Restricting access to the omero

[atarkowska]

Would be very useful if server allows to prevent a specific user from creating/editing or deleting data. Some institutions would like to allow an external collaborator to access data in Omero, but prevent that collaborator from making changes, or from uploading additional content.

[jamoore]

See ​http://lists.openmicroscopy.org.uk/pipermail/ome-users/2013-November/004048.html

[atarkowska]

It seems that we could handle that on the server side by adding new role "spectators" and limit API to read-only methods.

[wmoore]

Summary of devteam conversation with Ian Munro:

Ian
I've been asked to clarify whether the ability to give public access to say some of the files in a dataset 
(without moving to a public group) is in the pipeline

Will Moore
If you restrict access to the webclient, and you're prepared to write your own access control there
… you can do a fair bit but not everything

Simon
ian: https://trac.openmicroscopy.org.uk/ome/ticket/11653

Will Moore
Currently the web has a "public user"
so can access everything that this user can access - but has the option to restrict access based on other criteria
E.g. you can filter by url regex currently but you could choose a different criteria

Ian
Don't suppose we could filter by tag ?

Will Moore
I think you could
I can see this working ok for making the imageviewer only available for images with a particular tag
but configuring the webclient UI to show a restricted set of data is much harder

Ian
Will: Ok thanks for the help I'll pass that  along.