1.2 Users and Permissions

In order to access any of the EIS Consoles you need to be authenticated and authorized. 
Each Console / Functionality requires at minimum to have a specific Task.
Given that the Tasks are not directly assigned to users but to roles, eventually you need to have the appropriate role.
The role may or may not have Location or Source Restrictions:

A Location Restriction limits the geographic scope within which a user may exercise a given functionality (via WUI and/or System). That scope is defined by the location, country, or set of countries contained in the Location Restriction of the role/task of the user. 
Examples for clarity:
- Web User Interface: A user holding the LOCATION_MANAGER role/task with a Location Restriction Level of "User's country" will find that the country-selection list, on the Search Location page of the Geo Console, includes only their own country.
- System to System Interface: When notifying SSN for the creation of a PortPlus, a user holding the PORTPLUS_NOTIFIER role/task with a Location Restriction Level of "User's country" may only designate a PortOfCall that belongs to that same country.

A Source Restriction filters the exchange of information between two parties by constraining, in terms of country, which counterparties a given party may exchange information with. It is defined by the set of countries permitted under the restriction (the user's own country, or the countries of a regional agreement), and an exchange is allowed only when one party's country falls within the other party's permitted countries. Which party's restriction is consulted depends on the direction of the information flow:

• When sending information, the system checks each potential recipient's Source Restriction against the sender's country — a recipient is eligible to receive only if its permitted countries include the sender's country.
• When searching for or requesting information, the system checks the requesting user's own Source Restriction against each provider's country — a notification is visible to the requestor only if the requestor's permitted countries include the provider's country.

Examples for clarity:

Sending information (the recipient's restriction is checked against the sender – introduced under EIS-3748):
On the Incident Report page of the Send Notification Console, a recipient country is present in the available recipients list only if it has at least one party whose Source Restriction includes the country of the logged-in notifier. For instance, if there is a country that has only one party/user belonging to it, and that party/user has Source Restriction Level = ”XW”, then only users of countries that belong to that specific regional agreement will have the country as an available recipient in the recipients list.

Searching for / requesting information (the requestor's own restriction is checked against the provider):
On the Voyage Information pages of the Find Notification Console, a ShipCall notification appears in the search results only if the searching user's own Source Restriction includes the country of the party that originally provided it. For instance, a console user whose Source Restriction Level is "XW" will see ShipCall notifications only from providers whose country belongs to the "XW" regional agreement. 

In addition the following restriction levels are applied per case:
•    None: No restriction is imposed on Location or Source Restrictions
•    User’s country: Applies  to both Location and Source Restriction and limits the corresponding functionalities that are subject to both restriction types.
•    Specific locations: Applies only to Location Restriction and limits the corresponding functionalities that are subject to Location Restrictions.
•    Countries list: Applies to both Location Restriction and Source Restriction and limits the corresponding functionalities that are subject to both restriction types.

The restriction levels for Source Restrictions and Location Restrictions are defined in the ROLES_TASKS table.

More specifically: 

• A permission (defined by the TASK column) is assigned a Source Restriction by modifying the default “None” value of the RESTRICTION_LEVEL column to one of the following restriction levels
  • When setting the value to “User’s country” the corresponding value of the SOURCE_REGIONAL_AGREEMENT_CODE column must remain null
  • When setting the value to “Countries list” then the corresponding value of the SOURCE_REGIONAL_AGREEMENT_CODE column must change to one of the available Regional Agreement Codes that are defined in the COUNTRIES_REGIONAL_AGREEMENTS table
• A permission is assigned a Location Restriction by modifying the default “None” value of the LOCATION_RESTRICTION_LEVEL column to one of the other restriction levels.
  • When setting the value to “User’s country” the corresponding value of the DUTY_CODE column must remain null.
  • .When setting the value to “Specific locations” the corresponding value of the DUTY_CODE column must change to one of the available duty codes defined in the ORGANISATIONS_DUTIES table.
  • When setting the value to “Countries list” the corresponding value of the DUTY_CODE column must change to one of the available Regional Agreement Codes that are defined in the COUNTRIES_REGIONAL_AGREEMENTS table.

The Duty Codes determine the geographical scope of the Location Restrictions when the restriction level is set to “Countries list” or “Specific locations”. The information provided by COD to EIS creates/updates Organizations and their respective Duty Codes. These Duty Codes are mapped to specific Location Codes in the ORGANISATIONS_DUTIES_LOCATIONS table. 
When the system processes the Location restriction of a permission it checks if the geographical scope of the triggered functionality matches the Location Code that is mapped to the permission’s Duty Code (e.g a party that has a Location Restriction set to “Specific locations” and Duty Code set to “PORT_NOT” can only send PortPlus notifications regarding PortOfCalls that match the Location Codes that are mapped to “PORT_NOT” Duty Code).

The Regional Agreement Codes determine the geographical scope of Location and Source Restriction when the restriction level is set to “Countries list”. The information provided by CCBR to EIS creates/updates/deletes Countries and their respective Regional Agreements (if they belong to one).
When the system processes the Source and/or Location restrictions of a permission it checks if the geographical scope of the triggered functionality, is contained in the respective Regional Agreement Code of the restriction (e.g. a party that has a Location Restriction set to “Countries list” and Duty Code set to “XP” can only send PortPlus notifications regarding PortOfCalls that belong to countries of that specific regional agreement).

Below there are two tables:

• Table #1: Summarizes the minimum Task / Role that you need to have in order to access the Console / Functionality. 
• Table #2: Summarizes the association between IDM Roles / Tasks and Restrictions.

Table #1:

Table #2: