Skip to main content

Access Rights Separation for Diagrams

About 3 min

Access Rights Separation for Diagrams

Stormbpmn offers a powerful toolkit for managing access to process models. Numerous parameters influence the ability to view a specific diagram or a list of diagrams.

This article covers typical tasks and how to resolve them through system configuration.

What affects access to a specific diagram

Access to a specific diagram is affected by several factors in the following order:

1. Diagram Status

The diagram status determines the maximum access level to the diagram. If the diagram is in the following status:

  • "Ready"
  • "Under Review"
  • "Archive"

The maximum access level (regardless of other settings) is READ.

2. Server settings

  • ENV variable STORM_DISABLE_ANON_SHARING β€” if set to true, any unauthenticated user will not have access to any process model, regardless of other settings.
  • Setting allDiagramsAnonAccess β€” if set to true, any unauthenticated user WILL have access to the process model at least for reading, regardless of other settings.

3. Diagram Publicity

If the diagram is hidden (the "eye" button at the top), no one other than the author will have access to the diagram, regardless of other settings.

4. Diagram Access Settings

  • If Link Access is enabled in the "Share" settings of a specific diagram, any unauthenticated user will have read-only access to the diagram.
  • If a user's e-mail address is specified in the "Share" settings of a specific diagram, that user will have access to the diagram with the specified permissions.

5. Folder and Parent Folder Permission Settings

If the "Share" settings of the folder or its parent folders containing the diagram specify a user's e-mail address, that user will gain access to the diagrams in the folder with the specified permissions. Permissions propagate down the folder tree.

6. Participation in the diagram author's team

If the diagram author and the diagram reader belong to the same team, access checks will evaluate the reader's permissions, granting them access for reading at a minimum. For details on the permissions available to team members and how they are configured via groups, see Team member roles and permissions.

7. Reader β€” Administrator

If the reader is part of the administrative team, they always have access to edit all diagrams.

What affects access to process model lists in the table and folder structure

1. Server settings

allDiagramsAnonAccess setting β€” if set to true, any authenticated user will have access to lists of all diagrams for searching in the table.

2. Joining a team

By default, any team member receives access to view process model lists and the folder structure.

3. Granular folder permissions within a team

If a team member is denied read access to "Folders", they will not see the folder structure. For details on restrictions and inheritance, see the Restricting access to folders and wiki section.

Access configuration recipes

Recipe No. 1 β€” Multiple distinct teams, each performing its own tasks, occasionally sharing diagrams with one another

Solution: Create several distinct teams, configure nothing additional at the server level, and use diagram-level settings.

Recipe No. 2 β€” Multiple different teams, each doing its own work, all constantly monitoring each other's work

Solution: Create several different teams and configure allDiagramsAnonAccess in true.

Recipe No. 3 β€” One superuser wants to see all diagrams of all teams, while teams do not want to show anything to anyone

Solution: The superuser must belong to the administrative team.

Recipe No. 4 β€” We want a single folder structure for the entire server

Solution: All participants must be grouped into a single team.

Related documentation