Privileges are used to control access to specific resources, for example administrative commands.

Privileges are granted to roles. Each role defines a set of privileges associated with a specific resource. The only valid privilege for administration commands is AdminRunCommand. The AdminRunCommand privilege indicates that the command specified as a resource can be executed by the associated role. Administrative command resource names are specified as <target>.<command>. Other resource types support different privileges and resource naming conventions.

Roles and their associated privileges are defined using configuration. For example, the following configuration file allows the administrator role to run the start mytarget and stop mytarget administrative commands, and the monitor role to run the display mytarget command.

name = "my-target-role-mappings"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"
configuration =
{
    RoleToPrivilegeMappings =
    {
        privileges =
        {
            administrator =
            [
                {
                      resource = "mytarget.start"
                      privilege = "AdminRunCommand"
                },
                {
                      resource = "mytarget.stop"
                      privilege = "AdminRunCommand"
                }
            ]
            monitor = 
            [
                {
                      resource = "mytarget.display"
                      privilege = "AdminRunCommand"
                }
            ]
        }
    }
}

Once the above configuration is activated, the security service will enforce that only principals who have been assigned the administrator role are allowed to run the start mytarget and stop mytarget commands and those who have been assigned the monitor role are allowed to run the display mytarget command.

	Failing to grant privileges to an administration command will prevent those commands from being run by any principal.