Analyst Sandbox Permissions¶
Analyst sandbox process instances are launched from the Analyst User Interface using the Create Process Mode.
To grant sandbox creation access to a user or group of users, assign select access to the CxSandbox entity group. The CxSandbox entity group will allow users to launch a sandbox instance, whose name will correspond to their username.
In addition to CxSandbox, further restrictions can be imposed by implementing the CxDaemonAccess configuration parameter.
Restricting access by port range, daemon, and user group¶
What ports and daemon a user may select when creating a sandbox is configured by adding a CxDaemonAccess parameter entity.
By default, CxDaemonAccess does not exist, and any user may chose any port, providing they also have CxSandbox entitlements.
CxDaemonAccess¶
CxDaemonAccess must have the Parameter Attributes:
| name | type |
|---|---|
| daemon | Symbol |
| group | Symbol |
| portRange | String |
- daemon should be the daemon name
- group should be the user group which will be granted access
- portRange should be a comma separated list of ranges
A range is continuous and has a lower and upper bound separated by a hyphen. Ranges are inclusive. Ranges may also be a single value
The example below shows three daemons titled daemon1.com, daemon2.com, and daemon3.com.
- All users have access to daemon1.com on ports 4000-4100.
- Only users in daemon2UG have access to daemon2.com.
- Administrators have access to daemon3.com on any port
- Members of daemon3UG have access to ports 4000, 4010, 4020 only.
Environment variable use¶
Environment variables may be used for each of daemon, group, and portRange
The port ranges many contain multiple variables to allow specification of ranges
The example below shows several ways you might use variables to specify port ranges.
- PORT_MIN might have the value of '4000'
- PORT_MAX might have the value of '4100'
- PORT_RANGE might have a value of '4100-4100'
