Grants

Using the Grants Editor, you can specify grants for users, groups, and hosts. When you specify a grant, you must define certain attributes. (See Creating a grant and Usage Control Policy Language for more information.)

Producer grants may have been set up by the policy producer. Producer grants cannot be edited. Producer and user grants cannot be mixed within a single Silk Meter-controlled application. Currently Micro Focus does not provide policies with producer grants.

Grants

You can create grants that restrict application on hosts and users based on user/group management, timeframes and number of concurrent licenses (See Creating a grant). There are limitations, depending upon the application platform, as to what data is transferred as user and host name from the application. These limitations are described in the following table. If the client application supports user/password authentication and an empty user name is provided, Java applications will transfer javauser as the user variable.

Note: The entries in italics are variable, the entries in courier are constant.

User/Group Management

You can use the user/group management information of the Silk Meter server to create grants. When using a group grant, you must provide one of the existing group names. The provided user name by the request is checked to confirm that it is included within a group that has a grant on that policy. If the name is included within an existing group, access is given.

Grant Rules

When a license request is received by the server, the request is checked to determine if a policy exists that satisfies the request, including all grants applied to the policy. The following characteristics apply to grants:

• Silk Meter groups are independent of Windows group management.

• It is only possible to specify "allow" or "deny" grants for a policy.

• During a grant check, Silk Meter first checks the user grant, then the group grant and finally the host grant.

• A user name that is not known on the Silk Meter server is treated as a "groupless" user.

• If a request is satisfied by a user or host grant, then group "none" is logged and can be used for queries.