Share via


MSISCSITARGET_AuthorizedPrivilege class

Defines static copies of authorization policy rules. It is the base class for all activities which are protected by these rules. Use the MSISCSITARGET_AuthorizedSubject class to associate MSISCSITARGET_AuthorizedPrivilege with roles and identities. Define the entities to be protected by using the MSISCSITARGET_AuthorizedTarget association. Note that these classes provide a compact, static mechanism to represent authorization policies.

The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties.

Syntax

[Dynamic, Provider("MSiSCSITargetProv"), Version("1.0.0")]
class MSISCSITARGET_AuthorizedPrivilege : CIM_AuthorizedPrivilege
{
  string  Caption;
  string  Description;
  string  ElementName;
  string  InstanceID;
  boolean PrivilegeGranted = TRUE;
  uint16  Activities[];
  string  ActivityQualifiers[];
  uint16  QualifierFormats[];
  boolean RepresentsAuthorizationRights = FALSE;
};

Members

The MSISCSITARGET_AuthorizedPrivilege class has these types of members:

Properties

The MSISCSITARGET_AuthorizedPrivilege class has these properties.

Activities

Data type: uint16 array

Access type: Read-only

Qualifiers: ArrayType ("Indexed"), ModelCorrespondence ("CIM_Privilege.ActivityQualifiers")

An enumeration indicating the activities that are granted or denied. These activities apply to all entities specified in the ActivityQualifiers array. The values in the enumeration are straightforward except for one, 4="Detect". This value indicates that the existence or presence of an entity may be determined, but not necessarily specific data (which requires the Read privilege to be true). This activity is exemplified by 'hidden files'- if you list the contents of a directory, you will not see hidden files. However, if you know a specific file name, or know how to expose hidden files, then they can be 'detected'. Another example is the ability to define search privileges in directory implementations.

This property is inherited from CIM_Privilege.

Other (1)

Create (2)

Delete (3)

Detect (4)

Read (5)

Write (6)

Execute (7)

DMTF Reserved

8 15999

Vendor Reserved

16000 65535

ActivityQualifiers

Data type: string array

Access type: Read-only

Qualifiers: ArrayType ("Indexed"), ModelCorrespondence ("CIM_Privilege.Activities", "CIM_Privilege.QualifierFormats")

The ActivityQualifiers property is an array of string values used to further qualify and specify the privileges granted or denied. For example, it is used to specify a set of files for which 'Read'/'Write' access is permitted or denied. Or, it defines a class' methods that may be 'Executed'. Details on the semantics of the individual entries in ActivityQualifiers are provided by corresponding entries in the QualifierFormats array.

This property is inherited from CIM_Privilege.

Caption

Data type: string

Access type: Read-only

Qualifiers: MaxLen (64)

The Caption property is a short textual description (one- line string) of the object.

This property is inherited from CIM_ManagedElement.

Description

Data type: string

Access type: Read-only

Contains a textual description of the object.

This property is inherited from CIM_ManagedElement.

ElementName

Data type: string

Access type: Read-only

Contains a user-friendly name for the object. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information.

This property is inherited from CIM_ManagedElement.

InstanceID

Data type: string

Access type: Read-only

Qualifiers: Key

Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. In order to ensure uniqueness within the NameSpace, the value of InstanceID SHOULD be constructed using the following 'preferred' algorithm:

<OrgID>:<LocalID>

Where <OrgID> and <LocalID> are separated by a colon ':', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>.

<LocalID> is chosen by the business entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above 'preferred' algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance's NameSpace. For DMTF defined instances, the 'preferred' algorithm MUST be used with the <OrgID> set to 'CIM'.

This property is inherited from CIM_Privilege.

PrivilegeGranted

Data type: boolean

Access type: Read-only

Boolean indicating whether the Privilege is granted (TRUE) or denied (FALSE). The default is to grant permission.

This property is inherited from CIM_Privilege.

QualifierFormats

Data type: uint16 array

Access type: Read-only

Qualifiers: ArrayType ("Indexed"), ModelCorrespondence ("CIM_Privilege.ActivityQualifiers")

Defines the semantics of corresponding entries in the ActivityQualifiers array. An example of each of these 'formats' and their use follows:

- 2=Class Name. Example: If the authorization target is a CIM Service or a Namespace, then the ActivityQualifiers entries can define a list of classes that the authorized subject is able to create or delete.

- 3=<Class.>Property. Example: If the authorization target is a CIM Service, Namespace or Collection of instances, then the ActivityQualifiers entries can define the class properties that may or may not be accessed. In this case, the class names are specified with the property names to avoid ambiguity - since a CIM Service, Namespace or Collection could manage multiple classes. On the other hand, if the authorization target is an individual instance, then there is no possible ambiguity and the class name may be omitted. To specify ALL properties, the wildcard string "*" should be used.

- 4=<Class.>Method. This example is very similar to the Property one, above. And, as above, the string "*" may be specified to select ALL methods.

- 5=Object Reference. Example: If the authorization target is a CIM Service or Namespace, then the ActivityQualifiers entries can define a list of object references (as strings) that the authorized subject can access.

- 6=Namespace. Example: If the authorization target is a CIM Service, then the ActivityQualifiers entries can define a list of Namespaces that the authorized subject is able to access.

- 7=URL. Example: An authorization target may not be defined, but a Privilege could be used to deny access to specific URLs by individual Identities or for specific Roles, such as the 'under 17' Role.

- 8=Directory/File Name. Example: If the authorization target is a FileSystem, then the ActivityQualifiers entries can define a list of directories and files whose access is protected.

- 9=Command Line Instruction. Example: If the authorization target is a ComputerSystem or Service, then the ActivityQualifiers entries can define a list of command line instructions that may or may not be 'Executed' by the authorized subjects.

- 10=SCSI Command, using a format of 'CDB=xx[,Page=pp]'. For example, the ability to select the VPD page of the Inquiry command is encoded as 'CDB=12,Page=83' in the corresponding ActivityQualifiers entry. A '*' may be used to indicate all CDBs or Page numbers.

- 11=Packets. Example: The transmission of packets is permitted or denied by the Privilege for the target (a ComputerSystem, ProtocolEndpoint, Pipe, or other ManagedSystemElement).

This property is inherited from CIM_Privilege.

Class Name (2)

<Class.>Property (3)

<Class.>Method (4)

Object Reference (5)

Namespace (6)

URL (7)

Directory/File Name (8)

Command Line Instruction (9)

SCSI Command (10)

Packets (11)

DMTF Reserved

12 15999

Vendor Reserved

16000 65535

RepresentsAuthorizationRights

Data type: boolean

Access type: Read-only

The RepresentsAuthorizationRights flag indicates whether the rights defined by this instance should be interpreted as rights of Subjects to access Targets or as rights of Subjects to change those rights on/for Targets.

This property is inherited from CIM_Privilege.

Requirements

Minimum supported client
None supported
Minimum supported server
Windows Server 2012 R2
Namespace
Root\CIMv2\Storage\iScsiTarget
MOF
SmIscsiTarget.mof
DLL
WTWmiProv.dll

See also

CIM_AuthorizedPrivilege

iSCSI Target Server Reference

MSISCSITARGET_AuthorizedSubject

MSISCSITARGET_AuthorizedTarget

CIM_ManagedSystemElement