Access and Permissions

Users access and rights

Script configurations

You can combine the different configurations.

Minimum access

The easiest way to manage access on a script is the script configuration minimum_access. This configuration allow all users with a group ID greater or equal than the minimum_access to access to the script.

In the default WebScripts installation the group ID for the User group (default group for the authenticated users) is 50.

Example:

• To add a script for all of the authenticated users add this configuration: minimum_access=50 (INI syntax) or "minimum_access": 50 (JSON syntax).
  1. A simple user with this list of group ID: 0,1,50 will get access on the added script because the greater group ID of the user is 50 (>= 50).
  2. A not authenticated user (with this list of group ID: 0) don't have permissions to access to the new script.
  3. A administrator user with this list of group ID: 1000,1001 will get access on the added script because the greater group ID of the user is 1001 (>= 50).

Specific group

Sometimes you need to allow only a specific group to access to a script, for example: you cannot use the minimum_access for an administration script because you can add a Manager group with ID 1002 and manager users should not have access to administrative scripts.

To add a script with specific group access you should use the script configuration access_groups. This script configuration allow only the users with any group ID in the access_groups configuration to access to the script.

Example:

• The group ID for the Administrators group is 1000, for this example the group ID for the SOC is 1001. To add a script for the administrators and SOC users add this configuration: access_groups=1000,1001 (INI syntax) or "access_groups": [1000,1001], (JSON syntax).
  1. A administror user with this list of group ID: 0,1,50,1000 will get access on the added script because 1000 is in the list.
  2. A SOC user with this list of group ID: 1001 will get access on the added script because 1001 is in the list.
  3. A manager user with this list of group ID: 1002 don't have permissions to access to the new script.

Specific user

Sometimes a user don't have the group ID and need access to the script. To add a script with specific user access you shold use the script configuration access_users. This script configuration allow only the users with user ID in access_users configuration to access to the script.

Example:

• The user ID for the Admin user is 2. To add a script for the Admin user add this configuration: access_users=2 (INI syntax) or "access_users": [2] (JSON syntax).
  1. Only the Admin user have the user ID 2 and access to the new script.

User permissions

Somes users should not access to all normal scripts (for example a generic user for SupportX teams).

Users have a list of glob syntax for script names and a list of glob syntax for categories. If the script category match with any glob syntax for categories or the script name match with any glob syntax for script names the user get the access on this script.

The SupportX user with this list of glob syntax for categories ["*Account*", "*License*"] and this list of glob syntax for script names ["*password*"] can access to this default scripts:

1. Authentication
   • /auth/: The auth script is always accessible for everyone.
2. License
   • show_license.py: The categories License match with *License*.
3. My Account
   • change_my_password.py: The script name change_my_password.py match with *password* and the My Account category match with *Account*.
   • get_apikey.py: The My Account category match with *Account*
4. Password
   • password_generator.py: The script name password_generator.py match with *password*.
   • get_password_share.py: The script name get_password_share.py match with *password*.
   • new_password_share.py: The script name new_password_share.py match with *password*.

Share: upload and download permissions

Three permissions exists on the default file share:

1. Read permission: download the file
2. Write permission: write a new version of the file
   • caution: with write permission, the user can change all permissions on this file.
3. Delete permission: delete the file (the administrator can see all versions of the file)

Permissions are a number (a group ID), to access a file a user needs a group ID greater or equal than permission.