Stroom – authorisation

Docs: Users and Groups

Fri, 01 Nov 2024 00:00:00 +0000

TODO

The Users, Groups and Permissions screens are undergoing significant change in Stroom v7.6. Therefore this section will be updated with more detail in v7.6.

Accounts vs Stroom Users

See Accounts vs Users for details on the difference between a Stroom User Account and a Stroom User.

User

A Stroom User represents a human user and is linked to either a User Account in Stroom or to a user account in an external Identity Provider (IDP) Identity Provider (IDP) An Identity Provider is a system or service that can authenticate a user and assert their identity. Identity providers can support single sign on (SSO), which allows the user to sign in once to the Identity Provider so they are then authenticated to all systems using that IDP.Click to see more details.... It can also represent a non-human processing user, e.g. where a Stroom User is created and has an API Key API Key API Keys are a form of authentication token that are created within Stroom for use by Stroom-Proxy instances or other clients that want to use Stroom’s API. It is an encrypted string that contains details of the user and the expiration date of the token. Possession of a valid API Key for a user account means that you can do anything that the user can do in the user interface via the API.Click to see more details... created for it to allow a client system to use Stroom’s API API Application Programming Interface. An interface that one system can present so other systems can use it to communicate. Stroom has a number of APIs, e.g. its many REST APIs and its /datafeed interface for data receipt.Click to see more details....

All audited activity in Stroom will be attributed to a Stroom User and their unique identifier will be included in the audit events.

A User can have the following:

Membership of one or more Groups.
One or more Application Permissions Application permission This is a permission that is not specific to a single document. It applies to all documents or is not related to documents in any way.Click to see more details... granted to it.
One or more Document Permissions Document permission Document permissions control the access that users and/or groups have to a Document.Click to see more details... granted to it.

Group

A Group represents a collection of Stroom Users and/or other Groups. A Group can be used to ease the management of application and document permissions by granting permissions to one Group then adding users to that Group. For example if all the users in a team require the same application and document permissions, then a Group can be created for them and the permissions assigned to the Group. When a user joins or leaves the team it is simply a case of editing the membership of the Group.

A Group can have the following:

One or more members (Users and/or other Groups).
Membership of one or more other Groups.
One or more Application Permissions Application permission This is a permission that is not specific to a single document. It applies to all documents or is not related to documents in any way.Click to see more details... granted to it.
One or more Document Permissions Document permission Document permissions control the access that users and/or groups have to a Document.Click to see more details... granted to it.

Docs: Application Permissions

Fri, 01 Nov 2024 00:00:00 +0000

TODO

The Users, Groups and Permissions screens are undergoing significant change in Stroom v7.6. Therefore this section will be updated with more detail in v7.6.

An Application Permission is a permission to perform an action that is not associated with a single Document Document Typically refers to an item that can be created in the Explorer Tree, e.g. a Feed, a Pipeline, a Dashboard, etc. May also be known as an Entity.Click to see more details... or is unrelated to Documents. Application Permissions can be granted to Users or Groups.

In order to grant Application Permissions to yourself or to other Users/Groups you must have the Manage Users or Administrator Application Permissions. If you have one of these permissions then you can access the Application Permissions screen from the main menu:

Application Permission Types

The following is the list of different application permissions that can be granted to users/groups.

Permission	Description
Administrator	Full administrator rights to access and manage all data, documents and screens, i.e. everything.
Annotations	Create and view annotations in query results.
Change Owner	Change the ownership of a document or folder to another user.
Data - Delete	Delete streams.
Data - Export	Download/export streams from a feed.
Data - Import	Upload stream data into a feed.
Data - View	View stream data (e.g. in the Data Viewer or a Dashboard text pane).
Data - View With Pipeline	View data in a Dashboard text pane that uses a pipeline.
Download Search Results	Download search result data on a Dashboard.
Export Configuration	Export Content Content Content in Stroom typically means the user created documents/entities created in Stroom and as seen in the explorer tree. Content can be created/modified by Stroom users and imported/exported for sharing between different Stroom instances.Click to see more details... (i.e. documents, that you have permission to view) to a file.
Import Configuration	Import Content Content Content in Stroom typically means the user created documents/entities created in Stroom and as seen in the explorer tree. Content can be created/modified by Stroom users and imported/exported for sharing between different Stroom instances.Click to see more details... from a file.
Manage API Keys	Access the API Keys screen to view, create, edit, delete the user’s own API keys. ‘Manage Users’ permission is also required to manage other users API keys
Manage Cache	Access the Caches screen to view and clear system caches.
Manage DB	Access the Monitoring -> Database Tables screen to view the state of the tables in the database.
Manage Index Shards	Access the Shards sub-tab on an Index document.
Manage Jobs	Access the Jobs screen to manage Stroom’s background jobs.
Manage Nodes	Access the Nodes screen to view the nodes the cluster and manage their priority and enabled states.
Manage Policies	Access the Data Retention screen to manage data retention rules.
Manage Processors	Access the Processors tab and manage the processors/filters used to process stream data through pipelines.
Manage Properties	Access to the Properties to manage the system configuration.
Manage Tasks	Access the Server Tasks screen to view/stop tasks running on the nodes.
Manage Users	Access the screens to manage users, groups, document/application permissions. Also gives the user the ability to manage API keys for other users.
Manage Volumes	Access the Data Volumes and Index Volumes screens to create/edit/delete the index/data volumes used for Lucene indexing and the stream store.
Pipeline Stepping	Step data through a pipeline using the Stepper.
View System Information	Use the System Information API. This is used by the administrators for viewing some of the internal working of Stroom to aid in debugging issues.

Docs: Document Permissions

Fri, 01 Nov 2024 00:00:00 +0000

TODO

The Users, Groups and Permissions screens are undergoing significant change in Stroom v7.6. Therefore this section will be updated with more detail in v7.6.

Document Permissions are permissions that are granted to Users or Groups for a specific Document Document Typically refers to an item that can be created in the Explorer Tree, e.g. a Feed, a Pipeline, a Dashboard, etc. May also be known as an Entity.Click to see more details.... They control what documents a user/group can see and what they can do to those documents. They allow very fine grained control over what a user/group can see or do in Stroom.

For example, User jbloggs may be granted Use permission on the Index named Alert Index in order for him to be able to query that index in a dashboard, but not be able to see it in the explorer tree or change it in any way.

By default a new user with no Application Permissions, Document Permissions or Group memberships cannot view/use/modify any documents. They do not even have permission to create any documents. When logging into Stroom, they will simply see an empty explorer tree.

A user can gain varying levels of access to documents in a number of ways:

Being added to a Group that has direct or inherited permissions on one or more existing documents.
Being added to a Group that has direct or inherited permissions to create one or more document types.
Being directly granted permissions one or more existing documents.
Being directly granted the permission to create one or more document types.
Being granted the Administrator Application Permission which gives them access to ALL documents.

In order to modify the permissions on a document, you must either hold Owner permission on the document or have the Administrator Application Permission. The Document Permissions screen for a document/folder can be accessed by right clicking on it in the explorer tree and selecting:

Permission Types

The following is the list of different permissions that can be granted to users/groups on a document.

Permission	Description
Owner	Same as delete plus ability to change the document’s permissions (i.e. grant permissions on this document to other users/groups).
Delete	Same as edit plus permission to delete the document.
Edit	Same as view plus permission to edit, move, rename or add tags to the document.
View	Permission to see the document in the explorer tree, open it as read-only, copy it or export it (subject to also having the `Export Configuration` application permission).
Use	Only allow use of a document, e.g. allow use of an index as part of a search process but do not allow viewing of the document itself.

The following is the list of different permissions that can be granted to users/groups on a folder .

Permission	Description
Owner	Same as delete plus ability to change the folder’s permissions (i.e. grant permissions on this folder to other users/groups).
Delete	Same as edit plus permission to delete the folder.
Edit	Same as view plus permission to edit, move, rename or add tags to the folder.
View	Permission to see the folder in the explorer tree (and its child items that you also have View permission on), open it as read-only, copy it or export it (subject to also having the `Export Configuration` application permission).
Use	Only allow use of a folder, e.g. allow use of an index as part of a search process but do not allow viewing of the folder itself.

Implied Permissions

Note that each permission in the two tables above also includes all the permissions below it in the table, e.g. a user with Edit permission on a document will also have the implied permissions View and Use. There is no need to grant these lower permissions to the user, though doing so will have no impact as Stroom will use the highest value permission when checking permissions.

Inherited Permissions

If a User jbloggs is a member of Group Team A and that group is a member of group Division 123, then jbloggs will inherit all permissions from both Team A and Division 123. A User/Group will inherit all permissions of the groups that they are a member of and also from any ancestor groups of those groups.

User/Group	Permissions	Direct/Inherited
Division 123	View on Dictionary IP Allow List	Direct
Team A	View on Dictionary IP Allow List	Inherited
Team A	Owner on Dashboard Team Dashboard	Direct
jbloggs	View on Dictionary IP Allow List	Inherited
jbloggs	Owner on Dashboard Team Dashboard	Inherited
jbloggs	View on Dashboard Frank’s Dashboard	Direct

`Owner` Permission

A document can have multiple owners. An owner can be a user or a group. When a document is created by a user they are automatically made an owner of it. Any user with the Administrator role has implied ownership of ALL documents.

Having Owner permission on a document means the user can grant permissions on that document to other users, or revoke permissions from other users.

`Use` Permission

This permission allows users to access a document but not actually see it in the explorer tree or open the document in Stroom. They can however make use of the document, e.g. selecting and querying an Index in a Dashboard .

The Use permission is not relevant to all document types.

Permissions on Folders

Folders in the explorer tree work mostly in the same way as documents when it comes to permissions. There are a couple of exceptions to this.

Permission on Folder Contents

The permissions on a folder apply only to the folder itself and has no bearing on what you can/can’t do to its child items. The permissions on each child item in the folder control what you can/can’t do to those items.

For example, if you only have View permission on a folder, but have Delete on a document in that folder, then you are able to delete that document and thus change the contents of the folder.

Similarly, if you have View permission on a folder but have no permission on any of its child items, then you will just see an empty folder.

Ancestor Folder Visibility

A folder will be visible to a user in the explorer tree if the user has View permission on it OR if the user has View permission on any single document/folder that is a descendant of it.

For example, if a user has View permission on a Dictionary Dictionary_XYZ with path

System / Folder_A / Folder_B / Dictionary_XYZ

but no permissions on Folder A or Folder B, they will be able to see both Folders in the explorer tree in addition to the Dictionary. They will however not be able to open those Folders as they do not have the permission.

Therefore, when granting permissions on a document/folder to a user/group, you are also implicitly granting visibility (but not View permission) on all ancestor folders.

Create Permissions

Folders can have one or more Create Permissions granted on them to users/groups.

There is a Create Permission for each document type, e.g. Index, Dictionary, Feed, etc. A Create Permission is the ability to create a new document of that type in that folder.

For example, user jbloggs is an analyst and is granted Create Dashboard and Create Query permissions on the Folder named Joe's Folder. This means Joe can only create Dashboard or Query documents in that folder and nothing else.

Applying Changes to Descendants

When making changes to the permissions on a Folder you have the option of making the changes to just that folder or to all descendants of that folder. Selecting to apply to all descendants will make all permission changes apply to every descendant, i.e. including any sub-folders and their contents or own sub-folders.

Moving and Copying Documents

When you move or copy a document/folder you have the choice of how the destination document/folder’s permissions should be derived. The move/copy dialog offers the following choices:

None - Removes all current permissions. Ignores permissions of the destination folder. You will be the owner of the moved document if not already.
Source - Keep the current permissions and ownership as they are.
Destination - Removes all current permissions. Adds the permissions of the destination folder. You will be the owner of the moved document if not already.
Combined - Keep the current permissions and add the permissions of the destination folder. You will be the owner of the moved document if not already.

Note

You must have Owner permission on the source document/folder (or Administrator Application permission Application permission This is a permission that is not specific to a single document. It applies to all documents or is not related to documents in any way.Click to see more details…) if you wish to use None, Destination or Combined as these all involve a change of permissions.

Stroom – authorisation

Docs: Users and Groups

TODO

Accounts vs Stroom Users

User

Group

Docs: Application Permissions

TODO

Application Permission Types

Docs: Document Permissions

TODO

Permission Types

Implied Permissions

Inherited Permissions

Owner Permission

Use Permission

Permissions on Folders

Permission on Folder Contents

Ancestor Folder Visibility

Create Permissions

Applying Changes to Descendants

Moving and Copying Documents

Note

`Owner` Permission

`Use` Permission