Skip to content

Users and permissions

Overview

WCS has two active users out of the box: admin and demo. By default, all active WCS users have permissions to do anything for testing purposes. The admin user may also:

  • activate/deactivate the license key
  • update SSL certificates
  • add, remove, update other users

The demo user is also a special one: the demo examples may be opened by direct links when the demo user is active.

It's strongly recommended to enable REST API authorization in production use

disable_rest_auth=false

and deactivate demo user with CLI

update user -a false demo

or with /rest-api/v3/user/update REST API query

User permissions management

Since build 5.3.460, user permissions may be set up to limit a potentially dangerous REST API queries using authorities list.

The following authorities are available:

  • CERTIFICATE - the user has permissions to update SSL certificates with /rest-api/v3/certificate REST API
  • FILE_SYSTEM - the user has permissions to file system operations (read/write/create/delete files and directories) with /rest-api/v3/file-system-controller REST API
  • PROCESS_CONTROL - the user has permissions to restart or shutdown WCS with /rest-api/v3/process REST API
  • SETTINGS - the user has permissions to view the actual WCS settings with /rest-api/v3/settings REST API
  • SETTINGS_UPDATE - the user has permissions to update WCS settings with /rest-api/v3/settings/update REST API (the user should also have SETTINGS permissions too)
  • USER - the user has permissions to manage other users with /rest-api/v3/user REST API

The authorities may be set to the user when creating or updating it using CLI

update user --authorities SETTINGS,SETTINGS_UPDATE alice

or REST API

POST /rest-api/v3/user/update HTTP/1.1
Host: localhost:8081
Content-Type: application/json

{
    "username": "alice",
    "authorities": [
        "SETTINGS", "SETTINGS_UPDATE"
    ]
}

Attention

The system user admin permissions cannot be changed