Changes between Version 5 and Version 6 of MultiUser

Timestamp:

Sep 20, 2011, 11:17:20 AM (13 years ago)

Author:

davea

Comment:

--

MultiUser

@@ +1 @@
+[[PageOutline]]
+
 = Multi-user projects =
 
 This document describes a set of BOINC server features
-that support projects with multiple users (i.e., job submitters).
+that support projects with multiple job submitters, or '''users'''.
 A user may represent a single scientist, a research group, or some other organizational entity,
 An example of a multi-user project is a science portal such as NanoHUB.org.
 
-Such projects are typically structured so that users interact with the project through a web-based interface,
-possibly served on a computer other than the BOINC server.
-The BOINC server is accessible only to '''administrators'''.
+Such projects are typically structured so that users
+interact with the project through a web-based interface,
+and only project admins have login access to the BOINC server.
 
 BOINC's design supports the following goals:
@@ -14 +16 @@
  * The set of users may be large (1000s) and dynamic.
  * The project's resources are shared fairly among users, based on quotas.
- * Users have privacy: a user cannot see the computational results of other users.
- * The access rights of a user (e.g., the applications to which they can submit jobs)
-   can be limited by project administrators.
+ * Privacy: users cannot in general see the computational results of other users.
+ * Flexible access control.
 
 == User identity ==
 
 Users are identified by BOINC project accounts (same as volunteers).
-Users can supply computing resources to the project,
-and this may affect their quota (see below).
+Users may also be volunteers; i.e. they may supply computing resources to the project.
+(this may affect their quota; see below).
 
 == Access control ==
 
-To submit jobs, users must be given access by administrators.
-This can done via the '''User job submission permissions''' link in the project admin web interface.
-Users may be given permission to submit jobs only to specific applications,
-or to submit jobs to any current or future applications.
+The following operations are subject to access control:
 
-In the future, we may provide mechanisms by which users can create applications,
-and the access control system would be extended to control this capability.
+ * Submitting jobs
+ * Creating and deprecating apps
+ * Creating and deprecating app versions
+ * Aborting jobs (possibly those submitted by other users)
+ * Changing access rights
+
+For each user, the BOINC access control system defines a set
+of '''global privileges''' and optionally a set of '''per-app privileges'''
+for each app.
+
+The global privileges include
+
+ * '''submit_all_apps'''.
+  If this flag is set, the user can submit jobs to any application,
+  included those added in the future.
+ * '''admin_all_apps'''.
+  If this flag is set, the user
+  * has admin privileges for all apps (see below)
+  * can grant and revoke the privileges of any user
+  * can create and deprecate apps
+  * set user quotas (see below)
+
+The per-app privileges include
+ * the ability to submit jobs to the app
+ * '''admin''': if this flag is set, the user can
+  * create and deprecate versions of the app
+  * grant and revoke per-app permissions for this app
+  * abort any job of this app
+  * view the output files of any job of this app
+
+Users can be given '''admin_all_apps''' permission via the
+'''User access control''' link in the project admin web interface.
+All other access control is done via the submit_permissions.php page
+on the main web site.
 
 == User quotas ==
@@ -52 +82 @@
    e.g. by participating in the message boards.
 
-Quotas are set by administrators, via the admin web interface or other mechanism.
+Quotas can be manually set by users with the '''admin_all_apps''' privilege,
+via a web interface.
 
 == Implementation notes ==
@@ -58 +89 @@
 Two new DB tables support the multi-user features
 
- * '''user_submit''': access control and quota info for a user
+ * '''user_submit''': per-user access control and quota info
  * '''user_submit_app''':  per (user, app) access control info.