Discussion
Evgeny Shvarov · Nov 24, 2020

Managing Security Strategy in InterSystems: Users or Applications?

Hi Developers!

Want to raise security discussion today!

Let's discuss how InterSystems security for applications works. In general, the concept is clear: we have Resources (what to protect), Roles which combine a set of privileges and accesses to Resources and Users which can have this or that Role.

But there is also a concept of Application which also could have a Role.

So you either provide a Role for a User or for an Application.

What do you use in production? What is your strategy and why? Pros, cons?

 

What is your strategy for assigning Security Roles: Users or Applications?

Register or login to poll

Results
33.33%
(2)
Users
0%
(0)
Applications
66.67%
(4)
Another custom approach
00
2 0 4 105
Log in or sign up to continue

Replies

The applications you mentioned, it's not exactly applications, it's just kind of entrypoint to the application.

Security in Caché and in IRIS now, was not so good in my opinion, for many reasons.

An application developer, if he would like to use role-based security is too limited to use the Security model from InterSystems.

And no matter how many different applications customers would like to use on their own Instance of IRIS, security will be global.

Issues with mirroring, with ECP, any instance of IRIS use own tables, and have to be synchronized in some ways. Such big clusters should have the ability to use the same security settings on any instance, out of the box.

Application, real, not virtual, should have the ability to re-use Security and store it close to Application's data.

Security settings synchronization for mirroring and ECP is a different problem though a serious one. 

But there are strong recommendations from very experienced specialists to follow the Application-based security model. I want to have a discussion around - what are the key reasons for it?

I think both should be used.

If an application needs some privilege for itself (=for all users), e.g. for reading database with code, then this should be role for the application.

If different users within same application have different permissions then this should (can) be handled via user roles.