| Info |
|---|
Not familiar with Synapse teams? First, learn all about them here /wiki/spaces/DOCS/pages/1985446029. |
For complex Synapse projects, administrators manage a wide variety of data that requires different permissions for different user groups. In this scenario, creating a system for managing data access with Synapse teams is recommended. This method allows you to group users together according to the level of access they require and then assign permissions to the entire team rather than to many individuals.
...
Who needs to be able to view this project?
Who needs to be able to edit or add content to this project?
Who should be in charge of changing permissions to modify user access?
Does any content in this project need different permissions than the whole project? For example:
Raw data vs. processed data folders shared with specific groups
Internal meeting notes in a private folder vs. methodology and SOP documents shared publicly
Using Teams for Permissions
Teams are groups of Synapse users; learn more about /wiki/spaces/DOCS/pages/1985446029. If you are working with many Synapse users on a project, and you want to allow some users to view or download data, and other users to add new data, you should consider using teams to manage your project permissions.
...
This approach is especially useful if you have more than one project that the same group of people will be working on. Using teams for permissions can also help prevent administrative errors like forgetting to remove someone from a project if they leave your collaboration.
Recommended Team Types
For many collaborations, a small group of users administers the project, a larger group contributes data, and an even larger group downloads that data for their independent research. In these cases, we recommend creating groups for each of these permission types: an administrative team with “administer” permissions, a data curation or content creation team with “can edit” permissions, and a downloading team with “can view/download” permissions.
Because permissions are additive, a user who is in all three teams has the permissions of the highest level granted. In other words, if you add a single user to three different teams, “administer”, “can edit”, and “download”, the user will have “administer” permissions. If you remove that user from the “administer” team, they will have “can edit” permissions.
Local Sharing Settings
Sometimes, users wish to create private spaces for certain groups within larger, public projects. This is possible using local sharing settings to restrict content to specific teams.
...
Next, navigate to the new Folder, and click on Folder Tools. Select Folder Sharing Settings, then click Create Local Sharing Settings. Click on the Make Private button and confirm that fields for All registered Synapse users and Anyone on the web have been removed. Save your changes.
The folder with can then be shared only with the specific teams that the entire project is shared with, and not the general public. Removing local sharing settings on an item will assign default permissions from the parent folder or project.
Triaging Sharing Settings with Views
Creating local sharing settings for many folders, sub-folders, or other items in Synapse can become complex to manage as a project grows. You or another administrator may alter local sharing settings unintentionally, or you may want to audit your sharing settings periodically. One way to manage these settings is by /wiki/spaces/DOCS/pages/2011070739 to see sharing settings at a glance.
...
For more information on how to use SQL-like queries in Synapse, see the Searching Tables and Views page. Include Page