Access control

Available since Valtimo 13.20.0.

Access to users in the UserResource can be configured through access control. More information about access control can be found in the access control documentation.

Resources and actions

Resource type	Action	Effect
com.ritense.valtimo.contract.authentication.User	view_list	Allows viewing the list of users or searching for users
	view	Allows viewing details of a single user

Examples

Permission to view and list users for ROLE_ADMIN

[
    {
        "resourceType": "com.ritense.valtimo.contract.authentication.User",
        "actions": [
            "view_list",
            "view"
        ],
        "roleKey": "ROLE_ADMIN"
    }
]

Permission to view and list users for ROLE_USER with a condition

The following example allows users with ROLE_USER to view and list users, but only those users who also have the ROLE_USER role.

[
    {
        "resourceType": "com.ritense.valtimo.contract.authentication.User",
        "actions": [
            "view_list",
            "view"
        ],
        "roleKey": "ROLE_USER",
        "conditions": [
            {
                "type": "field",
                "field": "roles",
                "operator": "list_contains",
                "value": "ROLE_USER"
            }
        ]
    }
]

This permission supports the following condition fields:

• roles: The list of roles assigned to the user.