tiCrypt 2.17.15

Groups and Access Control

A VM group is a set of users inside a running virtual machine, and an access directory is a folder whose contents are governed by an access control list. Groups say who people are; access directories say what those people can reach. Together they are how a VM Owner subdivides a machine so that several people can work on it without all seeing the same data.

An access directory is not a separate kind of storage. It is an ACL applied to a directory on a read-write drive, scoping which users and groups on the VM can read or write inside it. The data stays where it is; what changes is who can reach it.

Why groups exist alongside VM roles

Roles decide authority; groups decide reach. A VM role (Owner, Co-owner, Manager, User) determines what someone can administer. It does not by itself determine which files they can open. A user with the plain User role has access governed entirely by their group membership and the access directories configured on the machine.

This is how one machine serves several collaborators. Without groups, sharing a VM would mean sharing everything mounted on it. Access directories let an Owner give a statistician the de-identified extract and nothing else, on the same machine, without provisioning a second VM and a second copy of the data.

Access control list templates make the arrangement repeatable. A template is a named set of permissions that you assign to users and groups on an access directory, so the same permissions are applied the same way everywhere. A template can be imported from the same or another VM rather than rebuilt by hand.

Before you begin

• The VM is running and you are its Owner, or a Co-owner or Manager with group permissions.
• The users you intend to add already exist in the VM. See VM User Management.

Create a Group in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to create a VM group.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Groups section in the left panel.
6. Click the Create group button in the top right panel.
7. In the pop-up, enter the group name.
8. Click Create group.

Sync Multiple Groups in a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to sync its VM groups.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Groups section in the left panel.
6. Click the Sync all groups button in the top right panel.

note

Syncing groups created by other admins helps you configure VM access for multiple users at once.

Add Members to a Virtual Machine Group

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine whose group you want to add members to.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Groups section in the left panel.
6. Select the existing group to add new members.
7. Click the Open full menu button in the top right panel.
8. Select Edit membership.
9. In the prompt, enter the user names to add to the group.
10. Click Update membership.

info

You can only add members who belong to the virtual machine.

tip

If you accidentally add a user to the virtual machine group in the prompt, click Undo add next to the user before you click Update membership.

Remove Members from a Virtual Machine Group

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine whose group you want to remove members from.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Groups section in the left panel.
6. Select the existing group to remove its members.
7. Click the Open full menu button in the top right panel.
8. Select Edit membership.
9. In the prompt, click Delete next to the user names you want to remove.
10. Click Update membership.

caution

Removing a user from a virtual machine group does not revoke their access to the virtual machine.

Open Access Control List Templates in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine whose access control list templates you want to view.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Control List templates section in the left panel.
6. View the access control list templates.

note

The Access Control List templates section appears only on Windows virtual machines.

Create an Access Control List Template in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine for which you want to create access control list templates.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Control List templates section in the left panel.
6. Click the Add ACL template button in the top right panel.
7. In the pop-up, enter the ACL name and optional description.
8. Select the appropriate permissions.
9. Click Save.

Import an Access Control List Template from an Existing Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine for which you want to import access control list templates.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Control List templates section in the left panel.
6. Click the Add ACL template button in the top right panel.
7. In the pop-up, tick Import templates from same or other VM.
8. Next, select an existing ACL template from the list.
9. Update the ACL name, description and permissions.
10. Click Save.

note

Importing an ACL template helps you create similar templates quickly.

Edit an Access Control List Template in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine whose access control list templates you want to edit.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Control List templates section in the left panel.
6. Select the access control list template to edit.
7. Click the Open full menu button in the top right panel.
8. Select Edit.
9. In the pop-up, edit the access control list template name and optional description.
10. Click Save.

View Details of Access Control List Templates in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine whose access control list templates you want to view.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Control List templates section in the left panel.
6. Find the access control list template to view.
7. Click the access control list template name to open its details.
8. In the new window, view the name, description and built-in status of the access control list template.

Refresh Details of Access Control List Templates in a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine whose access control list templates you want to refresh.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Control List templates section in the left panel.
6. Find the access control list template to refresh.
7. Click the access control list template name to open its details.
8. In the new window, click the Refresh button in the top right panel.

Replace Access Control List Templates in Virtual Machines

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine whose access control list templates you want to replace.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Control List templates section in the left panel.
6. Select the access control list template you want to replace.
7. Click the Open full menu button in the top right panel.
8. Select Replace ACL template.
9. In the prompt, select the ACL template to replace it with.
10. Click Replace.

note

• The ACL template you replace must be used by at least one access directory.
• Replacing ACL templates changes permissions consistently across all access directories using that ACL template. This helps you make changes at scale.

Delete Access Control List Templates in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine whose access control list templates you want to delete.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Control List templates section in the left panel.
6. Select the access control list template to delete.
7. Click the Open full menu button in the top right panel.
8. Select Delete ACL template.
9. In the prompt, type "Delete" followed by the name of the access control list.
10. Click Delete followed by the name of the access control list.

View an Access Directory for a Virtual Machine Group

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to view the access directory.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Directories section in the left panel.
6. Click the name of the access directory to view.
7. In the new window, view the access directory's basic information, owner, and group.

Confirmations, Errors & Solutions

Access Directories Section Missing in Virtual Machine

The Access Directories section does not appear in the VM Settings and Details window.

Ask Access Directories Permissions from VM Owner

Ask the VM owner to allow you to open the VM access directories. The VM Settings and Details option itself only appears for Managers, Co-owners, and the Owner of the VM.

To Virtual Machine Owner
To grant VM users permissions to VM access directories:  

1. In the VMs section, click the virtual machine where you want to update a user's access directory permissions.
2. Click the VM Settings and Details option in the bottom center.
3. In the new window, select the Users section in the left panel.
4. Next, select the appropriate user, then click the Open full menu button in the top-right panel.
5. Select Edit user access.
6. In the pop-up, set the profile to Custom.
7. Scroll down under Permissions, and tick Access Directories.
8. Click Save.

Failed to Look Up Drive in Access Directory

Failed to look up drive name: insufficient permissions: drives:list: missing permission: {PermDrives}

Ask Drive Permissions from Your Admin

Ask the VM owner to allow you to view drives.

To Virtual Machine Owner
To grant VM users permission to view VM drives:  

1. In the VMs section, click the virtual machine where you want to update a user's drive permissions.
2. Click the VM Settings and Details option in the bottom center.
3. In the new window, select the Users section in the left panel.
4. Next, select the appropriate user, then click the Open full menu button in the top-right panel.
5. Select Edit user access.
6. In the pop-up, set the profile to Custom and the role to Manager.
7. Scroll down under Permissions, and tick Drives List, format, mount, and unmount drives.
8. Click Save.

Refresh Access Directory Data for a Virtual Machine Group

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to view the access directory.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Directories section in the left panel.
6. Click the name of the access directory whose data you want to refresh.
7. In the new window, click the Refresh button in the top right panel.

Repair Permissions in an Access Directory for a Virtual Machine Group

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to view the access directory.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Directories section in the left panel.
6. Click the name of the access directory whose permissions you want to repair.
7. In the new window, click the Repair permissions button in the top right panel.

note

The Repair permissions option is available only to users with the Manager role or higher on the VM, and not for user home access directories.

Create an Access Directory for a Virtual Machine Group

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to create an access directory in.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Directories section in the left panel.
6. Click Create access directory in the top right panel.
7. In the prompt, select the access directory location.
8. Next, enter the directory name and owner.
9. Optionally, for Windows and Linux OS, enter the user and group permissions associated with the access control list.
10. Click Create.

info

To create a new group for the access directory from scratch, click the Create a group button in the prompt.

Confirmations, Errors & Solutions

Created Access Directory Successfully

Created access directory.

Failed to Enter Access Directory Name

You must enter a name.

Enter Access Directory Name

Enter the access directory name in the Name field.

Failed to Select an Access Directory Owner

You must select an owner.

Select an Access Directory Owner

Under the Owner field, select an access directory owner.

Failed to Select an ACL Template

You must select a ACL template.

Select an ACL Template

For each entry under Users and Groups, select an option in the ACL template field.

Failed to Create Access Directory

Failed to create access directory: [restricted-action]: action is restricted: accessDirectories:create.

Choose a Different Location for the Access Directory

restricted-action means the location you selected is not allowed. It is a problem with the location on the drive you selected rather than with your permissions.

On the VM's home drive, an access directory cannot be created at the root of the drive or inside a .ticrypt directory. Select a subdirectory of the home drive, or a directory on another drive.

Sync All Permissions for Access Directories in a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to sync its access directory permissions.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Directories section in the left panel.
6. Click Sync all permissions in the top right panel.

Confirmations, Errors & Solutions

Synced All Permissions Successfully

Sync permissions for vm-name (total-syncing-time).

Edit an Access Directory for a Virtual Machine Group

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to edit its access directory.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Directories section in the left panel.
6. Select the access directory to edit, then click the Open full menu button in the top right panel.
7. Select Edit access directory.
8. In the prompt, update the directory name and owner.
9. Optionally, for Windows and Linux OS, enter the user and group permissions associated with the access control list.
10. Click Update.

note

You cannot edit your Home access directory.

Confirmations, Errors & Solutions

Updated Access Directory Successfully

Update access directory access-directory-name (total-updating-time).

Delete an Access Directory for a Virtual Machine Group

Method One

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to delete its access directory.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Directories section in the left panel.
6. Select the access directory you want to delete.
7. Click the Open full menu button in the top right panel.
8. Select Remove access directory.

Method Two

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to delete its access directory.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, click the Access Directories section in the left panel.
6. Find the access directory you want to delete.
7. Click the access directory name to open its details.
8. In the new window, click Delete in the top right panel.
9. In the pop-up, click Delete access directory.

caution

When you delete an access directory, all its members lose access to it until you create another access directory. You cannot delete your Home access directory.

Confirmations, Errors & Solutions

Deleted Access Directories Successfully

Delete total-number-of-access-directories access directories (total-deletion-time).