Home/Field Guide/Security & operations
CONCEPT 24
Identity, roles, and access boundaries
Design role scopes, single sign-on, and tests that catch cross-account data exposure.
Authentication and authorization
Authentication establishes who is calling. Authorization checks whether that identity may perform a particular action on a resource. Use the appropriate regular, site, organization, or account role model for the target resource. Think through role assignment, group membership, resource permissions, and ownership separately. A role name alone does not confer access.
Use the supported SAML or OpenID Connect integration for human sign-in when appropriate. Verify how users and attributes map into Liferay, how role membership changes, and what happens when a user is disabled. Machine-to-machine access has a separate lifecycle for OAuth credentials, scopes, and the effective identity.
Test the boundary with actors
| Actor | Cases to run |
|---|---|
| Guest | Landing page, login prompt, direct file URL, and protected APIs |
| Partner A member | Own entry, another member’s entry, Partner B ID, and search |
| Partner B member | Mirror the cross-account and relationship tests |
| Reviewer | Assigned task, unassigned task, return and approval permissions |
| Integration identity | Intended API operation and a deliberate denied operation |
Include list and detail operations, relationship traversal, data exports, and attachment downloads. With a clustered site, verify the behavior after a role change and across sessions. Audit role changes, lock down management paths, rotate credentials, and review support advisories as part of platform maintenance.