Skip to main content

Folder Permissions

Applications, toolsets, prompts and files that are shared with the whole organization are stored in the Public folder of DIAL file storage. It is organized as a tree of folders. A user can see and use a published item only if the access rules of its folder, and of every parent folder up to the root, allow it.

The Folder Permissions screen is where you set those rules. This screen manages access rules only:

  • It shows the folders that exist in the Public folder. It doesn't create, rename, move, export or delete folders.
  • You select a folder and edit the rules that apply to it. Parent folders' rules are shown read-only.
  • The root folder has predefined rules that give access to all authorized users. You can't change them.

Folders appear in the tree when they are created on the Applications and Toolsets screens, or when users publish into a new folder and an administrator approves the request. Rules can also come from a publication request: when the request is approved, the rules it carries are stored for the target folder, and you can edit them here afterwards.

DIAL Core checks the rules on every request, using the claims of the user's identity token, so a saved change applies to the next request. Administrators, as defined by the access.admin.rules setting of DIAL Core, can access all public resources regardless of folder rules.

Note

Refer to Access Control to learn more about Private and Public logical spaces for object storage in DIAL.

Folder structure​

The left panel shows the Public folder as a tree. Click a folder to select it and display its rules. Use Collapse all folders (above the tree) to collapse the whole tree.

  • Root folder: visible to all authorized users. Objects published without a target sub-folder are placed in the root by default.
  • Sub-folders: use them for logical organization. One object per sub-folder is recommended. Folders support a maximum nesting depth of 4 levels (excluding the root folder), and folder names must not exceed 160 characters. Both limits apply where folders are created.

The effective authorization rule for any object in a sub-folder includes restrictions from all parent folders up to the root. Refer to Work with publications to learn about effective rules for folders.

Folder Permissions screen with the folder tree and the rules of the selected folder

Note

Folder actions (Add sibling, Add child, Move to, Export, Rename, Delete) are not available on this screen. Use the folder actions on the Applications and Toolsets screens.

Access rules​

Click any sub-folder to display its access rules. Changes are not applied until you click Save. Discard reverts them. Save is disabled while any rule is missing an attribute, an operation or a value.

Folders Storage access rules panel

Access rules are evaluated by matching the claims of the user's identity token, issued by the identity provider (IDP), with the defined rules. Each rule is built from three parameters:

ParameterDescription
AttributeThe claim of the user's token that the rule checks (e.g. role). The dropdown lists the attributes set in the PUBLICATION_FILTERS setting of DIAL Admin (default: title, role, dial_roles).
OperationThe matching function: Equal, Contains or RegEx.
ValueWhat to match against. For Equal and Contains, enter one or more values (e.g. admin). For RegEx, enter a single regular expression. Changing the operation clears the value.

How each operation matches (source: DIAL Core RuleMatcher):

  • Equal: the claim equals one of the values. The comparison ignores case.
  • Contains: the claim contains one of the values as a substring. The comparison ignores case.
  • RegEx: the whole claim matches the expression.

If the claim has several values (for example, a list of roles), the rule matches when any of them matches any of the rule's values.

Access rule configuration showing attribute, value, and operation fields

How rules combine​

The panel shows the folder's rules together with the rules of its parents:

  • Across levels (And): the panel shows one block for each folder in the path, from the root down to the selected folder, joined by And. A user gets access only if every level allows it. The blocks of parent folders are read-only.
  • Within a folder (Or): the rules of one folder are joined by Or. The user gets access if at least one rule matches. Use Add to append a rule.
  • No rules: a folder with no rules of its own doesn't restrict access beyond its parents.

Note

If a folder has a parent folder, all access rules of the parent also apply to the child. Refer to Work with publications to learn about effective rules.

Nested And/Or access rule blocks

Note

Refer to JWT and API Keys for how to enable access to DIAL resources. Refer to Configure IDPs for supported identity service provider configurations.

Further reading​