ACL use cases

This chapter presents some real-life use cases of the ACL feature. At the bottom of the page, you can find a more complete glossary.

For a deeper understanding on how Security Policy work you might also refer to the corresponding section of our administration guide.

IP Restrictions

Deny Access on a workspace to a list of IP

This is an example on how to deny access to a given workspace for a list of specific IPs.
You can also apply this rule to Cells, Share links and so on.

• Create a New Policy (Policy Type: Context-based ACLs. Put the Name and Description of your choice)

• Then define default permissions: they are mandatory otherwise other users will not have access. So we give read/write to everyone before adding a restriction based on IPs for specific requests.

• Now, let's add a policy to define the IP restriction rule:

• Give it a Label, Effect: Deny, Actions: Read/Write, as seen in screenshot 5:

• Add a condition and choose RemoteAddress:

• Write the condition, using JSON: in our example we explicitly define some IPs.

• Save

• We can now apply the newly created rule. In our example, we apply it on a group. But you can also choose user, group, role, etc.

• Select the rule, using the label you have defined earlier

• Once the rule is selected, save the changes:

Allow access for a specific IP range

You could also do the opposite and only give access to a list of IP by using StringNotMatchCondition.

IMPORTANT: Security policies, as provided by Pydio Cells, are both "Deny By Default" and "First Deny Wins". It means that, when no policy is defined, the resources are not available. It also means that if we have 2 rules that are applied to the same resource for the same subject, if one gives access and the other forbids it, the resource is not available.

Thus to allow access, you only have to define one rule that explicitely gives the access for the required IP range:

• Create a New Policy (Policy Type: Context-based ACLs)
• Create a rule that allows access to specific IP addresses or a range.

Corresponding JSON can then be something like:

{
  "type": "StringMatchCondition",
  "options": {
    "matches": "192.168.2.*"
  }
}

Note that you can also add multiple string conditions by separating them with a pipe | character. For instance:

192.168.0.*|192.168.3.2|...

ACLs values

Actions

Query Context

Conditions

Note: under the hood, Cells uses we internally use LADON, you might find it useful to refer to their documentation, typically on conditions to gain a deeper understanding of what you can do and how.