Restricting access by project

[jsmedmar]

I believe currently there's no way to limit anyone from accessing any project on the UI and any file on the datalake. It would be nice to have a way to restrict such things.

[jsmedmar]

This is a good point. We have though about this in the past. But it's a little tricky. We could implement custom permissions for projects, for example, to not display the Project View if it has a custom permission and the user doesn't have it. But actually we would need to limit the viewable Experiments, Analyses, and Submissions. Maybe Samples and Individuals if they only have Experiments for that project. So the permissions would need to be applied to every query. And the totals would be different for every user.

At some point we discussed that we preferred for our use case to allow all projects to be accessible by default. But I can see how other groups would like to restrict this.

[jsmedmar]

I think the metadata part is less of a challenge, real question is how do
you limit people in the same cluster, that belongs to the same linux
groups, from accessing the data? Is that something you also want to do, Eli?

On Thu, Jun 18, 2020 at 10:14 AM Juan Esteban Arango Ossa <
[email protected]> wrote:

This is a good point. We have though about this in the past. But it's a
little tricky. We could implement custom permissions for projects, for
example, to not display the Project View if it has a custom permission and
the user doesn't have it. But actually we would need to limit the viewable
Experiments, Analyses, and Submissions. Maybe Samples and Individuals if
they only have Experiments for that project. So the permissions would need
to be applied to every query. And the totals would be different for every
user.

At some point we discussed that we preferred for our use case to allow all
projects to be accessible by default. But I can see how other groups would
like to restrict this.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/isabl-io/cli/issues/33#issuecomment-646046420, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/ACDO7DWQFFYTL25KUBWKVK3RXIOL7ANCNFSM4OARHRBA
.

--

*Juan Medina *
Bioinformatics Engineer
Memorial Sloan-Kettering

[jsmedmar]

We were hoping to solve the server side problem with ACLs. If you dont think the ui side is difficult perhaps we can try to implement our side with a hackathon. Juanes I was thinking users could have project level permissions with their access limited at the project level. Im not sure how to lock down static file access or if thats even a problem.