Hi Eric!
See my comments inline below.
Il 2013-11-06 19:56 Eric Rasche ha scritto:
Hi Nicola,
Oh, excellent. I must've skipped over that, given the strange title
of
the thread.
Your solution at the end of that thread is very promising, and
certainly
handles failure MUCH better than mine does (i.e. raising exceptions
and
not breaking a workflow if the user isn't permitted access.)
(Did you put it on the galaxy wiki anywhere? If it weren't for you
linking that, I never would've known about it and that's very useful
info!)
No, the original code is from John, so I blame him for not documenting
it ;)
Seriously, I can do that, maybe even create a pull request with the
code, if there's enough interest.
In my organisation's case; if a user isn't allowed access to a given
tool, we believe that
- - galaxy has no reason to admit it exists
- - galaxy should not share default information about a tool
Which is a bit different from the case of having a license to use a
tool. For licensing issues, naturally it would be fine to say "yes
this
exists and if you can't run it, obtain a license".
For my org's case, we might want to store administrative tools (for
other services) in galaxy. It's a very convenient platform for more
than
just bioinformatics and we have some non-technical people on staff
who
occasionally need to pull various data sets from various
services/make
database backups/etc. Students and clients who use our galaxy
instance
don't need to know that these tools are available.
Thoughts?
In his first reply in the mentioned thread, John explained also how to
hide tools using tool filters. Here is his example code:
https://github.com/jmchilton/galaxy-central/commit/b500a24bc1aa94bef48db20a7cc1f3d68855b7fd#diff-2
In the mean time, tool filters has been enhanced with this pull request
by Bjoern:
https://bitbucket.org/galaxy/galaxy-central/pull-request/179/implement-the-ability-to-change-the-tool/diff
I hope this is what you need.
Best,
Nicola
On 11/06/2013 12:12 PM, Nicola Soranzo wrote:
Hi Eric,
please also take a look at this mailing list thread:
http://dev.list.galaxyproject.org/pass-user-groups-to-dynamic-job-runner-td4661753.html
If you are interested in the is_user_in_group solution, I have a
slightly updated version which also uses roles instead of groups.
Nicola
Il giorno mer, 06/11/2013 alle 11.38 -0600, Eric Rasche ha scritto:
Howdy devs,
I've implemented some rather basic tool access control and am
looking
for feedback on my implementation.
# Why
Our organisation wanted the ability to restrict tools to different
users/roles. As such I've implemented as an "execute" tag which can
be
applied to either <section> or <tools> in the tool configuration
file.
# Example galaxy-admin changes
For example:
<section execute="[email protected],[email protected]" id="EncodeTools" name="ENCODE
Tools">
<tool file="encode/gencode_partition.xml" />
<tool execute="[email protected]" file="encode/random_intervals.xml" />
</section>
which would allow A and B to access gencode_parition, but only B
would
be able to access random_intervals. To put it explicity
- by default, everyone can access all tools
- if section level permissions are set, then those are set as
defaults
for all tools in that section
- if tool permissions are set, they will override the defaults.
# Pros and Cons
There are some good features
- non-accessible tools won't show up in the left hand panel, based
on user
- non-accessible tools cannot be run or accessed.
There are some caveats however.
- existence of tools is not completely hidden.
- Labels are not hidden at all.
- workflows break completely if a tool is unavailable to a shared
user
and the user copies+edits. They can be copied, and viewed (says
tool not
found), but cannot be edited.
Tool names/id/version info can be found in the javascript object
due to
the call to app.toolbox.tool_panel.items() in
templates/webapps/galaxy/workflow/editor.mako, as that returns the
raw
tool list, rather than one that's filtered on whether or not the
user
has access. I'm yet to figure out a clean fix for this.
Additionally,
empty sections are still shown even if there aren't tools listed in
them.
For a brief overview of my changes, please see the attached diff.
(It's
missing one change because I wasn't being careful and started work
on
multiple different features)
# Changeset overview
In brief, most of the changes consist of
- new method in model.User to check if an array of roles overlaps
at all
with a user's roles
- modifications to appropriate files for reading in the new
tool_config.xml's options
- modification to get_tool to pass user information, as whether or
not a
tool exists is now dependent on who is asking.
Please let me know if you have input on this before I create a pull
request on this feature.
# Fixes
I believe this will fix a number of previously brought up issues
(at
least to my understanding of the issues listed)
+
https://trello.com/c/Zo7FAXlM/286-24-add-ability-to-password-secure-tools
+ (I saw some solution where they were adding "_beta" to tool names
which gave permissions to developers somewhere, but cannot find
that now)
Cheers,
Eric Rasche
___________________________________________________________
Please keep all replies on the list by using "reply all"
in your mail client. To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
http://lists.bx.psu.edu/
To search Galaxy mailing lists use the unified search at:
http://galaxyproject.org/search/mailinglists/
