Project Portal security controls access to workspaces, folders, documents, and other data objects stored in Project Portal . Project Portal security is based on multiple elements, depending on the type of access that is requested:
The Project Portal security process is illustrated in the following figure and described below.
Users are first authenticated by a user name and a password. Project Portal provides an internal user database that can be used for authentication but can also be connected to an Active Directory user database with the Project Portal Active Directory Connector as described in the BlueCielo Project Portal Administrator's Guide. Upon logon, the user's account type is evaluated, which determines their access rights in the current workspace. For more information about user account types, see Understanding user account types.
After a user has been granted access to a workspace, the system verifies that the user is not trying to change an object that is locked by another user or an item that is in a frozen status. If the object is not locked or frozen or the user is not trying to change an object, the system checks the user's assigned access role rights, if any, and the access profile of the object.
Access profiles contain authorization information for three different user types: owners, access group members, and guests. Owner access rights apply to the user if they are the owner (creator) of the folder or document. Access group rights apply if the user is a member of a group that has access rights to the folder or document. Guest rights apply to all workspace users, including guests.
Owner, access group, and guest access rights may all apply to the same user, for example, a user who is the owner of a folder belongs to a group that has access rights to the folder, and access rights are also specified for all workspace users.
If the user is validated by the object's access profile, they are granted access. If not, they are denied access.