...
More advanced functionality and processes are listed below
Grant a Role access to an Object (NMIS Group in this case) (opCharts 3.0.6 and later)
Granting access to different resources in opCharts is done by creating an object in RBAC that represents the resource in opCharts and then granting a role privileges to that object. The object that is created is linked to the opCharts resource through a path, most of these paths can be found in a table in the Resources section. In this instance we will grant access to an NMIS Group, the path for this is /root/opcharts/group/<group_name>.
- Create a privilege, this could be auto-created for us when doing other actions but then we would have to look up the name or id created by parsing output. I’ve named it ‘group_branches_read’ because I intend for it to represent the ability to read the branches group, it can be named whatever you want (as long as it is unique).
Create an object that represents the group by giving the correct path (with the group name), and tell that object that read permissions are granted using the privilege name from step #1.
Create a new role, and give the role our privilege.
Code Block nmis64:bin root$ ./oprbac_admin.pl act=create-priv name=group_branches_read created new privilege (internal id 582ba442a77ea70da3448f11) nmis64:bin markd$root$ ./oprbac_admin.pl act=create-object path=root,opcharts,group,Branches read_privileges=group_branches_read created new object nmis64:bin markd$root$ ./oprbac_admin.pl act=create-role name=BranchesRole privileges=group_branches_read created new role (internal id 582ba4c9a77ea70dcf4c2ea1)
...
The oprbac_admin actions exist for update as well so if the role already exists and you want to add a new privilege just use update and set the new privilege.
Add or edit Role properties (opCharts 3.0.7 and later)
Roles (and Users) can have properties attached to them which can then be used as substitutions in charts using SQL. The property name can be anything and when creating SQL can be accessed via 'user.property_name'.
Properties set on roles eventually trickle down into the user and it is possible to set properties directly on a user. If the same property name is set on a user and a role the value set on the user will win over the value set in the role (as it’s the most specific).
The following example uses new users and roles, this also works with existing users/roles.
Create a new role (System-> Portal Roles)
Create a new user and assign them to the role you have created (System -> Portal Users)
In the terminal use the oprbac_admin.pl tool to assign a new property to your role (cannot be done in GUI)
Code Block # view the roles available on the server nmis64:bin root$ ./oprbac_admin.pl act=list-roles Name Description role1 role1 # set the property 'customer_id' on the role nmis64:bin root$ ./oprbac_admin.pl act=update-role name=role1 property.customer_id=abc123xyz updated role. # view the roles again, this time using verbose to see the properties nmis64:bin root$ ./oprbac_admin.pl act=list-roles verbose=1 Name Description Properties Privileges role1 role1 customer_id=abc123xyz
Export your chart defintion using opcharts-cli.pl to a file
Edit your chart definition, in the SQL you can use the new property name, eg.user.customer_id (all properties from the user that you have set on the role/user are available using 'user.’)
Use opcharts-cli.pl to import the altered chart definition (note, import has a force=1 option so you can overwrite existing definitions making it easier to iterate).
Code Block #export nmis64:bin root$ perl ./opcharts-cli.pl act=export-charts name="SQL Test With Customer" file=/tmp/chart.json # modify the query to use the new property nmis64:bin root$ vi /tmp/chart.json "query" : "select * from test_table WHERE Company = user.customer_id", # re-import nmis64:bin root$ ./opcharts-cli.pl act=import-charts name="SQL Test With Customer" file=/tmp/chart.json force=1 chart SQL Test With Customer deleted #test chart