Controlling access to the server, server tasks and external data
Access to the various aspects of the CLC Server can be controlled using settings under the Global permissions tab (figure 6.5), found at:
Configuration (
) | Global Permissions (
)
To edit permissions, click on a heading and then click on an Edit Permissions button. When the option Only authorized users from selected groups is selected in the edit dialog, access can be granted to or removed from groups as relevant (figure 6.6).
Figure 6.5: Access to many aspects of the CLC Server can be controlled using settings under the Global permission tab.
Figure 6.6: Permissions can be granted to or removed from individual groups.
The sections under the Global permissions tab are described below, grouped by the general area they pertain to.
Restricting access to the CLC Server
By default, all users with access to the CLC Server can log in, and can use any client software to do so. Restrictions are available at two levels :
- Login restrictions Restrict login to the CLC Server by any route to only members of specified groups.
- Client access Restrict access to the CLC Server at a per-CLC client level (CLC Workbench, CLC Server Command Line Tools or web client).
Notes:
- By default, all authorized users can log into the CLC Server using any client type.
- At minimum, the admin group must have access to the web client.
- Access from a CLC Workbench or the CLC Server Command Line Tools can be entirely blocked by selecting the Only authorized users from selected groups option in the edit dialog and not selecting any groups.
Figure 6.7: These settings allow any authorized to log into the CLC Server from a CLC Workbench. Only members of the admin and bioinf groups can log in using the CLC Server Command Line Tools, and only members of the admin group can log in using the web client.
Extending access to administrative tasks
By default, non-administrative users logged into the web client have access only to the Element info tab. Access to some administrative functionality can be granted using the settings described in this section.
- Web admin access Access to the following administrative functionality can be extended to members of non-admin groups (figure 6.8):
- Audit log Grant access to work with the Audit log.
- External applications Grant permissions to configure and administer external applications.
- Queue Grant access to the Queue tab, where the list of processes queued or running on the CLC Server can be seen. This also grants permission to cancel queued or running jobs.
- Workflows Grant permissions to install and administer workflows on the CLC Server.
Figure 6.8: Access to some administrative functionality can be granted to members of non-admin groups.
- Audit log Grant access to work with the Audit log.
Restricting access to analysis functionality
- Algorithms Restrict access to individual tools (figure 6.9).
Enter a term in the search field just below the section heading to list only tools with names containing that term.
Figure 6.9: By default, all authorized users have access to all tools. Here, access to the Amino Acid Changes tool has been limited to members of the admin and bioinformaticians groups. - Workflows Restrict access to workflows installed on the CLC Server and control who can submit workflows present on a CLC Workbench for execution on the CLC Server.
Server-installed workflows Each workflow installed on the CLC Server is listed, with access to each configured individually (figure 6.10).
Other workflows By default, any workflow installed on a CLC Workbench or launched from the workflow editor in the CLC Workbench can be run on the CLC Server by any authorized user. This can be restricted by limiting access to the Server Execution of Workbench Workflows workflow. That workflow is used by the system when a Workbench workflow is run on the server.
Figure 6.10: With these settings, all authorized users are allowed to run the Copy of Prepare Raw Data v0.1 workflow. Only members of the bioinf group can run the Copy of De Novo Assemble Long Reads and Polish with Short Reads v0.1 workflow. Only members of the testers group can run Workbench workflows on the CLC Server. - External applications Restrict access to available External Applications. Access to each external application can also be configured under the Management tab for that application (see Editing external applications).
Restricting access to non-CLC data and systems
- Import/export directories Restrict access to file system areas configured as import/export directories.
- AWS Connections Restrict access to AWS Connections.
Restricting access to computational resources
- Grid presets Restrict access to grid presets.
Relevant only for setups with grid nodes.
Note: Grid presets are identified by name. Changing a grid preset's name under the Job processing tab, in effect, creates a new preset. Any relevant restrictions must be configured for this new preset. (Access permissions on the old preset are not copied automatically to the new preset.)
- Cloud presets Restrict access to cloud presets.
Relevant only where the Cloud Server Plugin is installed and an AWS Connection has been configured for accessing an AWS account with CLC Genomics Cloud resources in place. To use a cloud preset, a user must have access to the cloud preset as well as to the AWS Connection configured in that preset.