Permission inheritance

[ZbigniewK]

How inheritance of permissions works?
If mashups is calling a Thing and Thing is based on Template - will it take it from mashup, or Thing Template?

In specific case:

- we have UserA and User B,

- we have one mashup,

- we have 2 ThingTemplates: TTA and TTB,

- we have 2 Things created from ThingTemplate TTA: Thing_A1, Thing_A2
- we have 2 Things created from ThingTemplate TTB: Thing_B1, Thing_B2

- we want UserA to have access to services in Thing_A1, Thing_A2

- we want UserB to have access to all Things.

In this case, if we set Mashup Runtime to Service Execute to both users, then we set ThingTemplate TTA to Service Execute both users, but thing Template TTB only to user B - will it work desired way? Will it inherit User B to be able to use Thing_B1, Thing_B2, but user A not be abled to use them?  

[nmutter · Accepted solution]

You may check the docs. In general you need to differentiate: Runtime permissions and Visibility permissions. (There are also DesignTime permission but they are mostly for composer editing stuff).

- Visibility: Who can see the asset? Visibilty can only be assigned for Organization(Units).

- Runtime: What can the user do with it (which services can he execute)? Runtime can only be assigned for Users or UserGroups.

For inheritance there are "Instance" permissions, like ThingTemplate visibility instance permissions. If you give UserB thingtemplate instance visibility permissions for both thing templates, he can see all Thing instances of this ThingTemplate. User A you only give instance visibility permission for ThingTemplate A.

Giving Mashup runtime service execute permissions will only apply for the mashup-entity itself. Not for items referenced in the mashup. So this is not what you want.

Also see: https://support.ptc.com/help/thingworx/platform/r9/en/#page/ThingWorx/Help/Best_Practices_for_Developing_Applications/security_2.html

Hope it helps Needs some experience to better understand.