ADARBA (RBAC Administration)

This document describes the utility "ADARBA".

The following topics are covered:

Functional Overview
Procedure Flow
Checkpoints
Control Parameters

Functional Overview

The ADARBA utility is used to initialize and administrate the RBAC security definitions, which are stored in the RBAC system file in the database.

ADARBA initializes, creates, and modifies basic security objects such as users and roles, and is used to grant or revoke permissions. See Authorization for Adabas Utilities for further information.

The database to be used must be online.

Note:
Each ADARBA command represents a transaction. This means that modifications to the security definitions take effect immediately.

Important:
Access to this utility should be strictly limited to the person or persons responsible for database security.

This utility is a multi-function utility. For more information about single- and multi-function utilities, see Adabas Basics, Using Utilities.

Procedure Flow

Procedure Flow ADARBA

Data Set	Logical Name	Storage Medium	Additional Information
RBAC Definitions		Database/RBAC System File
Control statements	stdin		Utilities Manual
ADARBA messages	stdout		Messages and Codes

Checkpoints

The following table shows the nucleus requirements for each function and the checkpoints written:

Fuction	Nucleus must be active	Nucleus must NOT be active	Nucleus is NOT re-quired	Checkpoint writ-ten
INITIALIZE	X			SYNX (see note)

Note:
In addition, an ADAFDU checkpoint is generated, indicating the RBAC system file number.

Control Parameters

The following control parameters are available:

     [NO]ABORT

     [NO]AUDIT

     AUDIT  ,DISPLAY

     AUDIT  ,FORMAT = {TEXT|CSV} [,SEPARATOR = string]

     AUDIT  ,LOG_FILE = filepath

     CREATE  ,{OPERATION|USER|OBJECT|ROLE} = string

M    DBID = number

     DROP ,{OPERATION|USER|OBJECT|ROLE} = string

     [NO]ECHO

     EXPORT = filepath

     GRANT ,ROLE = string [,TO] ,USER = string

     GRANT ,OPERATION = string [,OBJECT = string] [,TO]  ,ROLE = string

     GRANT ,OPERATION = { ANY|DELETE|INSERT|READ|UPDATE}  ,OBJECT = number [,TO]  ,ROLE = string

     IMPORT = filepath

     INITIALIZE ,RBAC_FILE = number [,USER = string]

     LIST  ,{OPERATION|USER|OBJECT|ROLE} [= string]

     LIST  ,ASSIGNMENT, {USER [= string]|ROLE [= string]|PERMISSION}

     MAINTAIN

     REVOKE ,ROLE = string [,FROM] ,USER = string

     REVOKE ,OPERATION = string [,OBJECT = string] [,FROM] ,ROLE = string

     REVOKE ,OPERATION = { ANY|DELETE|INSERT|READ|UPDATE}  ,OBJECT = number [,FROM] ,ROLE = string

     [NO]STAT

Notes:

String values are case-sensitive.
With reference to GRANT and REVOKE, it is recommended to specify the parts of the assignment in the order shown above.

[NO]ABORT

[NO]ABORT

This function turns forced termination on or off.

If ABORT is specified, ADARBA terminates execution in case of an error and returns an error status.

If ADARBA is executed in interactive mode, the default is NOABORT.

If ADARBA is called with parameters, the default is ABORT.

Note:
[NO]ABORT can be specified in interactive mode or, if an input script is used to provide the RBAC security definitions, in the input script.

Example:

adarba: abort
%ADARBA-I-INP, abort
%ADARBA-I-PAR, forced termination enabled

For this ADARBA session, forced termination is enabled.

[NO]AUDIT

[NO]AUDIT

This function turns authorization auditing on or off.

Example:

adarba: noaudit
%ADARBA-I-INP, noaudit
%ADARBA-I-PAR, utility audit disabled

AUDIT DISPLAY

AUDIT ,DISPLAY

This function displays the settings of authorization auditing.

Example:

adarba: audit,display
%ADARBA-I-INP, audit,display

AUDIT=YES
FORMAT=TEXT
SEPARATOR=;
LOGFILE=${ADADATADIR}/db189/adaaudit.log

The settings for authorization auditing are displayed for this database. The default settings in this case.

AUDIT FORMAT

AUDIT ,FORMAT = {TEXT|CSV} [,SEPARATOR = string]

This function sets the format and optionally the separator for the authorization auditing.

TEXT

All values in the audit entry are preceded by a header and separated by blanks.

CSV

All values in the audit entry are separated by the separator value.

The separator defines the character to be used to separate values in CSV format.

Separator	Description
\,	Comma
\;	Semi-colon
/t	Tabulator
\	Blank (Default)

Example:

adarba: audit,format=CSV,SEPARATOR=\,
%ADARBA-I-INP, audit,format=CSV,separator=,

The format for authorization auditing is set to CSV with a comma separator.

AUDIT LOG_FILE

AUDIT ,LOG_FILE = filepath

This function sets the log file for the authorization auditing.

Example:

adarba: audit,log_file=./my.log
%ADARBA-I-INP, audit,log_file=./my.log

The log file for authorization auditing is set to the path.

CREATE

CREATE ,{OPERATION|USER|OBJECT|ROLE} = string

This function creates an RBAC definition of a given type and value.

The value assigned to items of type USER must be a valid logon credential; e.g. user identification. These values are platform-specific:

Linux: user_identification
Windows: domain\user_identification

See Authorization for Adabas Utilities for further information.

Example:

adarba: create,user=domain\userid

The user definition domain\userid for Windows is created.

DBID

DBID = number

This parameter selects the database to be used.

Note:
The nucleus must be running.

Example:

adarba: dbid=200

The database currently being used is database 200.

DROP

DROP ,{OPERATION|USER|OBJECT|ROLE} = string

This function deletes an RBAC definition with the given type and value. If this RBAC definition is referenced by a user or permission assignment, the corresponding assignment is revoked implicitly to avoid incomplete RBAC definitions.

Example:

adarba: drop,user=NEWUSER

The user definition NEWUSER is deleted.

[NO]ECHO

[NO]ECHO

This function turns the echo of the command input on or off. The default is ECHO.

Note:
[NO]ECHO can be specified in interactive mode or, if an input script is used to provide the RBAC security definitions, in the input script.

Example:

adarba: echo
%ADARBA-I-INP, echo
%ADARBA-I-PAR, echo input enabled

For this ADARBA session, echo input is enabled.

EXPORT

EXPORT = filepath

The export function creates a text file with the RBAC security definitions. This file contains:

the user-defined security definitions
the initial definitions, created by the initialize function.

The administrative user can edit this text file and add entries to create operation, user, object, or role, and to grant operations.

Note:
This function can only be executed if the RBAC system file is initialized.

Example:

adarba: export=myRBAC
%ADARBA-I-INP, export=
%ADARBA-I-RDREC, Number of records processed: 59

The file myRBAC contains 59 security definitions.

GRANT (User Assignment)

GRANT ,ROLE = string [,TO] ,USER = string

This function grants a role to a user.

Example:

adarba: grant,role=NEWROLE,to,user=NEWUSER

The user NEWUSER is assigned the role NEWROLE.

GRANT (Permission Assignment)

GRANT ,OPERATION = string [,OBJECT = string] [,TO]  ,ROLE = string

This function grants a role the permission to perform an operation on an object.

Example:

adarba: grant,operation=ada.uti.opr,to,role=ANYROLE

The role ANYROLE is assigned the permission to perform the operation ada.uti.opr on the default object (DBID.CURRENT).

GRANT (Command Assignment)

GRANT ,OPERATION = { ANY|DELETE|INSERT|READ|UPDATE} ,OBJECT = number [,TO] ,ROLE = string

This function grants a role the permission to perform the corresponding Adabas commands on an Adabas file of the default database (DBID.CURRENT).

The predefined operations DELETE, INSERT, READ and UPDATE are used to group the Adabas direct commands according to their functionality. ANY is a short notation for DELETE, INSERT, READ and UPDATE .

OBJECT is interpreted as the Adabas file number if the value is a valid Adabas file number. Other values, in particular DBID.CURRENT, are accepted as object but not interpreted.

Examples:

adarba: grant,operation=read,object=12,to,role=ANYROLE

The role ANYROLE is assigned the permission to perform the operation READ on file number 12 of the current database.

adarba: grant,operation=any,object=12,to,role=ANYROLE

The role ANYROLE is assigned the permission to perform the operations DELETE, INSERT, READ and UPDATE on file number 12 of the current database.

IMPORT

IMPORT = filepath

The import function reads a text file with definitions and creates the RBAC security definitions accordingly. This file can contain:

the user-defined security definitions
the initial definitions, created by the initialize function.

The order of the entries is irrelevant, whether granted operations are defined prior to the entity creation, the list will be sorted internally.

Note:
This function can only be executed if the RBAC system file is initialized. The function operates as an update function, existing security definitions will not be deleted, and already existing definitions will be just ignored.

Example:

adarba: import=myRBAC
%ADARBA-I-INP, import=
%ADARBA-I-RDREC, Number of records processed: 60, updates processed: 1

The file myRBAC contains 60 security definitions and 1 definition has been updated.

INITIALIZE

INITIALIZE RBAC_FILE = number [,USER = string]

The initialize function creates the RBAC system file and loads the initial security definitions. It is possible to define the user, which is authorized after the initialization. This could be the login name of a specific user. If the keyword USER is defined without the string, the current user login name will be taken. If the keyword USER is omitted, the PUBLIC user will be authorized.

The RBAC system file can be created with all possible block sizes for the ASSO container and the DATA container.

Example:

adarba: initialize rbac_file=200

The RBAC system file will created with file number 200 and the PUBLIC user will be authorized by default.

adarba: initialize rbac_file=200 user

The RBAC system file will created with file number 200 and the current user will be authorized.

adarba: initialize rbac_file=200 user=admin

The RBAC system file will created with file number 200 and the admin user will be authorized.

LIST

LIST ,{OPERATION|USER|OBJECT|ROLE} [= string]

This function displays the RBAC definition, if a string value is supplied and the specified definition exists.

This function displays all active RBAC definitions of the type specified if no value is supplied.

Examples:

adarba: list,role=PUBLIC
PUBLIC

The role PUBLIC is displayed.

adarba: list,role=
PUBLIC

The role PUBLIC is displayed because it is the only active role definition.

LIST ASSIGNMENT

LIST ,ASSIGNMENT ,{USER [= string]|ROLE [= string]|PERMISSION}

This function displays, according to the type specified, active user, active role, or permission assignments. It displays assignments for the specific user and/or specific role if a string value is supplied, otherwise, it displays all active user and role as-signments.

Example:

adarba: list,assignment,user
PUBLIC,PUBLIC

All user assignments are displayed.

adarba: list,assignment,role
PUBLIC,PUBLIC

All role assignments are displayed.

adarba: list,assignment,user=NEWUSER
PUBLIC,NEWUSER

Assignments for the user NEWUSER are displayed.

adarba: list,assignment,role=NEWROLE
NEWROLE,PUBLIC

Assignments for the role NEWROLE are displayed.

adarba: list,assignment,user=NEWUSER,role=NEWROLE
NEWROLE,PUBLIC

Assignments for the role NEWROLE and the user NEWUSER are displayed.

MAINTAIN

MAINTAIN

This function deactivates obsolete user assignments.

Note:
MAINTAIN can be specified in interactive mode or, if an input script is used to provide the RBAC security definitions, in the input script.

Example:

adarba: maintain
any_role,inactive_user

The obsolete user assignment ‘any_role,inactive_user' is now deactivated.

REVOKE (User Assignment)

REVOKE ,ROLE = string [,FROM] ,USER = string

This function revokes a role, which was granted to the user.

Example:

adarba: revoke,role=NEWROLE,from,user=NEWUSER

The role NEWROLE is revoked from user NEWUSER.

REVOKE (Permission Assignment)

REVOKE ,OPERATION = string [,OBJECT = string] [,FROM] ,ROLE = string

This function revokes a permission, which a role was granted, to execute an operation on an object.

Example:

adarba: revoke,operation=ada.uti.dbm,from,role=NEWROLE

The permission, which the role NEWROLE had been granted, to perform the operation ada.uti.dbm on the default object DBID.CURRENT, is revoked.

REVOKE (Command Assignment)

REVOKE ,OPERATION = { ANY|DELETE|INSERT|READ|UPDATE} ,OBJECT = number [,FROM] ,ROLE = string

This function revokes a permission, which a role was granted, to perform the corresponding Adabas commands on an Adabas file of the default database (DBID.CURRENT).

The predefined operations DELETE, INSERT, READ and UPDATE are used to group Adabas direct commands according to their functionality. ANY is a short notation for DELETE, INSERT, READ and UPDATE .

OBJECT is interpreted as the Adabas file number if the value is a valid Adabas file number.

Examples:

adarba: revoke,operation=read,object=12,from,role=NEWROLE

The permission, which the role NEWROLE had been granted, to perform the operation READ on file number 12 of the current database, is revoked.

adarba: revoke,operation=any,object=12,from,role=NEWROLE

The permission, which the role NEWROLE had been granted, to perform the operations DELETE, INSERT , READ, and UPDATE on file number 12 of the current database, is revoked.

[NO]STAT

[NO]STAT

This function enables or disables the display of command statistics. The default is STAT.

Note:
[NO]STAT can be specified in interactive mode or, if an input script is used to provide the RBAC security definitions, in the input script.

Example:

adarba: stat
%ADARBA-I-INP, stat
%ADARBA-I-PAR, command statistics enabled

Command statistics are enabled for this ADARBA session.

If command statistics are enabled, statcmd will display the number of errors which occurred when a valid function is executed through interactive or non-interactive mode.

Example:

adarba: dbid=50
%ADARBA-I-INP, dbid=050
%ADARBA-E-NOONLF, No online-functions possible, Nucleus not running
%ADARBA-I-STATCMD, 1 error(s) occurred