Skip to main content

Role Configuration

Archive-specific Roles​

These roles are limited to a specific archive and provide tiered access to the archive's content.

Available Roles​

There are four levels of access rights, with increasing permissions:

  • reader Can read content but cannot make changes.
  • editor Can read and edit content but cannot perform administrative tasks.
  • admin Can read, edit, and perform administrative tasks.
  • siteadmin Can read, edit, and perform both administrative and system-wide tasks.

Roles follow a hierarchical structure, where each higher role inherits the permissions of the roles below it. This means that a user with the admin role also has the permissions of an editor and reader.

Assigning Roles to Users​

Roles are assigned to users in Keycloak.

The following naming scheme must be followed:

{archive_id}-{client_id}-{role_name}

For example, for the archive with the ID myArchive and the client context, the admin role would be named as follows:

myArchive-context-admin

Note the case sensitivity - the role name must be specified in lowercase.

Global Roles​

Global roles provide access to system-wide administrative functions that are not limited to a specific archive.

There are no general access levels, but a separate role for each administrative function.

Available Roles​

The following global roles are currently available:

  • @archive:findAll Access to the list of all archives.
  • @archive:copyArchive Permission to copy an archive.
  • @system-config:getConfig Read access to the system configuration.
  • @system-config:applyConfig Write access to the system configuration.
  • @system:releaseInformation Read release information (version, branch, date).
  • @system:about Read system information.
  • @system:sbomFile Download SBOM file.
  • @logs:getLogLevel Read application log level.
  • @logs:setLogLevel Override application log level.
  • @logs:download Download log files.

Assigning Roles to Users​

Global roles are also assigned in Keycloak, with neither client nor archive included in the role name.

The role name corresponds to the name of the role, e.g., @archive:findAll.

The role required for an endpoint is specified in the Swagger documentation under Responses -> 401.