IBM Computer Hardware 2 User Manual download pdf (Page 402)

CCA Release 2.54

Aggregate Role Structure

A set of zero one or more role definitions are sent in a single data structure. This

structure consists of a header, followed by one or more role structures as defined in

“Basic Structure of a Role” on page B-29.

The header defines the number of roles which follow in the rest of the structure. Its

layout is shown in Figure B-32, with three concatenated role structures shown for

illustration.

Bytes Field

┌───────┐

4 │ │ Number of roles in aggregate structure

├───────┤

4 │ │ Reserved

├───────┴───────────────────────────────────┐

variable│ │ First role

├───────────────────────────────────────────┴─────────────┐

variable│ │ Second role

├───────────────────────────────────────┬─────────────────┘

variable│ │ Third role

└───────────────────────────────────────┘

Figure B-32. Aggregate Role Structure with Header

Access-Control-Point List

The user's permissions are attached to each Role in the form of an

Access-Control-Point list. This list is a map of bits, with one bit for each primitive

function that can be independently controlled. If a bit is True (1), the user has the

authority to use the corresponding function, if all other access conditions are also

satisfied. If the bit is False (0), the user is not permitted to make use of the

function that bit represents.

The access-control-point identifiers are two byte integers. This provides a total

space of 64K possible bits. Only a small fraction of these are used, so storing the

entire 64K bit (8K byte) table in each role would be an unnecessary waste of

memory space. Instead, the table is stored as a sparse matrix, where only the

necessary bits are included.

To accomplish this, each bitmap is stored as a series of one or more bitmap

segments, where each can hold a variable number of bits. Each segment must

start with a bit that is the high-order bit in a byte, and each must end with a bit that

is the low order bit in a byte. This restriction results in segments that have no

partial bytes at the beginning or end. Any bits that do not represent defined

access-control points must be set to zero, indicating that the corresponding function

is not permitted.

The bitmap portion of each segment is preceded by a header, providing information

about the segment. The header contains the following fields.

Starting bit number The index of the first bit contained in the segment. The index

of the first access-control point in the table is zero (X'0000').

Ending bit number The index of the last bit contained in the segment.

Number of bytes in segment The number of bytes of bitmap data contained in

this segment.

B-30 IBM 4758 CCA Basic Services, Release 2.54, February 2005

1 2 ... 397 398 399 400 401 402 403 404 405 406 407 ... 507 508

IBM Computer Hardware 2 User Manual Page 402

Comments to this Manuals

IBM Computer Hardware 2 User Manual Page 402

Comments to this Manuals

Related products and manuals for Software IBM Computer Hardware 2