How do I give a user access to only a specific OpenEdge resource that the agent manages?

Ensure that you meet the prerequisites, and then complete the following steps:.

Prerequisites

  • You have the AUTHZ_ADMIN role.
  • You have the AGENT_ADMIN role for the agent that manages the target resource.
  • The user to whom you want to grant access already has access to the parent resources in the resource hierarchy, such as the OpenEdge Command Center agent and the OpenEdge installation that hosts the target resource. For example, if the target resource is an OpenEdge database, the user must have access to the OpenEdge Command Center agent and the OpenEdge installation that hosts the database.
  • You have obtained the resourceURN for the target resource by using the Retrieve resources for administered systems API. For more information, see "Retrieve resources for administered systems" in the Authorization server REST API reference.
Steps
  1. Log in to the Authorization server as a user with the required privileges. For more information, see Log in to Authorization server.
  2. Create a custom role scoped to the target resource. For details, see Create and manage custom roles. The following request body defines a custom role with permissions for the target resource and its parent resources in the resource hierarchy.
    {
  "roleName": "<role-name>",
  "definedForSystem": "<system-name>",
  "usedBySystem": "<system-name>",
  "description": "<role-description>",
  "permissions": [
    {
      "resourceURN": "<agent-resource-URN>",
      "operations": {
        "allowedOperations": [],
        "disallowedOperations": []
      }
    },
    {
      "resourceURN": "<installation-resource-URN>",
      "operations": {
        "allowedOperations": [],
        "disallowedOperations": []
      }
    },
    {
      "resourceURN": "<target-resource-URN>",
      "operations": {
        "allowedOperations": [],
        "disallowedOperations": []
      }
    }
  ]
}
    Note: You can distribute the required resource URNs across multiple roles that you assign to the same user. However, the user must have access to all required parent resources across those roles.
  3. Assign the custom role to the user. For more information, see Assign roles to a user.