Share via

3.1.1.10 Access for Public Abstract Data Model Elements

  • Article

As described in section 3.1.1, direct access (query or set) of data elements tagged as "(Public)" MUST use the same authorization policies, enforced as if the elements were being accessed via the RPC-based protocol methods in this document. The calling patterns described in section 1.3 provide an overview for understanding the basic flow of the query and set patterns. Section 3.1.1.10.1 provides detailed examples for the Policy Object Data Model (section 3.1.1.1); the other object types use similar patterns.

The following table describes the level of access that MUST be enforced during direct access of the described public ADM elements.

Object type

DesiredAccess required for Query pattern

DesiredAccess required for Set pattern

Policy (section 3.1.1.1)

POLICY_VIEW_AUDIT_INFORMATION | POLICY_GET_PRIVATE_INFORMATION | POLICY_VIEW_LOCAL_INFORMATION | READ_CONTROL

POLICY_TRUST_ADMIN | POLICY_CREATE_ACCOUNT | POLICY_CREATE_SECRET | POLICY_CREATE_PRIVILEGE | POLICY_SET_DEFAULT_QUOTA_LIMITS | POLICY_SET_AUDIT_REQUIREMENTS | POLICY_AUDIT_LOG_ADMIN | POLICY_SERVER_ADMIN | READ_CONTROL

Account  (section 3.1.1.3)

ACCOUNT_VIEW | READ_CONTROL

ACCOUNT_ADJUST_PRIVILEGES | ACCOUNT_ADJUST_QUOTAS | ACCOUNT_ADJUST_SYSTEM_ACCESS | READ_CONTROL

Secret (section 3.1.1.4)

SECRET_QUERY_VALUE | READ_CONTROL

SECRET_SET_VALUE | READ_CONTROL

TrustedDomain (section 3.1.1.5)

TRUSTED_QUERY_DOMAIN_NAME | READ_CONTROL

TRUSTED_SET_CONTROLLERS | TRUSTED_SET_POSIX | READ_CONTROL