# AuthorizationType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Authorization define fine-grained access to midPoint objects and system functionality.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
$itemDefinition.Name.LocalPart | property string | [0,1] |
$itemDefinition.Name.LocalPart | property string | [0,1] |
$itemDefinition.Name.LocalPart | property AuthorizationDecisionType | [0,1] |
$itemDefinition.Name.LocalPart | property anyURI | [1,-1] |
$itemDefinition.Name.LocalPart | property AuthorizationPhaseType | [0,1] |
$itemDefinition.Name.LocalPart | property AuthorizationEnforcementStrategyType | [0,1] | Setting that specifies when to enforce the authorization.
$itemDefinition.Name.LocalPart | property ZoneOfControlType | [0,1] |
$itemDefinition.Name.LocalPart | container OwnedObjectSelectorType | [0,-1] | Object part from the (subject,action,object) authorization triple.
$itemDefinition.Name.LocalPart | property ItemPathType | [0,-1] |
$itemDefinition.Name.LocalPart | property ItemPathType | [0,-1] | Specification of items that are excluded from the scope of this authorization.
$itemDefinition.Name.LocalPart | container OwnedObjectSelectorType | [0,-1] | Target of the operation.
$itemDefinition.Name.LocalPart | property QName | [0,-1] | Relation(s) to which the authorization applies.
$itemDefinition.Name.LocalPart | container OrderConstraintsType | [0,1] | Order constraints for cases when assignment/inducement is a matter of the authorization decision.
$itemDefinition.Name.LocalPart | container AuthorizationLimitationsType | [0,1] | Limitations of this authorization when it is applied to other authorizations.

- ### Items

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime,AVals:2

    Multiplicity: [0,1]

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [1,-1]

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime,AVals:2

    Multiplicity: [0,1]

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime,AVals:2

    Multiplicity: [0,1]

    Setting that specifies when to enforce the authorization. Default setting is to always enforce the authorization.

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime,AVals:2

    Multiplicity: [0,1]

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Object part from the (subject,action,object) authorization triple.

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [0,-1]

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Specification of items that are excluded from the scope of this authorization. I.e. the authorization applies to all the items except those items that are specified here.

    Note: there is subtle (but important) difference between not allowing access and denying access. Authorization that denies access specifies a final decision. Denied access cannot be allowed by any other authorization. Deny authorization are very strong from a security perspective, but it is extremely difficult to combine them with other authorizations. Therefore deny authorizations are used very rarely. On the other hand if the access is not allowed by a specific authorization then it can still be allowed by another authorization. This makes authorizations "mergeable". Not allowing access is usually the right approach. The exceptItem specification is a convenient way to "not allow" access to specific items.

    The item specification must not be combined with exceptItem. One or the other can be used, but not both. If neither item nor exceptItem is specified then it is assumed that the authorization applies to all items.

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Target of the operation. E.g. an role that is being assigned. It can be considered an operation parameter. If no target is specified then the authorization applies to all possible targets.

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Relation(s) to which the authorization applies. This is applicable only to some authorizations, mostly those that create new object references (e.g. assign/unassign authorizations). If left empty it applies to all relations.

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Order constraints for cases when assignment/inducement is a matter of the authorization decision. Order constrain may limit the order of assignment/inducement being authorized. Order constraint of zero (default) means assignment. Order constraint of one or greater means inducement. Note: Partially implemented in midPoint 3.9. Only values of zero and one are supported. Only integer orders are supported. Assignments/inducements with complex orderConstraints are not supported.

  - #### $itemDefinition.Name.LocalPart

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Limitations of this authorization when it is applied to other authorizations. For example this specification may limit the power of attorney. It is only applicable to some authorization types.