The administration model

This model defines users, roles and permissions for UnityBase.

SIEM integration notice

Under Linux in case service is started by systemd all security-related changes are logged into syslog/journald (in addition to uba_audit table) with PRIORITY=Notice

Each message is in format AUDIT={json with parameters}, example:

AUDIT={"entity":"uba_userrole","actionType":"DELETE","actionUser":"admin","remoteIP":"127.0.0.1","targetUser":"admin2","targetRole":"DataManager","entityinfo_id":337856398524417}

Possible meaning of actionType:

  • INSERT - Adding
  • UPDATE - Modifying, new attributes are in toValue
  • DELETE - Removing
  • LOGIN - User is logged into, HTTP request headers is in toValue attribute
  • LOGIN_FAILED - User fails to log-in
  • LOGIN_LOCKED - Locked user login attempt failed
  • SECURITY_VIOLATION - Security violation, details in toValue attribute
  • DOWNLOAD - File downloaded` (DE edition only
  • PRINT - File printed` (DE edition only

Possible entity values

  • uba_role: roles
  • uba_grouprole: roles for groups
  • uba_els: entity-level security rules
  • uba_user: users
  • uba_usergroup: user groups membership
  • uba_userrole: user roles membership
  • org_employee: assignment of user to employee

Examples:

  • actionType==='INSERT' and entity=='uba_user' mean what new user is added
  • actionType==='DELETE' and entity=='uba_usergroup' mean what user removed from group

Other fields meaning:

  • actionUser: user who do an action
  • targetUser: user for whom action is done
  • remoteIP: IP address of caller
  • targetRole: a role
  • targetGroup: a group
  • userAgent: for LOGIN* events - an HTTP user-agent
  • fromValue: addition information

Security audit and audit trail separation

Starting from ub@5.25.25 uba_audit and uba_auditTrail row visibility can be separated depends on user border unit:

  • new properties uba_audit.borderID and uba_auditTrail.borderID are added
  • new ubConfig property security.auditBorderIDuDataProp is added - can be set to name of the Session.uData property what contains Int64 value to put into uba_audit.borderID and uba_auditTrail.borderID. If not set - audits dose not separates
  • for members of admin role all rows are visible, for other members - only rows with borderID ==== Session.uData[security.auditBorderIDuDataProp] are visible
  • model what defines auditBorderIDuDataProp in uData must also add UB.App.on('getBorderIDOnLoginFailure' event handler. Event is fired just after security violation with userName parameter, and task of the handler is to set Session.uData[security.auditBorderIDuDataProp] based on passed userName (because on this stage Session.on('login'` is not called yet)

Classes

Types

# ubaAdvSecurityAttrs inner

Properties

# ubaAlsAttrs inner

Properties

# ubaAuditAttrs inner

Properties

# ubaAuditTrailAttrs inner

Properties

# ubaElsAttrs inner

Properties

# ubaElsPermissionAttrs inner

Properties

# ubaGroupAttrs inner

Properties

# ubaGrouproleAttrs inner

Properties

# ubaOtpAttrs inner

Properties

# ubaPrevPasswordsHashAttrs inner

Properties

# ubaRoleAttrs inner

Properties

# ubaSessionAttrs inner

Properties

# ubaSubjectAttrs inner

Properties

# ubaUserAttrs inner

Properties

# ubaUsercertificateAttrs inner

Properties

# ubaUsergroupAttrs inner

Properties

# ubaUserroleAttrs inner

Properties