Bank Department Showcase

• Preconditions
• Create Resource Groups
• Assign Portfolio to Resource Group
• Create Resource Group Access Policy
• Verify Access for that User

Preconditions

• Space with Demo Data
• Admin (is_admin) -  member who configure permissions
• Head Of Private Banking - member who will have access to both resource groups
• Asset Manager A - member who will have access to Resource Group A
  
• Asset Manager B - member who will have access to Resource Group B
• Installed module com.finmars.standard-iam - module that contains all standard policies

Create Resource Groups

Go to Resource Group Page



Press add new Resource Group

In same manner add resource_group_b, or any other resource groups

At that point, that it, now you able to use it in Input Forms

Assign Portfolio to Resource Group

Go to Portfolios

Open any Portfolio

You should be able to see Resource Group Input (multiselect dropdown)
If you do not see it, go to Form Constructor and manually add this input to Form

Select Resource Group - Portfolio Group A

And thats it!

Not if you will return back to your Resource Group, you will see that that Portfolio is linked to this Resource Group

Create Resource Group Access Policy

Now is most interesting part

Go to Access Policies Page

Now add new Access Policy

So, here we must assign access to all actions to Portfolio Entity (if you do it for other entities, replace Portfolio with other Model Name)

Here is full JSON of that policy

{
  "Version": "2023-01-01",
  "Statement": [
    {
      "Action": [
        "finmars:Portfolio:create",
        "finmars:Portfolio:update",
        "finmars:Portfolio:destroy",
        "finmars:Portfolio:bulk_delete",
        "finmars:Portfolio:bulk_restore",
        "finmars:Portfolio:delete_preview",
        "finmars:Portfolio:list_ev_group",
        "finmars:Portfolio:list_ev_item",
        "finmars:Portfolio:list"
      ],
      "Effect": "Allow",
      "Resource": [
        "frn:finmars:iam:resourcegroup:portfolio_group_a"
      ],
      "Principal": "*"
    }
  ]
}

So, please NOTE BENE

"Resource": [
  "frn:finmars:iam:resourcegroup:portfolio_group_a"
],

Here ins Resource property

We must add FRN of our Resource Group, so - frn:finmars:iam:resourcegroup:portfolio_group_a

Thats it!

Now lets go to Member Page

Go to Member Page

Go to Attached Access Policies 

And attach our new Access Policy

Save Member and thats it!

Now its all done, IAM will gave access to that portfolio that Member

Verify Access for that User

Log in under user who has access only to Resource Group A

 

So, we just able to see that Potfolios that were assigned to Resource Group A

Lets remove Portfolio From Resource Group A

And then remove ch-bnd-20394857

Save and lets get back to our user and see his report

So, user just able to see that Portfolios that linked to Resource Group A (which linked to his Member)

In same manner you able to configure Permissions for any number of Members and Resource Groups and Models