# Groups and roles

To understand the security context of MOLGENIS you need to understand the following concepts.

*   **Group**

    A number of people that work together.
*   **User**

    A person that can login to MOLGENIS.
*   **Roles**

    A role is a job function within the context of a group with certain permissions on resources. Examples of roles are:

    * Managers
    * Editors
    * Viewers
*   **Resource**

    Resources can be tables or folders.
*   **Plugin**

    Plugins are specific modules within MOLGENIS that offer certain functionality. For example the [Data Explorer](../find-view-query/guide-explore).

## Overview

You can start performing these steps to configure groups in MOLGENIS.

*   **Step 1: Add a group**

    When you create a new root package, e.g. using the importer, a group will automatically be created for the package. You can manually add groups to MOLGENIS to structure user groups and data you want to share or manage. Every group gets a root package to put resources in.
*   **Step 2: Add members**

    When you have defined your group, you can add members to the group. Admins can also add new users, for more information see the [user management guide](guide-users).
*   **Step 3: Add members to groups**

    You can now determine who does what in your group. There are standard roles that you can use to enable members to edit, view or manage your group content. The available roles are:

    *   **Manager**

        Can manage members from a group and all resources in a group (tables, scripts and files)
    *   **Editor**

        Can edit all resources in a group (folders, tables)
    *   **Viewer**

        Can view all resources in a group (folders, tables)

When you have setup this basic configuration you can start using MOLGENIS.

## Adding groups

_note: you need to be superuser to add groups_

You can add groups in MOLGENIS by navigating to **Admin --> Security Manager**.

![Security Manager menu](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eA1L-N3C35-TK8O%2Fmain_menu_security.png?generation=1582898529897514\&alt=media)

Click on the **Add group**-button.

![Groups screen](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eA5jpcJzHcbDHFi%2Fgroup_overview_no_groups.png?generation=1582898529715692\&alt=media)

Fill out the necessary field and click on **Create**.

![Create a group](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2Fsync%2Fd5b2c09998e0d48c2c7ff48e7687ab2df5324c21.png?generation=1590565332549454\&alt=media)

When you've added the group a folder is created and the default roles are created for that group. The user who creates the group becomes manager of the group.

## Deleting groups

You can delete a group by clicking it on the detail screen to see the details, and than use the delete button (recycle bin icon) to delete the group. When deleting a group the package, groups specific roles and group memberships are deleted as well.

## Adding members to a group

_note: you need to be superuser or group manager to add members to a group_

You can add members to groups via the security manager. Navigate to **Admin --> Security Manager**. Click on a group

![Group overview](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eA9gNFpOnC8Nv7t%2Fgroup_overview.png?generation=1582898530133979\&alt=media)

Click on **Add member**.

![Membership overview](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eAB7n3fVKsH9fd8%2Fmembership_overview_only_admin.png?generation=1582898530603791\&alt=media)

Select a member from the **User-pulldown** and specify the **role**, for example: Editor. Click on **Add member**.

![Add membership](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eADtagj8y96Npu-%2Fadd_membership.png?generation=1582898530141138\&alt=media)

When a member is added to a group, permissions are set according to the role he/she has been given. The default permissions for these roles are as follows:

**Manager**:

* You can manage the memberships in the group
* You get access to the following plugins:
  * Import Data
    * Advanced importer
    * One click importer
  * Navigator
  * Data Explorer
  * Plugins
    * Search all
    * Job overview

**Editor**:

* You can edit data in the group
* You get access to the following plugins:
  * Import Data
    * Advanced importer
  * Navigator
  * Data Explorer
  * Plugins
    * Search all
    * Job overview
    * Questionnaires

**Viewer**:

* You can view data in the group
* You get access to the following plugins:
  * Navigator
  * Data Explorer
  * Plugins
    * Search all

![Membership overview](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eAHCiMO3w_hnLd6%2Fmembership_overview.png?generation=1582898529654943\&alt=media)

You can switch between roles whenever you want by updating the role of the member. Click on a member ("test" in this example).

![Update membership](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eALNTcxLrWBVjeE%2Fupdate_membership.png?generation=1582898529982941\&alt=media)

Click on "Edit" to update the role and click on "Update role".

![Update role membership](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eAORcOIIE-BcAy4%2Fupdate_membershiprole.png?generation=1582898530449419\&alt=media)

You can now view the members of the group and see that the "test" member has a Manager-role.

![Membership overview with role change](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eAQvDogIhdgHXmJ%2Fmembership_overview_with_rolechange.png?generation=1582898529538033\&alt=media)

You can also remove a member from a group. Click on a member ("test" in this example) and click on "Remove from group".

![Remove member from group](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eATQnLwXLeUZosZ%2Fremove_member_from_group.png?generation=1582898530212319\&alt=media)

## Roles and inclusion

MOLGENIS comes with three default roles out of the box: Manager, Editor and Viewer. When you add a Group, the three group roles that are added actually include (or inherit) these default roles. That's how you get all those permissions on plugins listed above automatically.

The default roles include each other as well. The Editor can see and do everything a Viewer can, and some more. The Manager can see and do everything the Editor can, and some more. System admins can change the permissions of these roles, so that certain plugins and functionality can be turned on or off across the system for all groups. Some examples: 1. As the admin, you don't want any user to use the Search All plugin. You achieve this by removing the Search All plugin permission from the `VIEWER` role. 2. As the admin, you only want Managers and Editors to use the Navigator. You achieve this by removing the Navigator plugin permission from the `VIEWER` role, and giving the `EDITOR` role `VIEW` permission to the Navigator plugin.

_For more information on how to give permissions to roles, read up on the_ [_Permission Manager_](guide-permissions)

The group roles include each other as well, in the same manner as the default roles. Your group's Manager can see and do everything your group's Editor can, etc. See the following schematic for an overview of how all the roles connect for a group that has been aptly named 'test':

![Role inclusions](https://4089188444-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LLUgz0ctDlFMwo2_rIW%2F-M1B5_MLXyQMGRYDh-v-%2F-M1B5eAVAefXjL7s4O01%2Frole_model.png?generation=1582898530316177\&alt=media)

The group roles do not contain any permissions when you first create them; they only include the default roles. However, just like with any other role, you can still add permissions to them. This setup gives you fine grained control, especially when your MOLGENIS hosts multiple groups. Some examples:

1.  You want all the users in your group to see a special plugin that's not relevant for other groups. You achieve this by

    giving the `TEST_VIEWER` role `VIEW` permission on that plugin.
2.  You don't want all Editors in the system to see the Job Overview plugin. You achieve this by removing that plugin permission&#x20;

    from the default Editor role and adding it to your group's Editor role. Now both the Editors and Managers in your group can use it,&#x20;

    but from now on any new group that's added won't have these permission by default.

Even though you'll find that the default settings are sufficient most of the time, you have complete control over all the roles and permissions in the system if you ever wish to change something.
