tiCrypt 2.18.0
Permissions
Permissions decide what a user can do in tiCrypt. You give them in a user profile, or to a single user in Management > Users. In the permission list, permissions are grouped in categories; tick a category to give all of its permissions.
A permission works together with the user's role. Permissions that act on other users, such as Deactivate users with a lower role, only work on users whose role is lower than the user's own. Super-admins have every permission.
Each table below lists:
- Permission: the name shown in the permission list. If the name was different in earlier versions, the earlier name is shown under it.
- What it allows: what a user with the permission can do, and what else they need.
- Type: whether the permission lets the user view, create, edit or delete something.
- ID: the permission ID used in exported and imported user profiles.
Permissions That Work Together
Some tasks need more than one permission. A user who has only some of them sees the action but it fails, or does not see it at all.
| To let a user… | Give them all of these |
|---|---|
| Upload files to the Vault | Create files (needed to upload), Share their files (also needed to upload) and Upload file content (needed to upload) |
| Download files | View their files and files shared with them (needed to download), Get the keys of their files and files shared with them (needed to download) and Download the content of files they can access; for files shared with a group, also Get the keys of groups they are a member of (needed to open and share group files) |
| Create directories | Create directories (also needs “Add items to directories”) and Add items to directories |
| Share files with a group | Share their files (also needed to upload) and Get the keys of groups they are a member of (needed to open and share group files) |
| Share a drive or attach it to a VM | Get drive keys (needed to share and attach drives), plus Share drives or Attach drives to VMs |
| Give other users access to a VM | Share VMs with other users and View other users' VM usernames (needed to share VMs) |
System Settings
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View system settings, such as the login logo Earlier name: View system settings (overrides for deployment file) | Lets the user read the system-wide settings that override the deployment file, such as the login logo and login message. tiCrypt Connect uses these settings, so most users need this permission. | View | ReadGlobalInfo |
System Settings Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Change system settings Earlier name: Edit (or create) system settings | Lets the user change system-wide settings in Management > System Settings, such as the login logo, login message and session timeouts, without sending a new deployment file to every user. | Edit | WriteGlobalInfo |
| Reset system settings to the deployment file's values Earlier name: Delete system settings (will default to deployment file) | Lets the user remove a system setting. tiCrypt then uses the value from the deployment file again. | Delete | DeleteGlobalInfo |
User Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View all users, not only those in their teams, groups and projects Earlier name: View all users in the system | Lets the user see every user in the system. Without it, a user sees only the people in their own teams, and the users they meet through shared groups and projects. | View | ListAllUsers |
| Edit the details of users with a lower role (name, email, department, position) Earlier name: Edit their own and lower-roled users' metadata | Lets the user change the name, contact email, department, position and deactivation reason of users with a lower role. Users can always edit their own details without this permission. | Edit | ModUser |
| Change the permissions of users with a lower role Earlier name: Edit lower-roled users' permissions | Lets the user change the permissions of users with a lower role. Super-admins can also change other super-admins' permissions, but super-admins have every permission anyway. | Edit | ChangePerm |
| Raise the role of users with a lower role, up to their own role Earlier name: Promote lower-roled users up to own role | Lets the user raise the role of a user with a lower role, up to (and including) their own role. For example, an admin can make a user a sub-admin or an admin. | Edit | Promote |
| Lower the role of users with a lower role Earlier name: Demote lower-roled users to even lower role | Lets the user lower the role of a user who already has a lower role than theirs. | Edit | Demote |
| View user profiles (permission templates) Earlier name: View profiles (role/permission templates) | Lets the user see the user profiles in Management > User Profiles. A user profile is a saved role and set of permissions that can be applied to users. | View | ReadGlobalSettings |
| Create and edit user profiles Earlier name: Create and edit profiles | Lets the user create, edit, clone and import user profiles. | Edit | WriteGlobalSettings |
| Delete user profiles Earlier name: Delete profiles | Lets the user delete user profiles. Deleting a profile does not delete the users it was applied to. | Delete | DeleteGlobalSettings |
| Activate users with a lower role Earlier name: Activate lower-roled users | Lets the user activate users with a lower role. Activating a user who was set to escrow their key at next sign-in cancels that escrow, because a user can be in only one state. | Edit | Activate |
| Deactivate users with a lower role Earlier name: Deactivate lower-roled users | Lets the user deactivate users with a lower role. A deactivated user cannot sign in. | Edit | Deactivate |
| Make users with a lower role escrow their key at their next sign-in Earlier name: Require lower-roled users to escrow their key | Lets the user mark users with a lower role so that their private key is escrowed automatically the next time they sign in. After that, the user is simply active again. | Edit | RequireEscrow |
| Delete users with a lower role Earlier name: Delete lower-roled users | Lets the user delete users with a lower role. Super-admins can also delete other super-admins. Deleted users are kept on record and can be restored. | Delete | DelUser |
| View deleted users Earlier name: View all soft-deleted users in the system | Lets the user see the users that were deleted but are still on record, in Management > Deleted Users. | View | GetDeletedUsers |
| Restore deleted users Earlier name: Reinstate soft-deleted users | Lets the user restore a deleted user, so they can sign in again. | Edit | ReenableUsers |
Teams
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View teams they are a member of Earlier name: View own teams | Lets the user see the teams they belong to. | View | GetTeamInfo |
| Edit teams they are a member of, as far as their team role allows Earlier name: Edit own teams (depending on stature per-team) | Lets the user change the name, description and members of teams they belong to, as far as their role in each team allows. | Edit | ModTeam |
Team Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View all teams Earlier name: View all teams in the system | Lets the user see every team in the system, not only their own. | View | GetAnyTeamInfo |
| Create teams | Lets the user create teams. | Create | CreateTeam |
| Edit any team Earlier name: Edit any team in the system arbitrarily | Lets the user change any team, including teams they are not a member or manager of. | Edit | ModAnyTeam |
| Delete any team Earlier name: Delete any team in the system arbitrarily | Lets the user delete any team. | Delete | DeleteTeam |
| Add users to any team Earlier name: Add users to any team arbitrarily | Lets the user add users to any team. | Create | AddAnyTeamMember |
| Edit the members of any team Earlier name: Modify any team membership arbitrarily | Lets the user change the members of any team, such as their role in the team. | Edit | ModAnyTeamMember |
| Remove users from any team Earlier name: Remove users from any team arbitrarily | Lets the user remove users from any team. | Delete | RemAnyTeamMember |
Key Escrow
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Put their own private key in escrow Earlier name: Escrow own key | Lets the user put their own private key in escrow: tiCrypt stores it split into encrypted parts held by different escrow users, so the key can be recovered if the user loses it. | Create | EscrowKey |
| Check whether their own key is in escrow Earlier name: Check if own key is escrowed | Lets the user check whether their own private key is in escrow. | View | QueryOwnKeyEscrowed |
Key Escrow Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View all keys in escrow Earlier name: View all escrowed keys in the system | Lets the user see every key that is in escrow in the system. | View | ListEscrowedKeys |
| View escrow recovery keys Earlier name: List escrow recovery keys | Lets the user see information about the recovery keys of escrowed keys. | View | ListEscrowRecoveryKeys |
| Delete keys from escrow, with their recovery parts Earlier name: Delete escrowed keys | Lets the user delete a key from escrow, together with its recovery parts. The key can no longer be recovered through escrow. | Delete | DeleteEscrowedKeyAndRecoveryParts |
| View escrow groups Earlier name: View Escrow groups | Lets the user see the escrow groups in the system. | View | GetEscrowGroups |
| View escrow users Earlier name: View Escrow users | Lets the user see information about escrow users. | View | GetEscrowUser |
| View escrow public keys Earlier name: Escrow public key | Lets the user get the public key of an escrow user or group, which is needed to escrow a key to them. | View | GetEscrowPublicKey |
| View the history of escrow actions approved with a Sitekey Earlier name: View history of all Sitekey-authorized Escrow actions | Lets the user see the history of escrow actions that were approved with a Sitekey. | View | ListEscrowCertificates |
Vault Files and Directories
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View their files and files shared with them (needed to download) Earlier name: View metadata for own files (necessary to download) | Lets the user see the files they own, the files shared with them and the files they shared. Needed to download a file. | View | GetFileInfo |
| View the history of their files (sharing, project tags, deletion) Earlier name: View access/sharing/project history of own files | Lets the user see the history of their files: when each file was created, shared or unshared, tagged with a project, or deleted. | View | GetFileHist |
| Create files (needed to upload) Earlier name: Create file metadata | Lets the user create new files in the Vault. Uploading a file also needs Share their files (to store the user's own key for the file) and Upload file content. | Create | CreateFile |
| Get the keys of their files and files shared with them (needed to download) Earlier name: View keys for own files (necessary to download) | Lets the user get the key that decrypts a file they own or that was shared with them. Needed to download a file. For a file shared with a group, the user also needs Get the keys of groups they are a member of. | View | GetFileKey |
| Share their files (also needed to upload) Earlier name: Share own files | Lets the user share their files with users and groups. Also needed to upload, because uploading stores the user's own key for the new file. Sharing with a group also needs Get the keys of groups they are a member of. | Create | AddFileKey |
| Unshare their files Earlier name: Unshare own files | Lets the user unshare their files from users and groups. | Delete | DelFileKey |
| Download the content of files they can access Earlier name: Download own files' content | Lets the user download the encrypted content of files they can access. Downloading also needs View their files… and Get the keys of their files…. | View | ReadChunk |
| Upload file content (needed to upload) Earlier name: Upload content to own files | Lets the user upload the encrypted content of files. Needed to upload. | Edit | WriteChunk |
| Transfer files from the Vault to VMs Earlier name: Transfer file from Vault to VM | Lets the user copy files from their Vault into a VM. | View | ReadChunkInternal |
| Transfer files from VMs to the Vault Earlier name: Transfer file from VM to Vault | Lets the user copy files from a VM into their Vault. | Edit | WriteChunkInternal |
| Delete their files Earlier name: Delete own files | Lets the user delete files they own. | Delete | DeleteFile |
| View their directories and their groups' directories Earlier name: View directories | Lets the user see the contents of their own directories and of the directories of groups they belong to. | View | GetDirInfo |
| Create directories (also needs “Add items to directories”) Earlier name: Create directories | Lets the user create directories. A new directory also has to be placed in an existing one, so this needs Add items to directories too. In a group's directories, the user's group permissions must also allow it. | Create | CreateDir |
| Delete directories (also needs “Remove items from directories”) Earlier name: Delete directories | Lets the user delete directories they own, or group directories where they may remove items. Removing the directory from its parent also needs Remove items from directories. | Delete | DelDir |
| Add items to directories Earlier name: Create entries in directories | Lets the user add files and directories to their directories. In a group's directories, the user's group permissions must also allow it. | Create | CreateDirEntry |
| Rename files and directories Earlier name: Rename entries in directories | Lets the user rename files and directories. In a group's directories, the user's group permissions must also allow it. | Edit | ModDirEntry |
| Remove items from directories Earlier name: Delete entries in directories | Lets the user remove files and directories from their directories. In a group's directories, the user's group permissions must also allow it. | Delete | DelDirEntry |
| View any user's Vault storage use Earlier name: View usage of vault for any user | Lets the user see how much Vault storage any user uses, including themselves. | View | GetAnyVaultUsage |
Groups
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View groups they are a member of | Lets the user see the groups they belong to. | View | GetGroupInfo |
| Get the keys of groups they are a member of (needed to open and share group files) Earlier name: View keys for groups they are a member of | Lets the user get their copy of the key of each group they belong to. Without it, the user cannot open files shared with their groups, share files with groups, or add people to their groups. | View | GetGroupKey |
| Create groups | Lets the user create groups, which are used to share files with several people at once. | Create | CreateGroup |
| Rename groups they own and give ownership to another member Earlier name: Rename own groups and transfer ownership | Lets the user rename groups they own, and give ownership of a group to another member. | Edit | ModGroup |
| Add users to groups they are a member of, if the group allows it Earlier name: Add users to groups they are a member of | Lets the user add people to groups they belong to. Unless they own the group, their permissions inside the group must also allow adding members. | Create | AddGroupMem |
| Change other members' group permissions in groups they are a member of Earlier name: Edit other members in groups they are a member of | Lets the user change what other members may do inside groups they belong to. Group owners can always do this in their own groups. | Edit | ModGroupPerm |
| Remove users from groups they are a member of, if the group allows it Earlier name: Remove other users from groups they are a member of | Lets the user remove people from groups they belong to. Unless they own the group, their permissions inside the group must also allow it. Nobody can remove a group's owner; the owner must give ownership to someone else first. | Delete | RemGroupMem |
| Delete groups they own Earlier name: Delete groups they are the owner of | Lets the user delete groups they own. | Delete | DeleteGroup |
Inboxes
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View their inboxes Earlier name: View own inboxes | Lets the user see which of their directories are inboxes. | View | ListMailboxes |
| Create inboxes, so people without an account can send them files Earlier name: Create inboxes | Lets the user turn one of their directories into an inbox, so people without a tiCrypt account can send files securely to their Vault. | Create | CreateMailbox |
| Delete their inboxes Earlier name: Delete inboxes | Lets the user remove inboxes they created. | Delete | DeleteMailbox |
Projects
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View projects they are a member of | Lets the user see the projects they belong to. | View | ListOwnProjects |
| View the members of projects they are a member of Earlier name: View other members in projects they are a member of | Lets the user see the other members of projects they belong to. | View | ListOwnProjectMemberships |
| View all security requirements Earlier name: View all security requirements in the system | Lets the user see all security requirements: what a user must be certified for before they can use a project's restricted items. | View | ListSecurityRequirements |
| View all security levels Earlier name: View all security levels in the system | Lets the user see all security levels that can be set on projects. | View | ListSecurityLevels |
| View their own certifications Earlier name: View own security requirement certifications | Lets the user see their own certifications, which show the security requirements they meet. | View | ListOwnUserCertifications |
| Tag what they own with a project they are active in Earlier name: Classify resources with projects they are active in | Lets the user tag what they own (such as files and drives) with a project they are active in. A project tag restricts the item to members of the project who are certified for its security requirements. | Edit | HeightenProjectTag |
Project Management
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Remove project tags of projects they manage Earlier name: Declassify resources tagged with projects they manage | Lets a project manager remove the project tag of a project they manage from items, which makes them less restricted. | Edit | LessenProjectTag |
| Create subprojects in projects they manage Earlier name: Create subprojects of projects they manage | Lets a project manager create subprojects inside projects they manage. | Create | ManagerCreateProject |
| Edit projects they manage Earlier name: Edit metadata for projects they manage | Lets a project manager change the name and details of projects they manage. | Edit | ManagerModifyProject |
| Delete projects they manage | Lets a project manager delete projects they manage. | Delete | ManagerDeleteProject |
| Add users to projects they manage | Lets a project manager add users to projects they manage. | Create | ManagerAddProjectMembership |
| Edit memberships, such as expiration dates, in projects they manage Earlier name: Edit memberships in projects they manage | Lets a project manager change memberships in projects they manage, such as when a membership expires. | Edit | ManagerModifyProjectMembership |
| Remove users from projects they manage | Lets a project manager remove users from projects they manage. | Delete | ManagerRemoveProjectMembership |
| View all users' certifications Earlier name: View all security requirement certifications in the system | Lets the user see every user's certifications for security requirements. | View | ListUserCertifications |
| Certify users for security requirements | Lets the user record that a user meets a security requirement (certify them). | Create | AddUserCertification |
| Edit users' certifications, such as expiration dates Earlier name: Edit user certifications for security requirements | Lets the user change a user's certification, such as when it expires. | Edit | ModifyUserCertification |
| Remove users' certifications Earlier name: Delete user certifications for security requirements | Lets the user remove a certification from a user. | Delete | DeleteUserCertification |
Project Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View all projects Earlier name: View all projects in the system | Lets the user see every project in the system. | View | ListAnyProject |
| Tag anything with any project Earlier name: Arbitrarily tag resources with any project | Lets the user tag any item with any project, or change or remove its tag, whether or not they own it or belong to the project. | Edit | SetProjectTag |
| Create security requirements | Lets the user create security requirements. | Create | CreateSecurityRequirement |
| Edit security requirements | Lets the user change security requirements. | Edit | ModifySecurityRequirement |
| Delete security requirements | Lets the user delete security requirements. | Delete | DeleteSecurityRequirement |
| Create security levels | Lets the user create security levels. | Create | CreateSecurityLevel |
| Edit security levels | Lets the user change security levels. | Edit | ModifySecurityLevel |
| Delete security levels | Lets the user delete security levels. | Delete | DeleteSecurityLevel |
| Create top-level projects Earlier name: Create root-level projects | Lets the user create top-level projects (projects that are not inside another project). | Create | CreateProject |
| Edit any project Earlier name: Arbitrarily edit any project | Lets the user change any project, whether or not they manage it. | Edit | ModifyProject |
| Delete any project Earlier name: Arbitrarily delete any project | Lets the user delete any project. | Delete | DeleteProject |
| View the members of every project Earlier name: View memberships for every project in the system | Lets the user see the members of every project, and every project a user belongs to. | View | ListAnyProjectMembership |
| Add users to any project Earlier name: Arbitrarily add users to any project | Lets the user add users to any project. | Create | AddProjectMembership |
| Edit memberships in any project Earlier name: Arbitrarily edit any project membership | Lets the user change any project membership, such as when it expires. | Edit | ModifyProjectMembership |
| Remove users from any project Earlier name: Arbitrarily remove users from any project | Lets the user remove users from any project. | Delete | RemoveProjectMembership |
Virtual Machines
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View their drives Earlier name: View drives (inconsistent, see notes) | Lets the user see their encrypted drives. | View | GetDriveInfo |
| Create drives | Lets the user create encrypted drives for VMs. | Create | CreateDrive |
| Edit drives (name and backup setting) Earlier name: Edit drives (name and whether to disable backup) | Lets the user change a drive's name and whether it is backed up. | Edit | ModifyDrive |
| Get drive keys (needed to share and attach drives) Earlier name: View drive keys (necessary to share/attach) | Lets the user get the key of a drive. Needed to share a drive and to attach it to a VM. | View | GetDriveKey |
| Share drives | Lets the user share drives with other users. | Create | AddDriveKey |
| Unshare drives | Lets the user unshare drives. | Delete | DelDriveKey |
| Attach drives to VMs | Lets the user attach drives to VMs. | Edit | AttachDrive |
| Detach drives from VMs | Lets the user detach drives from VMs. | Edit | DetachDrive |
| Delete drives they own | Lets the user delete drives they own. | Delete | DeleteDrive |
| View the VM hardware setups available to them Earlier name: View hardware/image setups made available to them | Lets the user see the VM hardware setups (hardware and image combinations) they may use to start VMs. | View | GetBrickInfo |
| View their VM configurations and those shared with them Earlier name: View own VM configs and configs shared with them | Lets the user see their own VM configurations and the ones shared with them. | View | GetVMConfigInfo |
| Create and edit VM configurations Earlier name: Create (and edit) VM configs | Lets the user create and edit VM configurations. | Create | CreateVMConfig |
| Start VMs from VM configurations Earlier name: Spawn VMs from VM configs | Lets the user start VMs from VM configurations. | Create | RunVMConfig |
| Force-stop VMs started from VM configurations Earlier name: Stop VMs spawned from VM configs | Lets the user force-stop VMs that were started from VM configurations. | Delete | KillVMConfig |
| View their own VM username Earlier name: View own VM username | Lets the user see their own VM username, the login name they have on every VM. | View | GetOwnVirtAccountInfo |
| View other users' VM usernames (needed to share VMs) Earlier name: View anyone's VM username (necessary for sharing VMs) | Lets the user see other users' VM usernames. Needed to give other users access to a VM. | View | GetAnyVirtAccountInfo |
| Let their VMs transfer files straight to their Vault Earlier name: Create sub-session for VM->Vault direct transfer | Lets the user's VMs act for them with a limited session, such as to copy files straight from the VM to the user's Vault. | Create | CreateSubSession |
| View their VMs and VMs shared with them Earlier name: View own VMs and VMs shared with them | Lets the user see their own VMs and the VMs shared with them. | View | GetVMInfo |
| Start VMs without a VM configuration Earlier name: Spawn VMs (without a config) | Lets the user start VMs without using a VM configuration. | Create | CreateVM |
| Connect to their VMs and VMs shared with them Earlier name: Connect to own VMs and VMs shared with them | Lets the user connect to their own VMs and the VMs shared with them, for example to open a terminal or desktop. | View | ProxyToVM |
| Share VMs with other users | Lets the user give other users access to their VMs. | Create | AuthorizeVMAccess |
| Shut down their VMs Earlier name: Shutdown own VMs | Lets the user shut down their VMs. | Delete | DeleteVM |
| View the storage pools of any realm Earlier name: View storage pools for any Libvirt realm | Lets the user see the Libvirt storage pools of any realm. | View | GetPoolsForRealm |
| Look up individual storage pools Earlier name: Lookup individual Libvirt storage pools | Lets the user look up a single Libvirt storage pool by its type or ID. | View | GetStoragePool |
VM Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Delete any drive Earlier name: Delete arbitrary drives | Lets the user delete any drive in the system, whether or not they own it or it is shared with them. | Delete | DeleteAnyDrive |
| Create storage pools Earlier name: Create Libvirt storage pools | Lets the user create Libvirt storage pools, which hold raw volumes such as drive and VM image files. | Create | CreateStoragePool |
| Edit any storage pool Earlier name: Edit Libvirt storage pools | Lets the user change any storage pool. | Edit | UpdateStoragePool |
| Delete any storage pool Earlier name: Delete Libvirt storage pools | Lets the user delete any storage pool. | Delete | DeleteStoragePool |
| View raw volumes (VM image files) Earlier name: View raw Libvirt volumes (images) | Lets the user see the raw volumes (VM image files) in the storage pools. | View | ListRawImages |
| Upload raw volumes (VM image files) Earlier name: Upload raw Libvirt volumes (images) | Lets the user upload raw volumes, such as VM image files. | Create | UploadLargeObject |
| View all VM images | Lets the user see all VM images. | View | ListImages |
| Create VM images from raw volumes Earlier name: Create VM images (from Libvirt volumes) | Lets the user create VM images from raw volumes. | Create | CreateImages |
| Edit any VM image | Lets the user change any VM image. | Edit | ModifyImages |
| Delete any VM image | Lets the user delete any VM image. | Delete | DeleteImages |
| View all VM hardware setups Earlier name: View all hardware/image setups in the system | Lets the user see every VM hardware setup in the system. | View | ListAnyBricks |
| Create VM hardware setups Earlier name: Create hardware/image setups | Lets the user create VM hardware setups. | Create | CreateBrick |
| Edit any VM hardware setup Earlier name: Edit hardware/image setups | Lets the user change any VM hardware setup. | Edit | ModifyAnyBrick |
| Delete any VM hardware setup Earlier name: Arbitrarily delete any hardware/image setup | Lets the user delete any VM hardware setup. | Delete | DeleteAnyBrick |
| View all VM configurations Earlier name: View all VM configs in the system | Lets the user see every VM configuration in the system. | View | ListAnyVMConfig |
| Edit any VM configuration Earlier name: Arbitrarily edit any VM config | Lets the user change any VM configuration. | Edit | ModifyAnyVMConfig |
| Delete any VM configuration Earlier name: Arbitrarily delete any VM config | Lets the user delete any VM configuration. | Delete | DeleteAnyVMConfig |
| View VM host machines and their hardware in any realm Earlier name: View host machines and hardware information in any Libvirt realm | Lets the user see the VM host machines of every realm and their hardware. | View | ViewHosts |
| Create hardware profiles Earlier name: Create new hardware profiles (metadata) | Lets the user create hardware profiles, which describe the hardware of host machines. | Create | CreateHardwareProfile |
| Edit any hardware profile | Lets the user change any hardware profile. | Edit | ModifyHardwareProfile |
| Delete any hardware profile | Lets the user delete any hardware profile. | Delete | DeleteHardwareProfile |
| Add VM host machines to realms Earlier name: Register physical VM host machines in Libvirt realms | Lets the user add VM host machines to realms. | Create | AddHosts |
| Edit VM host machines in any realm Earlier name: Edit VM host machine info in any Libvirt realm | Lets the user change the details of VM host machines in any realm. | Edit | ModifyHosts |
| Remove VM host machines from any realm Earlier name: Delete VM host machine info in any Libvirt realm | Lets the user remove VM host machines from any realm. | Delete | DeleteHosts |
| View licensing servers Earlier name: View external servers | Lets the user see the licensing servers (external servers that VMs are allowed to reach). | View | GetExternalServer |
| Create licensing servers Earlier name: Create external servers | Lets the user add licensing servers. | Create | CreateExternalServer |
| Edit licensing servers Earlier name: Edit external servers | Lets the user change licensing servers. | Edit | ModifyExternalServer |
| Delete licensing servers Earlier name: Delete any licensing server | Lets the user delete licensing servers. | Delete | DeleteExternalServer |
| Change any user's VM username Earlier name: Modify any user's VM username | Lets the user change any user's VM username, the login name the user has on every VM. | Edit | ModifyVirtAccountInfo |
| View the logs of any VM Earlier name: Arbitrarily view logs from any VM | Lets the user see the logs that the VM controller reports for any VM. | View | GetAnyVMLogs |
Slurm
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View Slurm node information Earlier name: View SLURM node information | Lets the user see information about Slurm nodes. | View | SlurmGetNodeInfo |
| View Slurm share information Earlier name: View SLURM share information | Lets the user see Slurm share information. | View | SlurmGetShareInfo |
| View Slurm job information Earlier name: View SLURM job information | Lets the user see information about Slurm jobs. | View | SlurmGetAllJobsInfo |
| View past Slurm job information Earlier name: View past SLURM job information | Lets the user see information about past Slurm jobs. | View | SlurmGetAllPastJobs |
| View Slurm system information Earlier name: View SLURM system information | Lets the user see information about the Slurm system. | View | SlurmGetSystemInfo |
| View the Slurm partitions they can use Earlier name: Get SLURM access partition | Lets the user (or their VM) see the Slurm partitions they can use. | View | SlurmGetAccessPartition |
| View all Slurm partitions Earlier name: List SLURM partitions | Lets the user (or their VM) see every Slurm partition in the system, including ones they cannot use. | View | SlurmListPartitions |
Miscellaneous
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Transfer ownership of their files and drives Earlier name: Transfer ownership of own files and drives | Lets the user give ownership of their files and drives to another user. The new owner must already have a key for the item, which means it must be shared with them. Sub-admins and higher can also transfer drives they manage, even ones they do not own. | Edit | ChangeObjectOwnership |
Discovered from Server
If the tiCrypt server has permissions that this version of the web application does not know, they are listed in the Discovered from Server category, by their permission ID. They can still be given and removed there.
tiCrypt also has permissions for surveys, such as ListForms and CreateForm. The permission list does
not show them, so they are not covered on this page.