Controlling access to CLC Server data
Folders are the basic unit for controlling access to data. Permissions applied to a folder also apply to the data elements within it. This section describes how to control access to folders on server file locations where permissions have been enabled and the "Group-based permissions" option has been selected, as described in File system locations.
When group-based permissions are enabled on a file system location, initially only the root user or users in a configured admin group have access to data stored there. Permissions are then set by the root user or other admin user on folders using a CLC Workbench acting as a client for the CLC Server, as described in Setting permissions on a folder.
Members of groups can be granted two types of access:
- Read access
- Members of the designated group(s) can see the elements in the folder, open them and copy from them. Access can be through any client software, for example, via the CLC Server Command Line Tools or via a CLC Workbench, for example when browsing in the Navigation Area, searching, or when clicking the "Originates from" link in the History (
) of a data element.
- Write access
- Members of the designated group(s) can make and Save (
) changes to an element, and new elements and subfolders can be created in that area.
For a user to access a folder, they must have read access to all the folders above it in the hierarchy. In the example shown in figure 5.1, to access the Sequences folder, the user must have access to both the Example Data and Protein folders.
Figure 5.1: A folder hierarchy on the server.
It is fine to just give write access to the final folder. For example, read access only could be granted to the Example Data and Protein folders, with read and write access granted to the Sequences folder.
Please see Technical notes about permissions and security for further details about the system behavior relating to permissions.
Subsections