Auditing access control

The QMC includes the following audit tools that enable you to review and preview access rights and the security rules that provide them:

• Audit page: Verify that access rights comply with your company's security policies.
• Preview page: See the effects that a new or edited rule will have without disrupting your system.

The auditing tools enable you to view the rules that apply to a resource. This means that you can verify access rights, identify overlapping security rules and ultimately streamline your security rule architecture.

Example:  

Your company is organized in the following departments: Finance, Sales, Marketing and Development. You have created a custom property called Departments with values that match the name of the departments and applied them to streams. Finally you have created security rules using the Streams page in the QMC to provide users in Finance with publishing and read rights to the Quarterly reports stream. All other departments have read access rights. You now want to check that your rules have been applied correctly.

Do the following:

1. Click Audit on the Start page.
2. In the Audit page Query view, select Stream from the Resource drop-down list and then set name = Quarterly reports.

3. Click Audit.

   The Results view should now change to show a grid. The rows of the grid show user ids while the columns the streams (in this case only the stream Quarterly reports).

   For each user the grid shows symbols that correspond to the access rights that the user has to the stream.

   Finance users should have Read and Other access rights while all other users should have Read access (provided they have the custom property Department).

   Only users with access rights to the stream are shown in the grid. This means that a user missing from the list has no access to the resource.
   Information noteThe list will always include the RootAdmin user since that user has full access. Depending on the selected resource the other Admin roles will also show in the grid.

4. Click on a cell in the grid (do not click on an admin user) corresponding to a user belonging to the Finance department.

   The Applicable rules dialog window opens.

   You should now see the security rules that apply to the selected user with regard to the Quarterly reports stream. The list should include the following rules:

   • Stream_read_Quarterly reports
   • Stream_publish_Quarterly reports

5. Click on a cell in the grid (do not click on an admin user) corresponding to a user belonging to the Sales department.

   The Applicable rules dialog window opens.

   You should now see the security rules that apply to the selected user with regard to the Quarterly reports stream. The list should include the following rules:

   • Stream_read_Quarterly reports