UserService permission levels

By design, the UserService component enjoys a special permission level scheme—one that varies from the scheme described for other component access.

By default, these user properties appear as slots in the UserService:

  • Email

  • Password

  • Cell Phone Number

  • Facets (time format and unit conversion)

The Operator config flag for these slots may be enabled (checked) and disabled (unchecked) just as you would configure the permission level on any other slot. The special scheme that applies only to the UserService component yields the following results:

  • If the operator permission level is enabled (Operator checked) on the slot, and the role assigned to the user grants read permission (r), the user is allowed read-only access to the user properties (email, password, etc.) on their own user account (all other users are hidden).

  • If the operator permission level is enabled (Operator checked) on the slot, and the role assigned to the user grants write permissions (rw), the user is allowed both read and write access to the user properties on their own user account (all other users are hidden). This is the configuration required to allow a user to change their own password.

  • If the admin permission level is enabled (Operator unchecked) on the slot, and the role assigned to a user grants read permission (rR), the user is allowed read-only access to all user properties for all available users.

  • If the admin permission level is enabled (Operator unchecked) on the slot, and the role assigned to a user grants write permissions (rwRW), the user is allowed both read and write access to all properties for all available non-super users. Moreover, they have access to the User Manager, and can add new users and delete selected users. In addition, the Permissions Browser view of the UserService is available to them.

Note: A user cannot assign permissions to other users that they do not have themselves. For example, a non-super user cannot make another user a super user.

To allow each user to change their own password, but not have access to other users’ passwords, you would set the config flag for the Authenticator slot to the operator permission level (checked; this is the default for this slot), and assign a role to the user that grants operator-level write (rw) permissions.

All non-super user roles should be configured for operator-level write (rw) permissions applied to the category that contains the UserService. (By default, the New Station Wizard assigns the UserService to the Admin named category (category 2), along with the CategoryService.)

Note: Any user granted super user permissions has access to all components, and can add more super users.