Manage Shares

Definitions:

• Layer – a file that is referencing a data source; due to this fact not only access to the Layer configuration but also access to the Layer data has to be controlled
  • Layer configuration - vector, raster, group or annotation layer properties. Layer configuration includes information from all Layer Properties tabs.
  • Layer data – data stored in the data source that is referenced by a Layer. For vector layer that would be the business attributes and geometries (table records), for raster layer it would be the images stored on the server’s HDD.  
• Resource – a file that is stored in Earthlight and does not have any linking to a data source, e.g. maps, styles, print templates, scripts, etc.
  
  
• Reference – a strong data source reference that controls both Layer configuration and Layer data permissions
• Link – a weak data source reference that controls only Layer configuration permissions
  
  
• Read – allows to view Resource or Layer configuration information
• Write – allows to modify Resource or Layer configuration information
• List – allows to list folders and files (Resources and Layers) in all Earthlight file browsers
• Publish - allows file owners to publish their files (Resources and Layers) to a specific location
• View – allows to view Layer data
• Edit – allows to modify Layer data
• Print – allows to print Layer data
• Export – allows to export Layer data
• Own – represents the ownership of a file (Resource or Layer)

Overview

Data security model in StatMap EVO Suite has significantly changed compared to the previous iterations. When working on the new model we looked at Microsoft’s files and folders access model. We listened to what you felt was missing in the current security model. We devised various access control scenarios and discussed how our model should behave. We experimented to establish the minimum number of individual permissions that we need to achieve a desired effect. Finally we converted all this knowledge into the new security model guidelines and implemented them into Earthlight.

The primary characteristics of the new security model are:

• increased security;
• simplified management;
• improved auditing;

There are two distinctive types of data source references – References and Links. When a user references a database table or a raster pyramid for the first time, the new layer becomes a strong reference, otherwise called a Reference. Whenever a user references the database table or the raster pyramid again, the layer becomes a weak reference, which in the system is known as a Link. In order to access source data from particular layer, user needs to have access to the Reference.

There are now nine permissions where originally there were just two. The increased atomisation enables much better control over how users can interact with resources and what they are allowed to do with the data. The permissions can be divided into three groups:

1. File ownership: Own
2. File control: Read, Write, List and Publish
3. Data control: View, Edit, Print and Export

We will cover each of the permissions in detail later.

Finally there is now a new auto-populated user group called ‘Everyone’. This group consists of all users and groups created or imported into Earthlight. It allows Earthlight administrators to easily set particular permissions for everybody regardless of whether they were in the system at the point of setting these permissions or they are created / imported afterwards.

Earthlight is using a multiple tier permission model. It means that you can control access rights on any of the three levels shown above. To speed up and simplify access management there is a group called ‘Everyone’, which contains all Earthlight users. Groups are inheriting permissions from the ‘Everyone’ entity. Users are inheriting permissions from groups.

Permissions:

Own

Own is the file ownership permission. This permission should be set by the system administrator on the repository root to allow them to set permission of any kind to any file. For newly created files (e.g. freshly referenced data source, created layers, designed maps, modified styles, etc.) the Own permission is applied for the user who created it.

Read

This permission allows users to view a Resource (like point style, page layout, etc.) or the Layer configuration (layer properties). If a user has Read permission:

• • on a Layer - they are able to add this layer to a map or open it in Modify tool to check the configuration;
  • on a Resource - they can use this resource, e.g. having Read permission on a point style allows a user to apply this point style to represent point features on a map;

Write

This permission allows users to modify Layer or Resource properties and save these changes back to the repository. It is required for a user to have Read permission on a Layer or Resource, otherwise they will not be able to open its properties to modify them. If a user has Write permission:

• • on a Layer – they are able to open Layer Properties window, modify a Filter Query and save the layer back in its original place or to their personal workspace;
  • on a Resource – they can open the Resource Editor window, change the size and colours of a polygon style and save it back in its original place or to their personal workspace;

List

List enables users to discover a Resource or a Layer in the repository when they browse or search the files and folders structure. If a user has the following permission set on a file:

• • Allow List – they will be able to see the file name listed among other or being returned as a search result;
  • Deny List - they will not be able to discover this file via any Earthlight tool. From the user’s perspective the file will not exist.

Publish

Publish can only be applied on folders, not files. It designates a location for a user or group of users where they can publish private (Owned) resources or layers, effectively making them departmental or corporate and available to others.

The four permissions described below are specific to References and even though they can be applied on folders, they only affect the References. The first two are the most obvious. Some users can only ‘View’ data, others are charged with ‘Edit’-ing the data as well. The latter two were created to improve security. Both those permissions limit user’s ability to extract data from the system without sacrificing access to the data within the Earthlight system.

View

This permission, just as the name suggests, allows users to view the business data stored by a data source. Having View permission is a requirement to be able to interact with the data in any form – inspect it, run attribute query, view it on the map, etc. Users who do not have View permission on a particular Reference will see a red circle with a white dash (similar to ‘no access’ road sign) next to its name. They will also see ‘Access to this layer is denied’ message when they hover the mouse cursor above the aforementioned symbol.

Edit

When Earthlight administrator wants to allow a user to amend layer’s data, this user has to have the ‘Edit’ permission on the specific Reference. Users who do not have Edit permission on a particular Reference are not able to start editing session on this dataset. This includes all adding, modifying or deleting records.

Print

As mentioned earlier this and the next permission limit user’s ability to extract data from the system without sacrificing access to the data within the Earthlight system. Print permission controls whether or not record data is included in a print out. The user is also informed about the lack of permissions to print records and all inaccessible layers are listed.

Export

Just as the previous one this permission improves granularity of data access and publishing. It controls all data exportation tool as well as all available formats within Earthlight. Upon trying to export data without appropriate permission a user is shown a message informing them about a lack of sufficient permissions.

Allow / Deny a permission:

Any permission can be either allowed or denied. Denying a permissions to a file takes precedence over allowing it. Not setting a permission on a file in any way (either directly or via inheritance from the parent folder / group) is treated like denying it.

When a file is denied to a user by a group they belong to, it cannot be allowed to them by any other group of the same or higher level. The file can only be allowed on a lower level group or on the user level. To put it simply Groups defined by Earthlight administrator trump ‘Everyone’ and individual users trump both ‘Everyone’ and Groups.

When a file is denied to an individual user on a folder level, it cannot be allowed for them directly on the file level.

Permissions configuration

The ‘Shares’ tool protects all files in Earthlight. Since Resources are self-contained files the ‘File control’ and ‘File ownership’ permissions apply to each and every one of them independently. As mentioned earlier the model for Layers is based on Master – Link paradigm. This means that ‘File control’ and “File ownership’ permissions act on them in similar way to Resources but ‘Data control’ permission can only be applied in one place (on the Reference) for all users.

‘Shares’ window contains 3 tabs. See the screenshot below for reference.

1. The ‘Manage shares’ tab allows you to set permissions for a user or a group.
2. ‘Report permission by user’ shows the list of all permissions that were set for a particular user / group of users.
3. ‘Report permissions by resource’ tab presents a list of all users that have permissions set on a particular file.

We cover each tab in detail next.

Manage shares

We can divide the ‘Manage Shares’ tab into 5 sections which we are describing below.

1.    Find folder or file 

In this search box you can type the name of the required file or folder and select it from the result list.

2.    Filter entries

These three check boxes allow you to filter out the files that you are not interested in.

• References – this checkbox controls whether or not References are listed;
• Links & Maps – controls visibility of the Links (the weak references) and Maps;
• Others – controls visibility of other files, e.g. styles, print layouts, Aurora scripts;

3.    File Explorer

In this section repository folder tree is displayed. You can select a file/folder here by browsing the folder structure. Selected item is highlighted. All users and groups that have permissions set for the selected file are listed in the pane on the right (4).

4.    Permission view

In this section you can actually manage permissions. After selecting an item from the left pane, you will see a list of users and groups that have permissions for the chosen item, or empty list if there are no permissions set for the resource.

Names of the applied permissions are listed next to the users/groups names. A struck through name denotes that a permission is denied. If a user or group is selected on the right pane its entry expands to allow modifications to be applied.

• •  - a grey tick in front of a permission name represents inherited permission.  
  •  - a green tick shows that a permission is set on the current level. 

On the screenshot above user jerry (Jerry Doroszkiewicz) inherits ‘List’ permission from a parent folder or a group he belongs to. The ‘Read’ and ‘Write’ permissions are applied directly on the user level.

To add permissions for a new user/group, please use “Add user or group” which is located at the top of section (4) to add new user/group and set correct rights for them.

5.    Find layer reference, links or tables

This tool helps to manage Master Layers and Link Layers. Using this tool helps users to find answers to the following questions:

• Where is the Reference for the selected Link?
• What are the names and locations of Links for the selected Reference?
• What is the name of the data source (e.g. database table) of the selected Layer (either Reference or Link)?
• What are the names and locations of all Layers referencing the selected data source?

In order to use it, please select the layer in the File Explorer (3) or type the name of it in the ‘Find folder or file’ search box (1) and click the ‘Find layer reference, links or tables’ button. Two new boxes appear. The one on the left is a drop-down list of layers which refer to the same table in the database. The right box presents the name of the table which is referenced by the selected layer.

In order to find locations of references for particular table, please type the name of the table in box on the bottom right of the Shares window, or manually scroll the list to find wanted table there.

Permissions auditing

Next two tabs are extremely useful when auditing permissions. They allow Earthlight administrators to quickly determine:

• What resources a particular user has access to?
• What level of access the user has to each resource?
• Who has permission to a particular resource?
• What permissions are set on a resource?

Report permission by user

‘Report permissions by user’ tool returns all files and folders that the selected user has any permissions on. In essence it provides answers to the first two of the questions raised a minute ago.

There are four controls on this tab:

1.    Select user or group

This search box allows you to select a user or a group to list all permissions that are set for them. In order to select a user you can either type a part of the user or group name and select it, or manually scroll through the list and select the required entry.

2.    Filter entries

These three check boxes allow you to filter out the files that you are not interested in.

• References – this checkbox controls whether or not References are listed;
• Links & Maps – controls visibility of the Links (the weak references) and Maps;
• Others – controls visibility of other files, e.g. styles, print layouts, Aurora scripts;

3.    Include tables

This option allows you to add a column containing the fully qualified name of the database table to the report.

4.    Download as CSV

Allows the report to be saved as CSV file for further processing.

Report permission by resource tab

‘Report permissions by resource’ returns all users and groups that have permissions set on the selected file. It provides answers to the last two questions raised earlier.

There are three controls on this tab.

1.    Select resource

This search box allows you to select a file or folder and see a list of all users and groups that have any permissions set on this location. In order to select a resource (a file) you can either type a part of the name of this file and select it from the results, or manually scroll through the list and select the required entry.

2.    Filter entries

These three check boxes allow you to filter out the files that you are not interested in.

• References – this checkbox controls whether or not References are listed;
• Links & Maps – controls visibility of the Links (the weak references) and Maps;
• Others – controls visibility of other files, e.g. styles, print layouts, Aurora scripts;

3.   Download as CSV

Allows the report to be saved as CSV file for further processing. 

Managing security for Metadata forms and data

Below you can find how different permissions works with Metadata:

Own - self explanatory. Owner can do anything with the schema and the underlying table
List - controls if particular schema shows up in File Explorer or Open / Save window in Metadata tab
Read - allows viewing of a metadata schema in Metadata tab
Write - allows modifying of an existing metadata schema in Metadata tab
View - enables viewing of the metadata content in Layer Properties / Browse Metadata
Edit - enables editing of the metadata content in Layer Properties / Browse Metadata

Please note that only "View" and "Edit" permissions controls metadata access for end users in Layer properties.