LabKey Server controls access to resources with a set of
security roles which represent a given set of
underlying access permissions. The permissions shown in that grid represent only a small fraction of the possible combinations of permissions available with LabKey Server.
Before embarking on creation of any new roles as described below, please connect with your Account Manager to see if we already provide something more specific for your needs. Begin by opening a ticket on your support portal describing the permissions scenario you require.
When the built in roles are not sufficient for your needs, developers can add custom security roles by defining them in a Java module as described in this topic. Once defined, other custom module code can use these new roles to control actions as needed. The basics of creating and deploying Java modules are covered in the
core documentation.
Module Structure
The items relevant to adding a new role can be included anywhere in the module resources, as long as they can be referenced from the main module class. One possible location is show here:
myModule
├── module.properties
├── resources
└── src
└── org
└── labkey
└── myModule
├── myModule.java // Register the new role here.
│
└── security
└── EditorWithoutDelete.java // Your new role is defined here.
Elements to Define
Your role will be defined as a class extending
AbstractRole and define the
name and
description to be displayed in the permissions UI. The specifics of how permissions are determined are contained in the body. The class must also override the
isApplicable method of the base security policy. See
examples below.
Register the New Role
Once defined, you provide an override in the myModule.java file in our example. Be sure to also include the dependency, similar to:
import org.labkey.myModule.security.EditorWithoutDelete;
The override section will look like this, providing the name of the class for your new role:
@Override
public void doStartup(ModuleContext moduleContext)
{
RoleManager.registerRole(new EditorWithoutDelete());
}
Example: Edit Without Delete
For example, the
Editor role permits users to read, insert, update, and delete data. If you wanted to provide a role that let users insert and update but
not delete, you could define it in a Java module.
public class EditorWithoutDelete extends AbstractRole
{
public EditorWithoutDelete()
{
super("No Delete Editor",
"Editors without the ability to delete records.",
new EditorRole().getPermissions().stream()
.filter(p -> !p.getName().equals("org.labkey.api.security.permissions.DeletePermission"))
.collect(Collectors.toList())
);
}
@Override
public boolean isApplicable(SecurityPolicy policy, SecurableResource resource)
{
return super.isApplicable(policy,resource) || resource instanceof PipeRoot || resource instanceof Study || resource instanceof Dataset;
}
}
Example: Project Admin without User Creation
As another example, you might want the ability to grant a user admin rights for project resources without also granting the ability to create new users. This involves filtering out the
AddUserPermission actions.
public class ProjectAdminRoleWithoutUserManagement extends AbstractRole
{
public ProjectAdminRoleWithoutUserManagement()
{
super("Project Admin Minus User Mgmt",
"Project Administrators without the ability to create new users.",
RoleManager.getRole(ProjectAdminRole.class).getPermissions().stream()
.filter(p -> !p.getName().equals("org.labkey.api.security.permissions.AddUserPermission"))
.collect(Collectors.toList())
);
excludeGuests();
addExcludedPrincipal(SecurityManager.getGroup(Group.groupUsers));
}
@Override
public boolean isApplicable(SecurityPolicy policy, SecurableResource resource)
{
return resource instanceof Container && ((Container)resource).isProject();
}
}
Related Topics
