How roles work

Currently there are 3 roles in Adept: Explorer, Manager, and Admin.

All users need to be granted access to a dataset, except the users with Admin role.

Admin

A user with Admin role can access and manipulate all the datasets. Its main purpose is to be used in unusual circumstances (e.g. debug problems), and by default it shouldn't be active.

Explorer

A user that has the Explorer role for a specific dataset, can view the dataset but not manipulate it. Full list of permissions on table below.

Manager

A user that has the Manager role for a specific dataset, can control the dataset. Full list of permissions on table below.

Managers are also responsible for marking a dataset as Draft or Ready. When a dataset is Ready, users with Explorer role can see it too.

How to get access to a dataset

uni.lu

For our main instance, adept.lcsb.uni.lu, users need to request access to datasets through data catalog.

Why can't I access a dataset?

• Was access granted through data catalog?
• Did a Manager mark the dataset as ready?
• Are you logging in with the correct credentials?
• Did you try logging out and logging back in?

Roles table

Action	No Access	Explorer (per dataset)	Manager (per dataset)	Admin (all datasets)
Export	-
Read import	-
Add import	-	-
See import table actions	-	-
Add root collection	-	-
Delete root collection	-	-
Rename root collection	-	-
Add collection	-	-
Delete collection	-	-
Move collection	-	-
Rename collection	-	-
Add dataset	-	-
Delete dataset	-	-
Move dataset	-	-
Mark dataset as draft or ready	-	-
View dataset settings	-	-
Rename dataset	-	-
Rename dataset row description	-	-
Read filter	-
Save filter	-	-
Edit dashboard	-	-
Read dashboard	-

How to configure roles for a custom Adept instance?

This content is intended for a technical audience.

If you'd like to run a custom instance of Adept, the rules below must be followed. These rules are currently very dependent on the data catalog and

uni.lu

, but this will change in the future.

Admin

The OIDC provider (e.g. Keycloak) must send the adept_admin role in the roles for the client adept.lcsb.uni.lu. The JWT should look like:

  "resource_access": {
    "adept.lcsb.uni.lu": {
      "roles": [
        "adept_admin"
      ]
    }
  }

Explorer

In order to have access to a dataset, a user must have a role that starts with ${VITE_REALM_ROLE_PREFIX}${VITE_EXTERNAL_ID_PREFIX}, and it must be part of the realm roles. The JWT should look like:

 "realm_access": {
    "roles": [
      "ACCESS::EXT_ID-XXX"
    ]
  }

Manager

In order to be a manager of a dataset, a user must have a role that starts with ${VITE_MANAGER_ROLE_PREFIX} then ${VITE_EXTERNAL_ID_PREFIX}, and it must be part of the client roles. The JWT should look like:

"resource_access": {
  "adept.lcsb.uni.lu": {
    "roles": [
      "collection_manager_EXT_ID-XXX"
    ]
}

but because only the manager role is not enough, they also need the access role:

"resource_access": {
  "adept.lcsb.uni.lu": {
    "roles": [
      "collection_manager_EXT_ID-XXX"
    ]
}

...

"realm_access": {
  "roles": [
    "ACCESS::EXT_ID-XXX"
  ]
}