[Girder-users] Restricting user access

[Andrés Fortier]

Great, thanks for the quick reply Zach! We are making good progress on
defining the workflow and so far Girder seems like a nice fit :)

On Mon, Jul 3, 2017 at 4:31 PM, Zach Mullen <zach.mullen at kitware.com> wrote:

> Hi Andy,
>
> Both of these things are pretty easy. API endpoints can be removed in your
> plugin just by using delattr on the method itself under info['apiRoot'].
> Modifying the UI to only show login for admins is pretty simple, too, by
> using the wrap function on the HeaderUserView.render function.
>
> Thanks,
>
>
>
> Zach Mullen
> Kitware, Inc.
> 919-869-8858
>
> On Mon, Jul 3, 2017 at 3:23 PM, Andrés Fortier <andres at ekumenlabs.com>
> wrote:
>
>> Hi all,
>> I was wondering if it is possible to restrict a user access to girder,
>> both in the REST API and in the web view. One use case for this is to be
>> able to treat a folder and its contents as a whole: we want a user to be
>> able to upload a folder and to update it, but always as a whole (i.e. not
>> to allow partial updates, like adding a file to it). Our idea would be to
>> have a dedicated REST endpoint for this (similar to the way a folder is
>> uploaded now) to handle the CRUD, but then we need to ensure that:
>>
>> 1. the user can't manually call the current API to update the folder. I
>> think the way to do this would be to remove some API endpoints, although
>> I'm not sure this can be done easily.
>> 2. the user can't login in the web UI (this is ok as we will be rolling
>> our dedicated UI). Is there a simple way to make the UI admin-only?
>>
>> Any hints would be much appreciated.
>>
>> Thanks!
>> Andy
>>
>> _______________________________________________
>> Girder-users mailing list
>> Girder-users at public.kitware.com
>> http://public.kitware.com/mailman/listinfo/girder-users
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://public.kitware.com/pipermail/girder-users/attachments/20170703/7d946096/attachment.html>