Tutorial: Security management

(we need help to improve this translated tutorial)

jLibrary includes a flexible security system based on users, groups, roles and descriptions, that will allow you to easily manage your application access grants.

For this task, jLibrary includes a specific perspective. This is the security perspective. If this perspective isn't available in you opened jLibrary instance, you should press the Other perspective button:

After that, it should appear a dialog in which you can select the different available jLibrary perspectives. One of them is the security perspective. Select it and press OK.

Once you have done the previous step, jLibrary should show the perspective security.

The security perpective is composed by some different views with regard to the traditional repository perspective:

• The groups view. This view shows the different groups within the select jLibrary repository server.
  
• The users view. This view shows the different users within the selected jLibrary repository server, or within the selected group.
  
• The roles view. This view shows the different roles within the selected repository, or the different roles for the selected user or group.
  
• The restrictions view. It shows the users or groups that have or have not their access restricted to the selected node. The type of restriction meaning depends on the configuration of the selected repository.

In jLibrary, a repository has several users defined. This users can have different permissions on the different jLibrary server repositories. Moreover, one server has several groupos defined, in which you will can add users. Both users and groups will have several roles assigned. Those roles are defined at repository level, so for example a user called martin can have an Administrator rol in repository A, and at the same time can have only the Reader rol in repository B. Finally, each node can have several restrictions assigned. Depending on the restriction policy type of the repository, the restrictions will mean that the restricted user or group can't access to that node, or will mean that only that user or group can access to that node. By default, the restrictions are "positive". This means that if a user or a group are in the restrictions list, only them would can access to the node content.

WARNING : To perform the following steps, you must have an user with server administrator rights. In case that you don't have such permissions, you should contact with your jLibrary server administrator. Some of the following operations won't work correctly. There are some operations that can be performed by users with server administrator permission, but most of the operations wouldn't work.

User management

On jLibrary server will have several user created. These users may belong to groups and have assigned several roles. By default, jLibrary comes with an Administrator user, that have the roles Administrator, Editor and Reader.

The Users view allows to manage users. It's on the upper central part of the security perspective. This view, as the restrictions and groups ones, includes on its toolbar three buttons that allows us to create, update and delete server users.

To create an user, you can press the left toolbar button. To delete an user, previously you should have selected a repository, because otherwise jLibrary won't know in which server should create the user.

Once you have done it, you'll find the user creation dialog that you had seen on the first tutorial: Creating a repository. If you didn't create the test user martin on that tutorial, then you can create him now. Enter some test data and press the Accept button to create that user.

To update an user, select him and press the button Update user

You'll see the previous dialog, but now it allows you to update the selected user's data. You can use this option to modify the user's password, or to modify his personal data.

Finally, you can press the Delete button if you wish to delete the selected user.

Finally, it's important to know the difference between a sever administrator and a repository administrator. A server administrator will have administration access to all the repositories created on a server. One server administrator also can assign administrator server privileges to other users from the user management dialog. On the other hand, a repository administrator, only has permissions to perform admin task on the repository in which he is administrator. He won't have extra permissions on anyother repository on the server, unless he was also administrator on them.

A server administrator can perform absolutelly all tasks on a repository, so it's very encouraged to be very carefully with the information of this user. It's recommended that few users have this type of access. Also you should have the biggest precautions with the password of those users.

Groups management

One jLibrary server can have several groups. These groups will contain users, and will have several roles assigned. By default, jLibrary cames with some predefined groups: Readers, Editors and Administrators. Each of these groups have assigned a single rol: Reader, Editor and Administrator. Therefore, an user within the Readers group will can only read documents, an user that belongs to the Editors group will can read and edit documents, and an user belonging to the Administrators group will be a repository admin.

You can create new groups using the most left button in the Groups view. Again, you have to ensure of having selected some repository.

It will appear a very simple dialog that would allow you to enter the group's name and description. Enter some test data and press Accept button to create the group.

The new group will appear in the groups view. Select it and press the Update group button to modify its description.

Managing group's users

When you have a group selected, for example the previous created one, at the right, in the users view, it will be shown the users that are members of the selected group. If you wish to came back, and see only the repository users, you must ensure that there aren't groups selected.

To add the user martin to the group Grupo Tutorial, simply you have to drag the user from the users view to the destination group, in this case Grupo tutorial. Remember that to see all the jLibrary server users you have to deselected all the previously selected groups.

Once you have added the user to the group, you will se how the group is selected, and you'll see the group's user on the users view.

To delete the user from the group, you only have to use the Delete button from the users view. But, warning, you must ensure that the group is selected, otherwise you will delete the user from the jLibrary server. If you have a group selected, and you press delete, the user will be removed from the selected group.

Roles management

Every jLibrary repository has several roles assigned. Each rol will contain users and groups. In this way, an user can have a rol in a repository and another rol in other repositories from the same jLibrary server. By default, jLibrary includes three roles that can't be modified or deleted:

• Reader : In this rol are included all the users and groups that should only read documents in a repository. It corresponds with a read-only access.
  
• Editor : In this rol are included all the users and groups that as well as reading documents can also update them or modify the repository. Examples of these modify actions can be creating a directory, updating document properties, updating documents contents, etc. It corresponds with a read-write access.
  
• Administrator : These users are those that as well as performing the previous tasks can also perform administrative tasks. This tasks are for example adding restrictions to repository nodes, creating roles within a repository, etc.
  

If you wish to see a repository's roles list, you must select the repository and you'll see in the roles view the available roles. If you want to see the roles of an user or group, simply select that user or gorup and the roles view will be update convenientlly.

jLibrary gives the possibility of creating new roles. To do that, press the New rol button at the roles view.

It will appear a roles dialog in which you can enter the data of the new rol.

Once you have pressed the Accept button, you'll see the new rol at the roles view. You can update its data selecting it and using the Update rol button.

Finally, if you wish to delete the rol, select it and press the Delete rol button from roles view.

Managing users and groups roles

The process of adding roles to the different users and groups its basically the same that the previously explained for adding users to groups. If for example you wish to add a rol to an user, drag directly the rol over the user and drop it. Automatically, jLibrary will assign that rol to the user. After that, the user will appear selected and in the roles view you should see the roles of that user. You can use the same operation to add roles to groups.

To remove a rol from an user or group you have to select the user or group from wich you want to remove a rol. Next, you should select the rol and press the Delete rol button. Again, you must ensure of having some user or group selected, otherwise you'll remove the rol from the repository, and that isn't what you want to do.

Restriction management

The restrictions, at its name appoints, restrict repository node access. If you select a node, you'll see the restricted users and groups in the restrictions view for that node.

If you wish to restrict the access to an user or group, the only thing you must do is dragging the user or group over the restrictions view.

The meaning of the restrictions depends on the repository policy type. If the policy is "negative" then when you drop an user or group over the restrictions view that user or group won't have access to the node. If you open the repository again, and try to access to that node with the restricted user or group, you'll see how the user or group can see the node.

The restrictions are applied transparently with independency of their roles or permissions. This is very important to maintain information privacity. So, even if a server or repository administrator wishes to access to that information, it will be impossible for him ─ok, if he's a repository admin probably it will have database access. We're looking for encryption support :-). So, be very careful with this, because for example if you add too much restrictions to a node, nobody, even admins, will have access to that node.

The security constraints policy can be configure from the jlibrary.properties file. If you don't know what is this file, you should go first to the install guide to learn about it. This file has a line from which you can configure your jLibrary server security restrictions policy:

use.negative.constraints.policy=false

By default the value of the key use.negative.constraints.policy is false. This means that the server will have a "positive" policy, and the restrictions will mean that the user or group have access to that node. With this policy, when you create a repository, only the repository creator is added to the restrictions list. If you wish that others users access to the repository, you must add them to the restrictions list.

If you specify a true value to the use.negative.constraints.policy you'll switch to a "negative" policy, and the restrictions will mean that the user or group won't have access to that node. With this policy, when you create a repository, no restrictions are created. So everybody can access to a repository. If you wish to deny the access to someone, you only have to add him to the restrictions list.

Congratulations ! Now you have enough knowledge to create your secure repositories :-)

-martin