Copyright: Saturday, January 04, 2003 15:50:07


Lists the available groups that you can add. A group cannot be added to itself, either directly or indirectly. If you try to add a group to itself, you will receive an error message.


Lists the available operations that you can add. An operation cannot be added to itself, either directly or indirectly. If you try to add a operation to itself, you will receive an error message.


Lists the available role definitions that you can add A role definition cannot be added to itself, either directly or indirectly. If you try to add a role to itself, you will receive an error message.


Lists the available task definitions that you can add. A task definition cannot be added to itself, either directly or indirectly. If you try to add a task to itself, you will receive an error message.


Specifies the LDAP query time-out, and provides a space for you to type the LDAP query time-out. The value is specified in milliseconds. The value can range from 500 to 2147483647. The default value of 15000 milliseconds (15 seconds) is recommended.


Specifies the authorization rule time-out, and provides a space for you to type the authorization rule time-out. The value is specified in milliseconds. The value can range from 5000 to 2147483647. The default value of 45000 milliseconds (45 seconds) or less is recommended.


Specifies the maximum number of cached authorization rules, and provides a space for you to type the maximum number of cached authorization rules. The value can range from 0 to 2147483647. The default value of 120 is recommended.


Sets the LDAP query time-out, the authorization rule time-out, and the maximum number of cached authorization rules to their default values.


Shows the name and location of the authorization store. If the store is an XML file, the full path is displayed. If the store is in Active Directory, the LDAP distinguished name of the store is displayed.


Provides a space for you to type a description of the authorization store. The description does not affect the functionality of Authorization Manager. Choose a description that is meaningful to you.


Shows the store type. XML stores are file-based and do not support delegation. Active Directory stores keep their data in Active Directory and are specified with an LDAP distinguished name such as CN=myStore,CN=Program Data,DN=nwtraders,DN=com. You can also use a URL beginning with MSLDAP:// or MSXML://.


Specifies the name of the application, and provides a space for you to type the name (for example, expense reporting, or information management). The name will be used to initialize Authorization Manager. The application name cannot be too long, must be unique to the authorization store, and cannot contain any of the characters \ / : * ? " < > | and [tab].


Specifies the description of the application, and provides a space for you to type the description. The description does not affect the functionality of Authorization Manager. Choose a description that is meaningful to you.


Specifies the version of the application, and provides a space for you to type the version. The version is optional text that specifies the version of the application.


Specifies whether run-time auditing is enabled. When you select this check box, Authorization Manager asks the applications within the store to generate both success audits and failure audits when they use policy from the store. See Authorization Manager auditing in Authorization Manager Help.


Specifies whether policy store change auditing is enabled. When you select this check box, Authorization Manager only asks that modifications to the authorization store itself be audited; mere use of the policy does not generate an audit. Success and failure audits are both requested. See Authorization Manager auditing in Authorization Manager Help.


Specifies the name of the application group, and provides a space for you to type the name. An application group is a group of users of the application. An application group can be composed of security groups, LDAP query groups, and other application groups. The application group name cannot be too long, must be unique to the scope, and cannot contain any of the characters \ / : * ? " < > | and [tab].


Specifies the description of the application group, and provides a space for you to type the description. The description does not affect the functionality of Authorization Manager. Choose a description that is meaningful to you.


Specifies the application group type, which can be Basic or LDAP query. A basic group is defined by a list of members and a list of nonmembers, which are excluded from the application group. An LDAP query group is built from a query on Active Directory.


Lists the LDAP query or queries that define the members of this application group.


Click to define a new query. For example, the query (&(objectCategory=person)(objectClass=user)(!cn=andy)) finds everyone except Andy. The query (memberOf=CN=DogLovers,OU=Distribution Lists,DC=northwindtraders,DC=com) finds all members of the DogLovers alias at northwindtraders.com.


Lists the users and groups that are members of this application group.


Click to add application groups to the list of members of this application group.


Click to add Windows users and groups to the list of members of this application group.


Removes the selected user, group, or application group. To make this button available, click an item in the list.


Lists the users and groups that are excluded from this application group. Exclusion takes precedence over inclusion.


Click to add application groups to be excluded from this application group. Exclusion takes precedence over inclusion.


Click to add Windows users and groups to be excluded from this application group. Exclusion takes precedence over inclusion.


Removes the selected user, group, or application group from the list to be excluded. If none is selected, the button is unavailable.


Provides a space for you to type the name of the new application (for example, expense reporting or information management). The name will be used to initialize Authorization Manager. It must be the name that the managed application uses when initializing Authorization Manager. The application name cannot be too long, must be unique to the authorization store, and cannot contain any of the characters \ / : * ? " < > | and [tab].


Provides a space for you to type a description of the new application. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Provides a space for you to type the version of the new application. The version is an optional text string that prevents different versions from being confused.


Specifies that the new authorization store is of Active Directory type. Active Directory type authorization stores keep their data in Active Directory and are specified with an LDAP distinguished name such as CN=myStore,CN=Program Data,DN=nwtraders,DN=com. You can also use a URL beginning with MSLDAP:// or MSXML://.


Specifies that the new authorization store is of XML type. XML stores are file-based and do not support delegation.


Provides a space for you to type the store name. If the store is an XML file, the current working directory is displayed (for example, C:\My Documents) and you can type the rest of the name. The XML extension is recommended but not required. If you do not include the file extension, .xml is appended. If the store is in Active Directory, type the LDAP distinguished name (for example, CN=myStore,CN=Program Data,OU=sales,DC=northwindtraders,DC=com). The distinguished name must be valid in Active Directory. You can also use a URL beginning with MSLDAP:// or MSXML://.


Click to browse to an authorization store location.


Provides a space for you to type a description of the authorization store. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Provides a space for you to type the name of the new application group. An application group is a group of users of the application (for example, Building 40 Users). You are prevented from entering a name that already exists in this scope or that is too long. It cannot contain any of the characters \ / : * ? " < > | and [tab].


Provides a space for you to type the description of the new application group. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Specifies that the new application group is of the basic type. An application group is a group of users of the application. The basic type of application group is based on Windows users and groups, which might include local groups, and global or universal groups that are stored in Active Directory.


Specifies that the new application group is defined by an LDAP query. An application group is a group of users of the application. LDAP queries are used to find objects in Active Directory and other LDAP compliant directories. For example, the query (&(objectCategory=person)(objectClass=user)(!cn=andy)) finds everyone except Andy. The query (memberOf=CN= DogLovers,OU=Distribution Lists,DC=northwindtraders,DC=com) finds all members of the DogLovers alias at northwindtraders.com.


Provides a space for you to type the name of the new operation definition (for example, Read Attributes). Operations are permissions associated with security procedures. Operations are meaningful to authorization application developers, but might not be meaningful to administrators. You are prevented from entering a name that already exists in this scope or that is too long. It cannot contain any of the characters \ / : * ? " < > | and [tab].


Provides a space for you to type the description of the new operation definition. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long. It cannot contain any of the characters \ / : * ? " < > | and [tab].


Provides a space for you to type the operation number of the new operation definition. The valid range of values is 0 through 2147483647. The application uses the operation number to identify the operation.


Provides a space for you to type the name of the new role definition (for example, Account Manager). A role definition is a collection of permissions in tasks and operations. You are prevented from entering a name that already exists in this scope or that is too long. It cannot contain any of the characters \ / : * ? " < > | and [tab].


Provides a space for you to type the description of the new role definition. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Lists the tasks and lower-level roles that define this role.  For example, a task called Reset Password might be part of a role called Account Manager.


Adds a task to the role definition (for example, Change Password). A task is a collection of operations required to do specific types of work that are meaningful to the administrator.


Adds a role to the role definition. A role is the set of permissions users must have to do their jobs.


Removes the selected task or role from the definition. To make this button available, click an item in the list.


Click to create an authorization rule for the role definition. An authorization rule is written in VBscript or Jscript, and makes an authorization decision based on application group membership and whatever application-specific data is relevant and current when the script is run.


Provides a space for you to type the name of the new scope (for example, *.txt, C:\temp, or Computers in Sales Department). A scope is a collection of objects or resources with their own authorization policy.  A scope is used within an application to limit authorization policy. The scope name must be recognized by the application and must be resolvable by the application at the time of the access check. The name must contain only printable characters. It cannot be too long, and the name cannot be a name that is already used by the application.


Provides a space for you to type the description of the new scope. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Provides a space for you to type the name of the new task. A task is a collection of operations or smaller tasks that are meaningful to an administrator as a unit of work requiring authorization. (By contrast, operations might be meaningful only to application developers.) You are prevented from entering a name that already exists in this scope or that is too long. It cannot contain any of the characters \ / : * ? " < > | and [tab].


Provides a space for you to type the description of the new task. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Lists the operations and lower-level tasks that define this task.


Adds a task to the list.


Adds an operation to the list.


Removes the selected task or operation from the list. To make this button available, click an item in the list.


Click to set an authorization rule for the task definition. An authorization rule determines whether the task is allowed. For example, the following VBScript always grants permission: AzBizRuleContext.BusinessRuleResult = True


Specifies that an Active Directory type store is to be opened. Active Directory stores keep their data in Active Directory and are specified with an LDAP distinguished name such as CN=myStore,CN=Program Data,DN=nwtraders,DN=com. You can also use a URL beginning with MSLDAP://.


Specifies that an XML file type store is to be opened. XML stores are file-based and do not support delegation. An XML-based authorization store can be specified with a URL beginning with MSXML://.


Provides a space to type the name of the authorization store to open. In the case of on XML store, this is a full path name to the file (for example, C:\stores\myStore.xml). In the case of an Active Directory store, this is the LDAP distinguished name (for example, CN=myStore,CN=Program Data,DN=nwtraders,DN=com).


Click to browse to an authorization store, or to browse to the place where you want to create the authorization store.


Provides a space to type the name of the operation definition. Operations are permissions that are associated with security procedures. Operations are meaningful to authorization application developers, but might not be meaningful to administrators (for example, to read or write attributes of an object). You are prevented from typing a name that already exists in this scope or that is too long.


Provides a space to type the description of the operation definition. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Provides a space to type the operation number of the operation definition. The application uses the operation number to identify the operation. The value can range from 0 to 2147483647.


Lists the tasks and lower-level roles that define this role.


Adds a task to the list.


Adds a role to the list.


Removes the selected task or role from the list. To make this button available, click an item in the list.


Allows you to set an authorization rule for the role definition. .An authorization rule determines whether the role is allowed (for example, the following VBscript always grants permission: AzBizRuleContext.BusinessRuleResult = True).


Provides a space for you to type the name of the scope (for example, *.txt, C:\temp, and Computers in Sales Department). A scope is used within an application to limit authorization policy if that authorization policy should not be used outside the scope. The scope name must be recognized by the application. The name must contain only printable characters. It cannot be too long, and the name cannot be a name that is already used as a scope name by the application.


Provides a space for you to type the description of the scope. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Specifies VBScript for the authorization rule. An authorization rule determines from client context, access check, and application-specific information, whether the role or task is allowed. For example, the following VBscript always grants permission: AzBizRuleContext.BusinessRuleResult = True


Specifies JScript for the authorization rule. An authorization rule determines from client context, access check, and application-specific information, whether the role or task is allowed. For example, the following JScript always grants permission: AzBizRuleContext.BusinessRuleResult = true;


Shows the source code for the authorization rule. You cannot edit the code in this field, so you must write your scripts in a text editor.


Provides a space for you to type the path to the authorization rule. The script will automatically be loaded, and its source code will be displayed.


Opens the browse dialog box so that you can browse to the authorization rule.


Loads the authorization rule into the store, and displays the source code.


Removes the authorization rule from the store.


Click the arrow to choose either Administrator or Reader for the Authorization Manager user role. This determines the level of access to the authorization store for users and groups assigned to each role. Readers can read the store and its attributes and can perform access checks by using the data in the authorization store. Administrators can do everything Readers can and they can also change the authorization store contents and its attributes. The Delegated User setting is used in conjunction with the Administrator setting to enable auditing of applications and scopes. See Authorization Manager auditing in Authorization Manager Help.


Lists the users and groups that are assigned to this role.


Click to add users or groups.


Click to remove the selected user or group. To make this button available, click an item in the list.


Lists the operations and lower-level tasks that define this task.


Click to add a task. A task is a collection of operations required to do work that requires authorization.


Click to add an operation. Operations contain permissions required for authorization and are generally defined by a developer rather an administrator.


Click to remove the selected task or operation. To make this button available, click an item in the list.


Click to set the authorization rule for the task.


Provides a space for you to type the name of the task. You are prevented from entering a name that already exists in this scope or that is too long.


Provides a space for you to type the description of the task. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Provides a space for you to type the name of the role definition. You are prevented from entering a name that already exists in this scope or that is too long.


Provides a space for you to type the description of the role definition. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Provides a space for you to type the name of the role assignment. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a name that is too long.


Provides a space for you to type the description of the role assignment. The description does not affect the functionality of Authorization Manager and should be meaningful to you. You are prevented from entering a description that is too long.


Click to show the role definition.