[Progress Communities] [Progress OpenEdge ABL] Forum Post: RE: OE STS Gateway a few questions

[Peter Judge]

The callbacks in the OEAG will allow you to add roles into the token that is returned. The connection role authorization is based on the qualified-user-id and those values are stored in the ‘business db’. The _Can-* stuff is still where it is, and uses (if I remember right) the qualified user id too. If you add roles that you want for ABL business logic authorization you need to check/enforce them yourself. The one exception is if you’re using PASOE and set up intercept-url (oeablSecurity.csv) authorization using roles.

Continue reading...