Portal Access Control¶

Each portal decides who can view it, who can edit it and who can manage it. This lets you show the finance dashboard only to the finance team and the operations dashboard only to operations, while keeping editing to the people who build them.

Access is set per user or per role on the portal, and it works together with the role's workspace-wide Portals permission. This page explains how the two combine and what people with limited access see.

The four access levels¶

How access is decided¶

For each user, the portal checks these in order and uses the first one it finds:

1. A setting for that user on the portal.
2. Otherwise, a setting for the user's role on the portal.
3. Otherwise, if the portal has Inherit access from workspace turned on, the role's Portals permission.
4. Otherwise, no access.

A portal's own settings work within the role's Portals permission, never around it. A user whose role has No Access on Portals can't open the Portals app at all, whatever an individual portal says. For everyone else, the portal's settings can raise or lower their access between Read, Write and Full Access.

Only members of the portal's workspace can open it. A setting on a portal never lets in someone from outside the workspace, not even through the published link.

Setting up access¶

1. Open the Portals app and select a portal in the list.
2. Click Manage access. It is also in the right-click menu. This needs Full Access to the portal.
3. Under Users, click Add User Access Level. Under Roles, click Add Role Access Level. Set an access level for each entry.
4. To limit the portal to only the users and roles listed, turn Inherit access from workspace off.
5. Click Save.

The same dialog opens from the portal designer: Manage Access in the ribbon's Danger Zone group, next to Delete Portal. Both buttons are disabled without Full Access.

What a new portal starts with¶

A new portal starts with the same access as a new report:

• Inherit access from workspace is on, so everyone gets their role's Portals permission.
• The user who created it has Full Access.

Duplicated and imported portals start the same way. The user who duplicated or imported them is the one with Full Access.

What a user with limited access sees¶

Toolbar buttons a user isn't allowed to use stay visible but disabled, with the tooltip You don't have permission to perform this action. A row's right-click menu is shorter instead: it lists only the actions the user can take on that portal.

• In the Portals list, the toolbar's Add new portal, Edit, Duplicate, Delete and Manage access are disabled where the user lacks the access. A user who can neither create portals nor edit any listed portal sees a Read-only access badge next to the heading.
• For a portal they can only read, its name, a double-click and the right-click Preview all open the preview in a new tab. The right-click menu has no Duplicate, Manage access or Delete. Opening the designer's address directly redirects to the preview.
• With no Portals permission at all, the app shows You don't have permission to view this page with a Go to Portals button. Ask a workspace administrator for access, then reload the page.

Designs and themes¶

Designs and themes are shared by many portals, so they are not controlled per portal. Access to them comes from the role's Portal Designs and Portal Themes permissions, which are either Read or Full Access. Creating a portal needs at least Read on Portal Designs, because every portal is built on a design.

With Read only, the Designs and Themes lists show a Read-only access badge, and their add, edit, duplicate and delete buttons are disabled. The user can still open a design or theme to look at it. The editor then shows Read-only access. You can view this design, but you can't change it. (or …this theme…), and nothing they change is saved. With No Access, the Designs or Themes entry is hidden from the navigation.

The parts of a page that belong to its design, such as headers, footers and navigation, follow the Portal Designs permission, not the portal's own access settings.

Good to know¶

• Viewing a portal does not need the Global Data Sources permission. Neither does setting up a page's own data sources. Viewing them needs Read on the portal, and changing them needs Write.
• Data read from an external database still needs access to that database connection, just as it does for reports.