Differences

This shows you the differences between two versions of the page.

--- rootdir_security [2022/02/10 15:36] – [Accessing secured content] yves
+++ rootdir_security [2022/03/14 11:48] (current) – [Public vs private] yves
@@ Line 7: / Line 7: @@
       * Configure public/secret key combinations for S3 resources
       * Configure account credentials to be used when accessing a UNC network resource path
-  * Prevent users from access mounted content through root directories that they are or are not allowed to do
+  * Prevent [[user_management|users]] from access mounted content through root directories that they are or are not allowed to do
       * Define Access control lists
@@ Line 18: / Line 18: @@
 === Local hard disk entry points ===
-If you want to expose a local folder on the server's hard disk as a root directory in PMA.core, the simplest way to do this is by giving the IIS user account access rights to the folder using the Windows Explorer:
+If you want to expose a local folder on the server's hard disk as a root directory in PMA.core, you have to give the IIS user account access rights to the folder using the Windows Explorer:
 {{ :rootdir_local10.png?direct&400 |}}
+Note that even though the dialog shows impersonation options, you can't use these in a local path reference context. The impersonation properties are reserved for networked content, and if you fill them in, PMA.core tries to interpret your local reference as a network path, and subsequently fails trying to access it.
+{{ ::rootdir_local20.png?direct&400 |}}
+So when defining local hard disk paths, make sure the impersonation options are left blank.
 === Network storage (UNC paths) ===
@@ Line 33: / Line 38: @@
 {{ :rootdir_network10.png?direct&400 |}}
+We can enter this as a path for the mounting point, and add the impersionation information for our pma_read user:
+{{ :rootdir_network20.png?direct&400 |}}
+The mounting point shows up, and you can activate the View slides tab to inspect its content:
+{{ :rootdir_network30.png?direct&400 |}}
+If the credentials are faulty, an error appears
 === S3 storage ===
+PMA.core is one of the few vendors that [[https://www.prweb.com/releases/pathomation_announces_support_for_cloud_storage_and_file_transfer_protocol_ftp_servers/prweb18296771.htm|supports cloud storage natively]].
+Let's say that you have an S3 bucket and put slides in it:
+{{ ::rootdir_s3_10.png?direct&400 |}}
+To protect access, you should create a dedicated entity that can only access that content.
+{{ ::rootdir_s3_20.png?direct&400 |}}
+You can then create a pair of dedicated access / secret keys for the new entity:
+{{ :rootdir_s3_30.png?direct&400 |}}
+These keys are then used to configure the S3 mounting point at the PMA.core side:
+{{ :rootdir_s3_40.png?direct&400 |}}
+The mounting point only functions when the provided credentials are still active on the S3 storage side. If not, an error message ensues:
+{{ :rootdir_s3_50.png?direct&400 |}}
+If all is well, you can now browse your slides directly from your S3 content.
+{{ :rootdir_s3_60.png?direct&400 |}}
 === Azure storage ===
+Microsoft Azure has its own protocol, and so we provide a separate mounting point type of it.
-==== Public vs private ====
+Let's say that you have an Azure container defined and put some slides in it already:
-Public root directories can be accesses by anybody who is a registered user in the PMA.core user repository.
+{{ :rootdir_azure_10.png?direct&400 |}}
-Private root directories are only accessible by those who have been explicitly given access to be allowed to access the folder through the directory's [[acl|access control list]].
+You can convert these credentials in a connectionstring:
+''%%DefaultEndpointsProtocol=https;AccountName=pathomation;AccountKey=SUPERSECRET;BlobEndpoint=https://pathomation.blob.core.windows.net/;QueueEndpoint=https://pathomation.queue.core.windows.net/;TableEndpoint=https://pathomation.table.core.windows.net/;FileEndpoint=https://pathomation.file.core.windows.net/;%%''
-==== Access control lists ====
+This text snippet is then pasted in the connection string field of the mounting point properties:
-As you have more users and more root-directories, it becomes undesirable that everybody is allow to see everything.
+{{ :rootdir_azure_20.png?direct&400 |}}
+If all goes well, you can now serve your slides from your Azure storage repositories.
+==== Public vs private ====
+As you have more [[user_management|users]] and more root-directories, it becomes undesirable that everybody is allowed to see everything.
 Therefore, root-directories can be marked "public" or "private":
-  * Unordered List ItemWhen they are marked "public", it means every user has access to them.
-  * Unordered List ItemWhen they are marked "private", it means only select users can see the content
+{{ :rootdir_public_private_switch.png?direct&200 |}}
+Public root directories are marked "public", it means every user has access to them. They can be accessed by anybody who is a registered user in [[user_management|the PMA.core user repository]].
+Private root directories are marked "private", it means only select users can see the content. They are only accessible by those who have been explicitly given access to be allowed to access the folder through the directory's [[rootdir_security#access_control_list|access control list]].
+==== Access control lists ====
 Once marked private, you can select what users are allowed to see the content of the root directory, and which ones aren't: Do this by pressing the "Edit access control list" link after you selected the "private" option:
 {{ :acl.png?nolink&400 |}}
+An interactive overview grid is available via the Root directories management view:
+{{ :rootdir_acl_20.png?direct&400 |}}
+As you get even more root-directories and more users, it is useful to get an overview of who has access to what. For that, you can request the ACL report from the root-directories view.
+{{ :overview.png?nolink&400 |}}
+The resulting report looks like this:
+{{ :overview2.png?nolink&400 |}}