountant access control policy condition record.

   The following figure shows the completed Definition tab:

Create a RestrictFinancialInformation access control policy

1. Open the Records Explorer.
2. Expand the Security category.
3. Select Access Control Policy record types.
4. Click Create.
5. On the new record form, enter the following information:
   1. In the Label field, enter RestrictFinancialInformation.
   2. In the Action field, enter PropertyRead.
   3. In the Apply to list, enter MDC-Data-Invoice.
   4. In the Add to ruleset field, enter DeliveryServiceAuthorization.
6. Click Create and open to create the new RestrictFinancialInformation access control policy.
7. On the Definition tab of the access control policy, in the Permit access if field, enter the CityManagerAndAccountant policy control condition that you created.

The following figure shows the completed Definition tab:

8. Save the new RestrictFinancialInformation access control policy.

Each persona must have access to intended Cases and data objects only. 

1. In the navigation pane of App Studio, click Users, as shown in the following figure:
   
2. On the Personas tab, select the required Persona from the list, as shown in the following figure:

3. Change the roles for selected persona.
   
4. Update the Cases for which external user access is required, and then ensure that you remove access to other Cases, as shown in the following figure:
   
5. Update the data objects for which access is required.
   
6. Update the security of the other Personas in App Studio.

1. Log in as a registered business partner, and then create a Delivery request.
2. Wait for the job scheduler to assign a truck or manually run the utility of the job scheduler for test purposes.
3. As a city manager of the corresponding city for which the delivery request is submitted, complete the Pickup and Delivery Steps of the Truck request to generate an Invoice Case.
   Truck requests for other cities must not be visible or accessible through search.
4. Log in as an accountant, and then provide the required approval for the Invoice of Delivery and Truck requests.
5. As a business partner, complete the payment on the Delivery request.
6. As a city manager, complete the feedback on the truck.

Throughout the process, the City Manager and Accountant should not have access to the Cases and data related to other cities.