Authorization Manager

Authorization Manager provides a flexible framework for integrating role–based access control into applications. It enables administrators who use those applications to provide access through assigned user roles that relate to job functions. Authorization Manager applications store authorization policy in the form of authorization stores that are stored in Active Directory or XML files and apply authorization policy at runtime.

  • Before using Authorization Manager, see Checklist: Before you start using Authorization Manager.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


Checklist: Before you start using Authorization Manager

Step | References
Review fundamental security concepts. | Security
Review related tools such as the Delegation of Control Wizard for comparison with Authorization Manager. | Delegating administration; Comparing Authorization Manager to other management tools
Read background material about Authorization Manager. | Concepts
Read about the difference between administrator mode and developer mode in Authorization Manager. | Using developer mode and administrator mode in Authorization Manager; To set Authorization Manager options
Learn about authorization stores and applications, and about the difference between authorization stores that are stored as XML files and authorization stores that are stored in Active Directory. | Authorization Stores and Applications
(For developers) Review the latest information about Authorization Manager and authorization-related application programming interfaces (APIs) in the Platform SDK. | MSDN Library at the Microsoft Web site (http://msdn.microsoft.com/); TechNet at the Microsoft Web site (http://www.microsoft.com/); Platform SDK at the Microsoft Web site (http://msdn.microsoft.com/)
Before you can use Authorization Manager for authorization stores that are stored in Active Directory, you must raise the Active Directory domain functional level to Windows Server 2003.

Caution

  • Raising the domain functional level is an irreversible step.
 Domain and forest functionality; To raise the domain functional level; Raising domain and forest functional levels
Open Authorization Manager. | To start Authorization Manager


How to...

  • Start Authorization Manager
  • Set Authorization Manager options
  • Assign an application group to a role
  • Assign a Windows user or group to a role
  • Add an authorization rule
  • Refresh Authorization Manager
  • Reload an authorization store
  • Work with authorization stores
  • Work with applications
  • Work with role, task, and operation definitions
  • Work with scopes


Start Authorization Manager

Microsoft Windows Graphic

To start Authorization Manager

  • Open Authorization Manager.

Notes

  • XOX
  • To open Authorization Manager at a command prompt, type:

    azman.msc

    XOX

  • Authorization Manager opens without a default authorization store. To use Authorization Manager, you need to create or open an authorization store. For more information, see Related Topics.
  • If you want to configure your own Microsoft Management Console (MMC) and include Authorization Manager as part of that console, see Related Topics. If you create and save your own MMC console, it opens to the configuration at the time you saved the file. It can open to an authorization store.

Related Topics


Set Authorization Manager options

To set Authorization Manager options

  1. Open Authorization Manager.
  2. In the console tree, right-click Authorization Manager, and then click Options.
  3. In the Options dialog box, click either Developer mode or Administrator mode.

Notes

  • XOX
  • In developer mode, you can create, deploy, and maintain applications. With developer mode, you have unrestricted access to all features.
  • In administrator mode, you can deploy and maintain applications. With administrator mode, you have access most Authorization Manager features. In administrator mode, you cannot do the following:
    • Create new authorization stores
    • Create new applications
    • Define or modify operations
    • Change an application name
    • Change the version information for an application
  • Administrator mode is the default. Before you can use administrator mode, you need to provide an application that supports roles, includes all of the necessary operation and task definitions, includes its own authorization store, and is ready for use in Authorization Manager. After you set up an application in developer mode, you do not have to use Authorization Manager in developer mode for that application. You can work in authorization mode instead.


Assign an application group to a role

To assign an application group to a role

  1. Open Authorization Manager.
  2. In the console tree, right-click the role to which you want to assign the application group, and then click Assign Application Groups. The role can be at the application or scope level.

    Application level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Role Assignments
    • Role

    Scope level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
    • Roles Assignments
    • Role
  3. In the Add Groups dialog box, select the check boxes next to the application groups that you want to add.

Notes

  • XOX
  • This is one of the most common Authorization Manager procedures for administrators.
  • To carry out this procedure, a role assignment needs to exist. For more information about creating a role assignment, see Related Topics.


Assign a Windows user or group to a role

To assign a Windows user or group to a role

  1. Open Authorization Manager.
  2. In the console tree, right-click the role to which you want to assign a user or group, and then click Assign Windows Users and Groups. The role can be at the application or scope level.

    Application level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Role Assignments
    • Role

    Scope level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
    • Roles Assignments
    • Role
  3. In the Select Users, Computers, or Groups dialog box, type the name of the user or group that you want to assign to the role.
  4. Click Check Names, and then click OK.

Notes

  • XOX
  • This is one of the most common Authorization Manager procedures for administrators.
  • To carry out this procedure, a role assignment needs to exist. For more information about creating a role assignment, see Related Topics.


Add an authorization rule

To add an authorization rule

  1. Open Authorization Manager.
  2. In the console tree, right-click the role definition or task definition to which you want to add an authorization rule, and then click Properties. The role or task definition can be at the application or scope level.

    Application level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Definitions
    • Role Definitions (or Task Definitions)
    • Role definition (or Task definition)

    Scope level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
    • Definitions
    • Role Definitions (or Task Definitions)
    • Role definition (or Task definition)
  3. Click the Definition tab, and then click Authorization Rule.
  4. In the Authorization Rule dialog box, in Script path, type the complete path to the authorization rule, including the file name extension.
  5. Under Script type, do one of the following:
    • If your script has a .vbs file name extension, click VBScript.
    • If your script has a .js file name extension, click JScript.

Notes

  • XOX
  • To perform this procedure, you need a role definition or a task definition. For more information about creating a role assignment, see Related Topics.


Refresh Authorization Manager

To refresh Authorization Manager

  1. Open Authorization Manager.
  2. In the console tree, right-click the item that you want to refresh, and then click Refresh.

Notes

  • XOX
  • This procedure updates the user interface from the authorization store cache. If more than one process is modifying an authorization store and you refresh an item in Authorization Manager, the refreshed item might remain unsynchronized with the authorization store. To synchronize Authorization Manager with an actual authorization store, not just the cached copy, see Related Topics.


Reload an authorization store

To reload an authorization store

  1. Open Authorization Manager.
  2. In the console tree, right-click the authorization store that you want to reload, and then click Reload.

Notes

  • XOX
  • This procedure updates Authorization Manager from the authorization store, not from the cache. If you want do a faster update that might be less thorough, see Related Topics.


Work with authorization stores

  • Create an authorization store
  • Edit the properties of an authorization store
  • Create a group within an authorization store
  • Edit the properties of a group within an authorization store
  • Delegate an authorization store
  • Audit an authorization store


Create an authorization store

To create an authorization store

  1. Open Authorization Manager.
  2. In the console tree, right-click Authorization Manager, and then click Options.
  3. In the Options dialog box, click Developer mode.
  4. In Authorization Manager, right-click Authorization Manager, and then click New Authorization Store.
  5. In the New Authorization Store dialog box, click either Active Directory or XML file.
  6. In Store name, type the authorization store name or click Locations to find the authorization store.
  7. (Optional) In Description, type a description for the new authorization store.

Notes

  • XOX
  • To perform this procedure, you must be working in developer mode.
  • If you are using an authorization store that is stored in Active Directory, use the LDAP name (for example, CN=myStore,CN=Program Data,DN=nwtraders,DN=com). If you are using an XML–based authorization store, use a path and file name that is valid at runtime (for example, C:\AuthStores\MyStore.xml).


Edit the properties of an authorization store

To edit the properties of an authorization store

  1. Open Authorization Manager.
  2. In the console tree, right-click the authorization store that you want to edit, and then click Properties.
  3. In the Properties dialog box, modify the settings that you want to change.

Notes

  • XOX
  • To perform this procedure, you need to have access to an authorization store. For more information, see Related Topics.


Create a group within an authorization store

To create a group within an authorization store

  1. Open Authorization Manager.
  2. In the console tree, right-click Groups, and then click New Application Group.

    Where?

    • Authorization Manager
    • Authorization store
    • Groups
  3. In the New Application Group dialog box, in Name, type a name for the group.
  4. In Description, type a description for the group.
  5. In Group type, click Basic or LDAP query.

Notes

  • XOX
  • To perform this procedure, you need access to an authorization store. For more information, see Related Topics.


Edit the properties of a group within an authorization store

To edit the properties of a group within an authorization store

  1. Open Authorization Manager.
  2. In the console tree, right-click the group that you want to edit, and then click Properties.

    Where?

    • Authorization Manager
    • Authorization store
    • Groups
    • Group
  3. In the Properties dialog box, modify the settings that you want to change.

Notes

  • XOX
  • To perform this procedure, you need to have access to an authorization store. For more information, see Related Topics.


Delegate an authorization store

To delegate an authorization store

  1. Open Authorization Manager.
  2. In the console tree, right-click Authorization Manager, and then click Open Authorization Store.
  3. In the Open Authorization Store dialog box, click Active Directory.
  4. Click Browse, find the authorization store that you want, double-click it, and then click OK.
  5. In the console tree, right-click the authorization store, and then click Properties.
  6. In the Properties dialog box, click the Security tab.
  7. Under Authorization Manager user role, click Administrator.
  8. Under Users and groups that are assigned to this role, click Add or Remove to add or remove users and groups to which you want to assign the Administrator role.

Notes

  • XOX
  • XML–based authorization stores, applications, and scopes do not support delegation.


Audit an authorization store

To audit an authorization store

  1. Open Authorization Manager.
  2. In the console tree, right-click the authorization store that you want to audit, and then click Properties.
  3. In the Properties dialog box, click the Auditing tab, and then do one or both of the following:
    • To audit runtime application initialization, select the Runtime application initialization auditing check box.
    • To audit authorization store changes, select the Authorization store change auditing check box.

Notes

  • XOX
  • To audit an authorization store, you must have specific privileges and security settings. For more information, see Related Topics.
  • To perform this procedure, you need to have access to an authorization store. For more information, see Related Topics.


Work with applications

  • Create an application
  • Edit the properties of an application
  • Create a group within an application
  • Edit the properties of a group within an application
  • Create a role assignment within an application
  • Edit the properties of a role assignment within an application
  • Delegate an application
  • Audit an application


Create an application

To create an application

  1. Open Authorization Manager.
  2. In the console tree, right-click Authorization Manager, and then click Options.
  3. In the Options dialog box, click Developer mode, and then click OK.
  4. In the console tree, right-click the authorization store for which you want to create an application, and then click New Application.
  5. In the New Application dialog box, in Name, type a name for the application.
  6. In Description, type a description for the application.
  7. (Optional) In Version information, type the application version information.

Notes

  • XOX
  • To perform this procedure, you need an authorization store. For more information, see Related Topics.


Edit the properties of an application

To edit the properties of an application

  1. Open Authorization Manager.
  2. In the console tree, right-click Authorization Manager, click Options.
  3. In the Options dialog box, click Developer mode, and then click OK.
  4. In the console tree, right-click the application that you want to edit, and then click Properties.

    Where?

    • Authorization Manager
    • Authorization store
    • Application
  5. In the Properties dialog box, modify the settings that you want to edit.

Notes

  • XOX
  • To perform this procedure, you need to use an existing authorization store that contains an application. For more information, see Related Topics.


Create a group within an application

To create a group within an application

  1. Open Authorization Manager.
  2. In the console tree, right-click Groups, and then click New Application Group.

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Groups
  3. In the New Application Group dialog box, in Name, type a name for the group.
  4. In Description, type a description for the group.
  5. Under Group type, click Basic or LDAP query.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application. For more information, see Related Topics.


Edit the properties of a group within an application

To edit the properties of a group within an application

  1. Open Authorization Manager.
  2. In the console tree, double-click the group that you want to edit.

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Groups
    • Group
  3. In the Properties dialog box, modify the settings that you want to change.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application, and the application must contain a group. For more information, see Related Topics.


Create a role assignment within an application

To create a role assignment within an application

  1. Open Authorization Manager.
  2. In the console tree, right-click Role Assignments, and then click Assign Roles.

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Role Assignments
  3. In the Add Role dialog box, select the check boxes for the role definitions that you want to add.

Notes

  • XOX
  • If you have not defined any roles, the Add Role dialog box will not contain any role definitions.
  • To perform this procedure, you need to use an authorization store that contains an application. For more information, see Related Topics.


Edit the properties of a role assignment within an application

To edit the properties of a role assignment within an application

  1. Open Authorization Manager.
  2. In the console tree, right-click the role assignment that you want to edit, and then click Properties.

    3. Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Role Assignments
    • Role assignment
  3. In the Properties dialog box, modify the settings that you want to change.
  4. (Optional) To edit the role definition upon which the role assignment is based, do the following:
    • In the Properties dialog box, click Show Definition.
    • In the Definition Properties dialog box, modify the settings that you want to change.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application. For more information, see Related Topics.


Delegate an application

To delegate an application

  1. Open Authorization Manager.
  2. In the console tree, right-click the authorization store that contains the application that you want to delegate, and then click Properties.
  3. In the Properties dialog box, click the Security tab.
  4. On the Security tab, under Authorization Manager user role, click Delegated Users.
  5. Under Users and groups that are assigned to this role, click Add or Remove to add or remove users and groups.
  6. In Authorization Manager, right-click the application that you want to delegate, and then click Properties.

    Where?

    • Authorization Manager
    • Authorization store
    • Application
  7. In the Properties dialog box, click the Security tab.
  8. On the Security tab, under Authorization Manager user role, click Administrator.
  9. Under Users and groups that are assigned to this role, click Add or Remove to add or remove users and groups to which you want to assign the Administrator role.

Notes

  • XOX
  • XML–based authorization stores, applications, and scopes do not support delegation.


Audit an application

To audit an application

  1. Open Authorization Manager.
  2. In the console tree, right-click the application that you want to audit, and then click Properties.

    3. Where?

    • Authorization Manager
    • Authorization store
    • Application
  3. In the Properties dialog box, click the Auditing tab, and then do any of the following:
    • To audit runtime client context and access checks, select the Runtime client context and access check auditing check box.
    • To audit authorization store changes, select the Authorization store change auditing check box. This check box only exists for authorization stores that are stored in Active Directory.

Notes

  • XOX
  • To audit your applications, you must have specific privileges and security settings. For more information, see Related Topics.
  • To perform this procedure, you need to use an authorization store that contains an application. For more information, see Related Topics.


Work with role, task, and operation definitions

  • Create an operation definition
  • Edit an operation definition
  • Create a task definition
  • Edit a task definition
  • Create a role definition
  • Edit a role definition


Create an operation definition

To create an operation definition

  1. Open Authorization Manager.
  2. In the console tree, right-click Authorization Manager, and then click Options.
  3. In the Options dialog box, click Developer mode, and then click OK.
  4. In the console tree, right-click Operation Definitions, and then click New Operation Definition.

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Definitions
    • Operation Definitions
  5. In the New Operation dialog box, in Name, type a name for the operation definition.
  6. In Description, type a description for the operation definition.
  7. In Operation number, type the specific number from 0 to 2147483647 that the application uses to identify the operation.

Notes

  • XOX
  • To perform this procedure, you must be working in developer mode. For more information about developer mode, see Related Topics.
  • To perform this procedure, you need to use an authorization store that contains an application. For more information, see Related Topics.


Edit an operation definition

To edit an operation definition

  1. Open Authorization Manager.
  2. In the console tree, right-click Authorization Manager, and then click Options.
  3. In the Options dialog box, click Developer mode, and then click OK.
  4. In the console tree, double-click the operation definition that you want to edit.

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Definitions
    • Operation Definitions
    • Operation definition
  5. In the Definition Properties dialog box, modify the settings that you want to change.

Notes

  • XOX
  • To perform this procedure, you must be working in developer mode. For more information about developer mode, see Related Topics.
  • To perform this procedure, you need to use an authorization store that contains an application. For more information, see Related Topics.


Create a task definition

To create a task definition

  1. Open Authorization Manager.
  2. In the console tree, right-click Task Definitions, and then click New Task Definition. The Task Definitions folder can be at the application or scope level.

    Application level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Definitions
    • Task Definitions

    Scope level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
    • Definitions
    • Task Definitions
  3. In the New Task dialog box, in Name, type a name for the task.
  4. In Description, type a description of the task.
  5. (Optional) Specify any tasks, operations, and authorization rules that you want to include.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application. The application can contain a scope. For more information, see Related Topics.


Edit a task definition

To edit a task definition

  1. Open Authorization Manager.
  2. In the console tree, double-click the task definition that you want to edit. The task definition can be at the application or scope level.

    Application level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Definitions
    • Task Definitions
    • Task definition

    Scope level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
    • Definitions
    • Task Definitions
    • Task definition
  3. In the Definition Properties dialog box, modify the settings that you want to change.
  4. Click the Definition tab, and then select any tasks, operations, and authorization rules that you want to include.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application, and the application must contain a scope. For more information, see Related Topics.


Create a role definition

To create a role definition

  1. Open Authorization Manager.
  2. In the console tree, right-click Role Definitions, and then click New Role Definition. The Role Definitions folder can be at the application or scope level.

    Application level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Definitions
    • Role Definitions

    Scope level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
    • Definitions
    • Role Definitions
  3. In the New Role dialog box, in Name, type a name for the role.
  4. In Description, type a description of the role.
  5. (Optional) Specify any operations, tasks, roles, and authorization rules that you want to include.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application. The authorization store can also contain an application that contains a scope. For more information, see Related Topics.


Edit a role definition

To edit a role definition

  1. Open Authorization Manager.
  2. In the console tree, double-click the role definition that you want to edit. The role definition can be at the application or scope level.

    Application level

    Where?

    • Authorization Manager
    • Authorization Store
    • Application
    • Definitions
    • Role Definitions
    • Role definition

    Scope level

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
    • Definitions
    • Role Definitions
    • Role definition
  3. In the Definition Properties dialog box, modify the settings that you want to change.
  4. Click the Definition tab, and then select any operations, tasks, roles, and authorization rules that you want to include.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application, or both an application and a scope. For more information, see Related Topics.


Work with scopes

  • Create a scope
  • Edit the properties of a scope
  • Create a role assignment within a scope
  • Edit the properties of a role assignment within a scope
  • Delegate a scope
  • Audit a scope


Create a scope

To create a scope

  1. Open Authorization Manager.
  2. In the console tree, right-click the application within which you want to create the scope, and then click New Scope.

    3. Where?

    • Authorization Manager
    • Authorization store
    • Application
  3. In the New Scope dialog box, in Name, type a name for the scope.
  4. (Optional) In Description, type a description for the scope, and then click OK.

Important

  • The scope name must be recognized by the application, and the application must resolve the name at the time of the access check. Following are some examples of scope names: "*.txt", "C:\temp", and "Computers in Sales Department." The scope name must contain only printable characters. It must contain at most 65536 characters, and it must be unique (that is, it cannot match the name of another scope currently used by the application).

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application. For more information, see Related Topics.


Edit the properties of a scope

To edit the properties of a scope

  1. Open Authorization Manager.
  2. In the console tree, right-click the scope that you want to edit, and then click Properties.

    3. Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
  3. In the Properties dialog box, modify the settings that you want to change.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application, and the application must contain a scope. For more information, see Related Topics.


Create a role assignment within a scope

To create a role assignment within a scope

  1. Open Authorization Manager.
  2. In the console tree, right-click Role Assignments, and then click Assign Role.

    3. Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
    • Role Assignments
  3. In the Add Role dialog box, select the check boxes next to the role definitions that you want add.

Notes

  • XOX
  • If you have not defined roles, the Add Role dialog box will be empty.
  • To perform this procedure, you need to use an authorization store that contains an application, and the application must contain a scope. For more information, see Related Topics.


Edit the properties of a role assignment within a scope

To edit the properties of a role assignment within a scope

  1. Open Authorization Manager.
  2. In the console tree, right-click the role assignment that you want to edit, and then click Properties.

    3. Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
    • Role Assignments
    • Role assignment
  3. In the Properties dialog box, modify the settings that you want to change.
  4. (Optional) To edit the role definition upon which the role assignment is based, do the following:
    • In the Properties dialog box, click Show Definition.
    • In the Definition Properties dialog box, modify the settings that you want to change.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application, and the application must contain a scope. For more information, see Related Topics.


Delegate a scope

To delegate a scope

  1. Open Authorization Manager.
  2. In the console tree, right-click the authorization store that contains the parent application of the scope that you want to delegate, and then click Properties.
  3. In the Properties dialog box, click the Security tab.
  4. On the Security tab, under Authorization Manager user role, click Delegated Users.
  5. Under Users and groups that are assigned to this role, click Add or Remove to add or remove users and groups.
  6. In the console tree, right-click the application that contains the scope that you want to delegate, and then click Properties.

    Where?

    • Authorization Manager
    • Authorization store
    • Application
  7. In the Properties dialog box, click the Security tab.
  8. On the Security tab, under Authorization Manager user role, click Delegated Users.
  9. Under Users and groups that are assigned to this role, click Add or Remove to add or remove users and groups.
  10. In the console tree, right-click the scope that you want to delegate, and then click Properties.

    Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
  11. In the Properties dialog box, click the Security tab.
  12. On the Security tab, under Authorization Manager user role, click Administrator.
  13. Under Users and groups that are assigned to this role, click Add or Remove to add or remove users and groups to which you want to assign the Administrator role.

Notes

  • XOX
  • To perform this procedure, you need to use an authorization store that contains an application, and the application must contain a scope. For more information, see Related Topics.
  • XML–based authorization stores, applications, and scopes do not support delegation.
  • If a scope within an authorization store that is stored in Active Directory contains task definitions that include authorization rules or role definitions that include authorization rules, you cannot delegate the scope.


Audit a scope

To audit a scope

  1. Open Authorization Manager.
  2. In the console tree, right-click the scope that you want to audit, and then click Properties.

    3. Where?

    • Authorization Manager
    • Authorization store
    • Application
    • Scope
  3. In the Properties dialog box, click the Auditing tab.
  4. On the Auditing tab, select the Authorization store change auditing check box. This check box does not exit for XML–based authorization stores.

Notes

  • XOX
  • XML–based authorization stores do not support auditing at the scope level.
  • If you configure auditing at the application level or the authorization store level, this is indicated on the Auditing tab in the Properties dialog box for the scope.
  • To audit your applications, you must have specific privileges and security settings. For more information, see Related Topics.
  • To perform this procedure, you need to use an authorization store that contains an application, and the application must contain a scope. For more information, see Related Topics.


Concepts

This section provides general background information about Authorization Manager:

  • Authorization Manager and role–based administration overview
  • Using Authorization Manager


Authorization Manager and role–based administration overview

Network administrators, Information Technology specialists, and others responsible for computer-related infrastructure, are most effective when they help people do their jobs. The role–based management model enables you to assign users to roles. The settings that authorize users for specific roles are made automatically, by means of scripts. The scripts, called authorization rules, enable you to apply fine-grained control over the mapping between access control and the structure of your organization.

Role–based administration is often used to facilitate authorization and computer configuration. Authorization and computer configuration are two categories of roles that you can manage by using role–based administration.

  • Authorization roles are based on a user's job function. You can use authorization roles to authorize access, to delegate administrative privileges, or to manage interaction with computer–based resources. For example, you might define a Treasurer role that includes the right to authorize expenditures and audit account transactions. Authorization Manager enables administrators to implement this type of role–based administration through applications. For more information about applications, see Authorization stores and applications.
  • Computer configuration roles are based on a computer's function. You can use computer configuration roles to select features that you want to install, to enable services, and to select options. For example, server roles might be defined for Web servers, domain controllers, file servers, and custom server configurations that are appropriate to your organization.

Using developer mode and administrator mode in Authorization Manager

With Authorization Manager, you can use the following two modes:

  • Developer mode. In developer mode, you can create, deploy, and maintain applications. You have unrestricted access to all of the Authorization Manager features.
  • Administrator mode. This is the default mode. In administrator mode, you can deploy and maintain applications. You have access to all Authorization Manager features, but you cannot create new applications or define operations.

Applications that support roles usually create an authorization store, or use an existing authorization store, with pre-defined operations and tasks. In that case developer mode need not be used.

When you use developer mode, it is recommended that you run Authorization Manager in developer mode only until the authorization store, application, and other necessary objects are created and configured. After you initially set up Authorization Manager, run Authorization Manager in administrator mode. For more information about using developer or administrator mode, see To set Authorization Manager options.

Comparing Authorization Manager to other management tools

Authorization Manager is capable of implementing multiple configuration and permission changes at once. There are other management tools available with the Microsoft® Windows® Server 2003 family of operating systems that are comparable to Authorization Manager.

  • ACL Editor. The access control list (ACL) editor for access control on Active Directory directory service and Windows objects sets access control policy. Authorization Manager differs from the ACL editor by facilitating the use of role–based access control in applications that support roles. Sometimes you might not know precisely which permissions you need to set for authority to be delegated. Authorization Manager takes the guess work out of this process. For more information about access control, see Access control.
  • Delegation of Control Wizard. The Delegation of Control Wizard also sets multiple permissions automatically. Authorization Manager provides more scope and configuration options for role-supporting applications. For more information about delegation, see Delegating administration.

For more information about Authorization Manager, see Using Authorization Manager.


Using Authorization Manager

This section covers:

  • Authorization rules
  • Groups in Authorization Manager
  • Authorization stores and applications
  • Scopes in Authorization Manager
  • Roles, tasks, and operations
  • Authorization Manager auditing
  • Authorization Manager delegation


Authorization rules

Authorization rules are scripts, written in VBScript or JScript, that you can include in role definitions and task definitions. An authorization rule determines whether the role or task is allowed. For information about role definitions and task definitions, see Roles, tasks, and operations.

By using authorization rules, you can base authorization decisions on any conditions that a script can test. These include privileges and permissions, as well as time of day, billable expense limits, account balances, and other criteria.

With Authorization Manager, you can use authorization rules, but it is not designed for writing or debugging authorization rules. You can write your scripts in a text editor (for example, Notepad), in an integrated development environment like Visual Studio .NET, or in another application of your choice.

Authorization rules are usually written by developers. For more information about authorization-related application programming interfaces (APIs), see Authorization at the Microsoft Web site.(http://msdn.microsoft.com/)

VBScript example

The following is a VBScript authorization rule that always grants permission:

AzBizRuleContext.BusinessRuleResult = True

For more information about VBScript, see VBScript at the Microsoft Web site.(http://msdn.microsoft.com/)

JScript example

The following is a JScript authorization rule that always grants permission:

AzBizRuleContext.BusinessRuleResult = true;

For more information about JScript, see JScript at the Microsoft Web site.(http://msdn.microsoft.com/)


Groups in Authorization Manager

In Authorization Manager, recipients of authorization policy are represented by the following different kinds of groups:

  • Windows Users and Groups—These groups includes users, computers, and built-in groups for security principals. Windows users and groups are not used only in Authorization Manager. They are used throughout Windows.
  • LDAP query groups—Membership in these groups is dynamically calculated as needed from LDAP queries. An LDAP query group is a type of application group.
  • Basic Application Groups—These groups are defined in terms of LDAP query groups, Windows users and groups, and other basic application groups. A basic application group is a type of application group.
  • Application groups—These groups include basic application groups and LDAP query groups as special cases. Application groups are specific to Authorization Manager role–based administration. An application group is a group of users, computers, or other security principals. An application group is not a group of applications.

Windows Users and Groups

For more information about groups in Active Directory, see Understanding groups. For more information about security principals that are not stored in Active Directory, see Local Users and Groups.

LDAP query groups

In Authorization Manager, you can use LDAP queries to find objects in Active Directory and other LDAP compliant directories. For example, the following query finds everyone except Andy:

(&(objectCategory=person)(objectClass=user)(!cn=andy))
The following query finds all members of the DogLovers alias at northwindtraders.com:
(memberOf=CN=DogLovers,OU=Distribution Lists,DC=nwtraders,DC=com)

You can use an LDAP query to specify an LDAP query group by typing the desired LDAP query in the space provided on the Query tab of the Properties dialog box of the application group.

Basic application groups

Basic application groups are specific to role–based administration.

To define basic application group membership, you need to:

  1. Define who is a member.
  2. Define who is not a member.

Both of these steps are carried out in the same way: First, you specify zero or more Windows Users and Groups, previously defined basic application groups, or LDAP query groups.

Second, the membership of the basic application group is calculated by removing any nonmembers from the group. Authorization Manager does this automatically at runtime.

Nonmembership in a basic application group takes precedence over membership.

Circular membership definitions are not allowed, and result in the error message "Cannot add GroupName. The following problem occurred: A loop has been detected."

Application groups

When you create a new application group, you need to determine whether you want it to be an LDAP query group or a basic application group. For Authorization Manager role–based applications, any authorization you can do with Windows users and groups can also be done with application groups. Application groups are more dynamic and flexible.

For more information about creating application groups, see To create a group within an authorization store and To create a group within an application.

For information about editing the properties of an application group, see To edit the properties of a group within an application and To edit the properties of a group within an authorization store.


Authorization stores and applications

With Authorization Manager, you can provide authorization services to administrators that you support by creating Authorization Manager applications that access authorization stores.

In Authorization Manager, there is no default authorization store and there is no default application. To create an authorization store, you must work in the Authorization Manager developer mode. For more information about working in developer mode, see To set Authorization Manager options.

You can store authorization stores in either XML files or Active Directory. The following table compares the two types.

Authorization store type Delegation support Authorization store is specified by Windows support
Active Directory Supported at the authorization store, application, and scope levels A URL, beginning with the protocol prefix MSLDAP:// or an LDAP distinguished name (for example, CN=myStore,CN=Program Data,DN=nwtraders,DN=com) Windows Server 2003 domain functional level Active Directory domain only

Important

  • In Windows 2000, Active Directory does not support authorization stores.
XML Not supported
The XML file is secured as a whole by its NTFS file system access control entries (ACEs). 		A URL beginning with the protocol prefix MSXML:// or a Path (for example, C:\Temp\MyStore.xml or \\ServerName\ShareName\MyStore.xml) Any NTFS partition

An application is specific to an authorization store, and it is always located directly under its parent authorization store in Authorization Manager. For more information about creating an application, see To create an application. Scopes, roles, tasks, and operations are always specific to an application. For more information, see Scopes in Authorization Manager and Roles, tasks, and operations.

Using application groups

An application group is a group of users of an Authorization Manager application. You can create application groups at any of the three levels in the Authorization Manager console. The following table lists the different Authorization Manager levels where you can create application groups.

Level | Application group can be used in
Authorization store | The authorization store, and applications and scopes underneath it
Application | The application, and scopes underneath it
Scope | The scope

For more information about application groups, see Groups in Authorization Manager.

Delegating authorization stores and applications

Authorization stores that are stored in Active Directory, and the applications that they contain, support delegation. For more information about performing delegation, see To delegate an authorization store and To delegate an application.

Note

  • XML–based authorization stores, applications, and scopes do not support delegation.


Scopes in Authorization Manager

A scope is a subdivision within an application that separates resources from other resources that are used by that application. You do not have to use scopes. A scope can be a folder, an Active Directory container, a file-masked collection of files (for example, *.doc), a URL, or any item that can be accessed by the application and its underlying authorization store. You can use scopes to prevent unintended resource sharing and to support auditing and delegation.

If you have Authorization Manager groups, role assignments, role definitions, or task definitions that you do not want to apply to an entire application, you can create them at the scope level. The application that contains the scope must be able to recognize the scope name. For example, file–based applications might have scope names that include file names or paths. Web–based applications might have URL–based scope names. Registry applications might have scope names based on registry hives, and Active Directory scope names could specify organizational units. You cannot define operations at the scope level.

Auditing scopes

You cannot perform Authorization Manager runtime auditing on scopes. You can perform Authorization Manager authorization store change auditing on scopes contained in authorization stores that are stored in Active Directory. For more information about auditing, see Authorization Manager auditing.

Delegating scopes

Scopes within authorization stores that are stored in Active Directory support delegation. For more information about delegating a scope, see To delegate a scope.

XML–based authorization stores do not support delegated administration. If a scope within an authorization store that is stored in Active Directory contains task definitions that include authorization rules, or role definitions that include authorization rules, you cannot delegate the scope.


Roles, tasks, and operations

A role is a set of permissions that a user must have to do a job. Well-designed roles should correspond to a job category or responsibility (for example, receptionist, hiring manager, or archivist) and be named accordingly. With Authorization Manager, you can adds users to a role to authorize them for the job.

A task is a collection of operations, and sometimes other tasks. Well-designed tasks are inclusive enough to represent work items that are recognizable (for example, "change password" or "submit expense").

An operation is a set of permissions that you associate with system-level or API-level security procedures like WriteAttributes or ReadAttributes. You use operations as building blocks for tasks.

You can define roles, tasks, and operations only in developer mode, not administrator mode. To set developer mode, see To set Authorization Manager options.

Role definitions

The role definitions that are appropriate depends on the structure and goals of your organization. Roles support inheritance from other roles. To define a role, you specify a non-arbitrary name, a friendly description, and some lower-level tasks, roles, and operations that are part of it. This provides a mechanism for role inheritance. For example, a Helpdesk role might include a Product Support role. You can specify an authorization rule, which may be either VBScript or JScript. For more information, see VBScript at the Microsoft Web site (http://msdn.microsoft.com/) and JScript at the Microsoft Web site.(http://msdn.microsoft.com/)

If there are several authorization rules associated with a role definition (for example, it has several subroles and tasks), the authorization rules run synchronously. In Authorization Manager, the order has no effect on authorization.

Role assignments

A role assignment is a virtual container for application groups whose members are authorized for the role. A role assignment is based on a single role definition, and a single role definition can be the basis of many role assignments.

The most common procedure that administrators carry out is the assignment of application groups, or Windows users and groups, to a role. For step-by-step instructions, see To assign an application group to a role or To assign a Windows user or group to a role.

Task definitions

A task definition is smaller than a role definition and can be used to define roles and other tasks.

With Authorization Manager, you associate tasks with roles in an intuitive way. For example, the Recruiter role might include the Interview task. Tasks, like roles, are defined in a way that is appropriate to the organization. To define a task, you specify a name, a friendly description, and some lower-level tasks and operations that are part of it. You can also specify a VBScript or JScript authorization rule.

For more information about creating or editing task definitions, see To create a task definition and To edit a task definition.

Operation definitions

Operations are small computer-level actions that are used to define tasks and usually are not relevant to an administrator. You define operations only in developer mode.

You can set operation definitions at the application level, but not at the authorization store level or the scope level. An operation definition includes a name, a description, and an operation number. The operation number X must be an integer from zero to 2147483647 (that is, 0 ≤ X ≤ 231 - 1). The operation number is used by the application to identify the operation, so entering a wrong operation number will cause a bug in the application. For more information about creating or editing operation definitions, see To create an operation definition or To edit an operation definition.


Authorization Manager auditing

You need the Generate security audits privilege and the Manage auditing and security log privilege to do auditing. For more information about these privileges, see Privileges.

With Authorization Manager, you can use two kinds of auditing: runtime auditing and authorization store change auditing.

Runtime auditing

When you enable runtime auditing, applications generate audits when they use policy that is defined in the authorization store. You can configure auditing to log successes, failures, or both. Runtime auditing records client context and access checks. Access checks are based on the AccessCheck method described in the Authorization section of the Platform SDK. For more information about authorization-related application programming interfaces (APIs), see Authorization at the Microsoft Web site.(http://msdn.microsoft.com/)

Authorization store change auditing

When you enable authorization store change auditing, audits are generated every time the authorization store is modified. The audit logs all events, successes and failures.

For authorization store change auditing, Authorization Manager supports the NTFS file system (for XML–based authorization stores) and Active Directory. The APIs upon which Authorization Manager is based are flexible enough to allow for the use of the Windows registry, Exchange Server, and SQL Server.

Auditing availability

The availability of auditing depends on the following:

  • Whether the authorization store is based on Active Directory or XML.
  • Whether auditing is applied at the authorization store level, the application level, or the scope level.

The following table describes the availability of the two auditing types.

Level Runtime auditing is available in Authorization store change auditing is available in
Authorization store
  • XML
  • Active Directory
  • XML
  • Active Directory
Application

  • XML
  • Active Directory
  • Active Directory
Scope Not available
  • Active Directory

To use auditing, you have to select the appropriate check box on the Auditing tab. To enable runtime auditing, click the Runtime application initialization auditing check box. To enable authorization store change auditing, click the Runtime client context and access check auditing check box.

If the authorization store is based on XML, you also have to specify object access auditing. If the authorization store is based on Active Directory, you also have to specify directory service access auditing.

Important

  • By default, object access auditing is turned off. Auditing for XML–based authorization stores only works if you turn on object access auditing. To do this, you need to use Group Policy at the domain, domain controller, or other applicable organizational unit level in Active Directory, or through local security policy. If the XML–based authorization store is located on a domain controller, the Default Domain Controllers Policy Group Policy object (GPO) is the most appropriate place to turn on object access auditing. If the XML–based authorization store is located on a workstation or member server, edit the local Group Policy object for that computer to set local security policy, or edit another Group Policy object that applies to the computer through Active Directory. For more information about Active Directory, see Active Directory.

    To enable object access auditing, double-click Audit object access.

    Where?

    • Group Policy object name (for example: Default Domain Controllers Policy)
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
    • Audit object access

    Select the Define these policy settings check box, select the Success check box, and then select the Failure check box.

    Notes

    • If you are editing the local Group Policy object, the Define these policy settings check box does not appear in the Group Policy Object Editor. It only appears if you are editing Group Policy objects that are stored in Active Directory.
    • If the Success and Failure auditing check boxes are unavailable, the Define these policy settings check box has probably been selected through security policy that is acting at a higher level in Active Directory. In this situation, you need to find out where the Define these policy settings check box is selected and clear the check box. To find this setting, look in the Group Policy objects (GPOs) that affect this computer.

Important

  • By default, directory service access auditing is turned off. To use auditing for authorization stores that are stored in Active Directory, you must turn on directory service access auditing. You do this through Group Policy at the domain, domain controllers, or other applicable organizational unit level in Active Directory. The Default Domain Controllers Policy Group Policy object is usually the most appropriate place to turn on directory service–based access auditing. For more information about Group Policy, see Group Policy.

    To enable directory service access auditing, double-click Audit directory service access in Group Policy.

    Where?

    • Group Policy object name (for example: Default Domain Controllers Policy)
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
    • Audit directory service access

    Notes

    • If you are editing the local Group Policy object, the Define these policy settings check box does not appear in Group Policy. It only appears if you are editing Group Policy objects that are stored in Active Directory.
    • If the Success and Failure auditing check boxes are unavailable, the Define these policy settings check box has probably been selected through a security policy that is acting at a higher level in Active Directory. In this situation, you need to find out where the Define these policy settings check box is selected and clear the check box. To find this setting, look in the Group Policy objects (GPOs) that affect this computer.

After editing the Group Policy objects, run the gpupdate command to ensure that the changes take effect immediately. For more information, see Gpupdate.

Auditing event logging

All Authorization Manager audits are written to the Security section of the Event Viewer. For more information about Event Viewer, see Event Viewer.

Auditing that is enabled by inheritance

Any auditing obtained through inheritance takes place regardless of the local setting. For example, in the case of an authorization store that is stored in Active Directory, auditing policy can be inherited from a parent organizational unit in Active Directory. In the case of an XML–based authorization store, audit policy on the folder containing the XML file is applicable.

For more information about auditing, see Auditing security events.


Authorization Manager delegation

Using delegation, you can assign responsibility to someone else. Delegation helps balance workloads, and it can help with security by assuring that individuals do not have more rights than they need.

Authorization stores that are stored in Active Directory support delegation.

XML–based authorization stores do not support delegation at any level. The XML file is secured as a whole by its NTFS file system access control entries (ACEs).

A scope within an authorization store that is stored in Active Directory cannot be delegated if the scope contains task definitions that include authorization rules, or role definitions that include authorization rules.

For more information about delegating authorization stores, see To delegate an authorization store. For more information about delegating applications, see To delegate an application. For more information about delegating a scope, see To delegate a scope.

For more information about delegation, see Delegating administration.