Role based control over Angular Custom Tools in Persona UI

In IBM Product Master, the access of JSP Custom Tools are governed from the Admin UI using the 'Role Console' widget. However, the access of Angular Custom Tools are not governed.

The customer wants to restrict certain custom tools based on a specific role. But, currently the persona UI provides access to all the custom tools that are listed in the persona-custom-tools.json for all the users, even though the specific roles have only their required custom tools configured in the mdmce-roles.json.

For E.g.

For the role 'Role 1', all the Angular Custom Tools

• Bulk Item Categorisation

• Dashboard

• Bulk Upload Assets

are accessible where as the expectation is to provide access only to

• Dashboard

• Bulk Upload Assets

Below is the configuration in persona-custom-tools.json and mdmce-roles.json files

persona-custom-tools.json

{

"scripts": [

{

"scriptName": "Bulk Item Categorisation",

"scriptDisplayName": "Bulk Item Categorisation",

"scriptPath": "bulk-item-categorisation",

"scriptType": "Persona_Custom_Tools",

"scriptId": "29215"

},

{

"scriptName": "Dashboard",

"scriptDisplayName": "Dashboard",

"scriptPath": "ext-enrichment-shell",

"scriptType": "Persona_Custom_Tools",

"scriptId": "29216"

},

{

"scriptName": "Bulk Upload Assets",

"scriptDisplayName": "Bulk Upload Assets",

"scriptPath": "ext-bulk-upload-shell",

"scriptType": "Persona_Custom_Tools",

"scriptId": "29217"

}

]

}

mdmce-roles.json

{

"name": "Custom Tools",

"index": "6",

"components": [

"Dashboard",

"Bulk Upload Assets"

]

}

This has brought up critical security issues at the business.