Triaster Server 2011 - Folder and File Permissions

Default Permissions

When installed, the permissions on the Triaster Server folders and files would typically be as follows:

Modifying Permissions

Security could be tightened by removing the permissions for the generic 'Users' and 'Authenticated Users' groups, and perhaps replacing them with permissions for more specific groups. It should be emphasised that permissions for administrative groups and SYSTEM should be retained. Permissions then need to be added for particular accounts so that:

• The websites continue to work.
• Process mappers retain access to their files.
• A Library Administrator can manage the library.

Permissions will be in the context of a particular role, so a full set of permissions would need consideration of each of these.

Web Server Role

These will be the permissions needed for the websites to run properly.

Anonymous Authentication

If Anonymous authentication is enabled, Authenticated User/Group would normally be IUSR (in IIS 7.x) or a group that contained that user.

Windows or Basic Authentication

If Windows or Basic authentication is enabled, Authenticated User/Group would correspond to a user or a group representing those who would use the process library websites.

Permissions

In addition to those described above, permissions are required for the user account under which the Triaster web applications' application pool runs. This would usually be NETWORK SERVICE, but could be another account, such as an application pool's ApplicationPoolIdentity account.

File Server Role

This relates to the process map Visio files.

It will probably be a decision for the Library Administrator as to who should have access to what. Files editable by process mappers would be in the 'Site Maps' and 'Menu Pages' folders. The 'Stencil, Template and Properties' folder may contain shared copies of the Visio template and stencil to which mappers would need at least read access. A shared Properties XML file may reside here, but may be elsewhere (in the 'ProcessLibraries' folder).

As an example, let's say that those who create and edit process maps are members of a 'Triaster Authors' security group. They will need to be able to create and edit maps in the Sandpit, and use the Visio template and stencil (and possibly a Properties XML file) in the 'Stencil, Template and Properties' folder. They could read content from elsewhere, but not change it. Library Administrators are members of a 'Triaster Library Administrators' security group, and will need read and write access to the whole of the map store.

Library Administration

This would be a typical set of permissions that would allow a Library Administrator to manage a process library, whether to make modifications directly, or to retrieve copies of files that may be requested by Triaster Support.

Again, a 'Triaster Library Administrators' group is used for illustration.