Using the Admin UI

The Ego administrative UI allows you to easily mangae your applications, users, groups, and policies all from a single web interface.

Logging In

To log into the Ego admin UI:

1. Go to <url>/ego-ui (where <url> is the base URL or domain where you have deployed Ego):

2. Select the identity provider that you wish to login with. The following example uses ORCiD:

3. Grant access to Ego to your profile on the identity provider. For example:

4. After granting access, if the email address on your identity provider profile is not configured to be publicly accessible, you may receive an error message indicating so:

If the identity provider you are using allows such a setting, you must change the email to be accessible. For instructions on how to do so, see here. However, if you do not wish to make your email accessible for that provider, your only alternative is to log in again with a different provider that does not have such a setting, or for which you do not mind exposing the email.

5. Once successfully logged in, you will see the list of users registered in Ego displayed by default:

Managing Applications

An application is a third party service that registers itself with EGO so that EGO can authorize users on its behalf. Upon registration, the service must provide secure credentials in the form of a Client ID and Client Secret pair that you have generated.

Creating an Application

To create a new application:

1. Click Applications from the lefthand menu, then click Create in the righthand panel.

2. The application fields appear in the righthand panel. Populate them as follows:

3. Click Save. The application is created and you can now assign groups and users to it.

Editing an Application

To edit an application:

1. Click Applications from the lefthand menu, then click the app you want to edit from the applications table.
2. The app's details pane is displayed on the right. Click Edit and modify the fields as required. The fields are the same as described earlier in Creating an Application.

Deleting an Application

To delete an application:

1. Click Applications from the lefthand menu, then click the app you want to delete from the applications table.

2. The app's details pane is displayed on the right. Click Delete. You will be asked to confirm the deletion.

Managing Policies

A policy is a scope or context for which an application may want to grant READ/WRITE/DENY permissions to a particular user or group. The permissions are:

• READ - Grants read-only access to a particular resource
• WRITE - Grants read & write access to a particular resource
• DENY - Denies access to a particular resource

Policies are flexible in configuration and it is up to the administrator to determine, based on their requirements, what permissions that policy should grant and to whom (users, groups).

Permission Inheritance

Before proceeding, it is important to understand how the permissions described earlier are inherited. First, here is the entity relationship diagram introduced earlier:

Observe that a user can have permissions assigned directly against their profile (their user ID), while simultaneously the group they belong to will have permissions assigned against that group. As such, the user inherits permissions that are directly against their profile and those from groups they belong to.

This raises a valuable question: What happens if a user has seemingly conflicting permissions assigned against their profile and against their group? For example:

• User ID abc123 is directly assigned permission SONG.WRITE
• Meanwhile, user abc123 also belongs to group TestGroup and TestGroup is assigned permission SONG.DENY

How do these resolve?

In the Ego permission inheritance scheme, only the permission level matters, not the source. That is, it doesn't matter whether the permission comes from the user profile or the group. What matters is the strictness of the actual permissions (READ/WRITE/DENY) assigned. In Ego, the least-permissive permission is the one that will resolve and be used. Thus, in our example above, it does not matter that user abc123 has SONG.WRITE, because TestGrouphas the more restrictive permission,SONG.DENY`.

It is important to note that the Ego API has two separate endpoints to retrieve user-level permissions:

• users/{id}/permissions - This returns permissions assigned directly to the user
• users/{id}/groups/permissions - This returns the ultimate resolved permissions that a user would have from direct permissions and group permissions

Creating a Policy

To create a new policy:

1. Click Policies from the lefthand menu, then click Create in the righthand panel.

2. The policy fields appear in the righthand panel. Populate them as follows:

3. Click Save. The policy is created and the users and groups you have assigned to it will be granted only the particular permissions that you have specified for them.

Editing a Policy

To edit a policy:

1. Click Policies from the lefthand menu, then click the policy you want to edit from the policies table.
2. The policy's details pane is displayed on the right. Click Edit and modify the fields as required. The fields are the same as described earlier in Creating a Policy.

Deleting a Policy

To delete a policy:

1. Click Policies from the lefthand menu, then click the policy you want to delete from the policies table.
2. The policy's details pane is displayed on the right. Click Delete. You will be asked to confirm the deletion.

Managing Groups

A groups define a set of users with similar properties. Admins can create new groups and add users to them. They can then assign permissions to an entire group which will be reflected for each user in that group. This greatly simplifies permission management for similar users, since the admin only needs to assign a permission to the entire group, instead of each individual user.

Creating a Group

To create a new group:

1. Click Groups from the lefthand menu, then click Create in the righthand panel.

2. The group fields appear in the righthand panel. Populate them as follows:

3. Click Save. The group is created and the users and groups you have assigned to it will be granted only the particular permissions that you have specified for them.

Editing a Group

1. Click Groups from the lefthand menu, then click the group you want to edit from the groups table.
2. The group's details pane is displayed on the right. Click Edit and modify the fields as required. The fields are the same as described earlier in Creating a Group.

Deleting a Group

To delete a group:

1. Click Groups from the lefthand menu, then click the group you want to delete from the groups table.
2. The group's details pane is displayed on the right. Click Delete. You will be asked to confirm the deletion.

Managing Users

A user is any individual registered in Ego who needs to authorize themselves with Ego-aware applications.

Editing a User

To edit an existing user:

1. Click Users from the lefthand menu, then click the user you want to edit from the user table.
2. The user's details pane is displayed on the right. Click Edit and modify the fields as required:

Disabling a User

To disable a user:

1. Click Users from the lefthand menu, then click the user you want to edit from the user table.
2. The user's details pane is displayed on the right. Click Disable. You will be asked to confirm the operation.
3. Alternatively, you can also Edit the user, change the Status to DISABLED, then click Save.