Databases – Permissions

In the Permissions tab, you can manage and assign access rights to users and groups in detail.

In the main window, you can see all users/groups authorized to access the corresponding database. Below, you can see the effective rights of individual users and groups. If you want to see the effective rights in detail, select the desired user or group from the list.

If you want to remove database access for individual users or groups, select the corresponding account and click Delete on the right. Users and groups that have been removed from a database cannot access it anymore; however, those users and groups are still available on the server. Click Select All to select all users/groups with access to the corresponding database. You can then perform further actions which will be applied to all highlighted user/group objects.

New

Select New to add new users/groups to the selected database. Choose a user/group from the list on the left. Finally, click OK to finish.

In the main view, double-click the user or group you just added to the database in order to perform detailed rights management. Alternatively, you can also select the user/group from the list and click Properties on the right. A new dialog window opens where you can set the permissions at database level as well as for individual folders and entries. Three tabs are available here:

  • General
  • Entries and folders
  • Sealed access

The permissions set in the General tab are applied to the entire database. Further permissions for individual entries and folders can be set in the tab of the same name. The Sealed access tab is used for changing the status of sealed entries. Detailed rights management as well as the process of sealing entries are explained more precisely below.

Properties

General

The permissions set in the General tab are applied to the entire database. You can see the selected user or group in the upper left corner. Below the user name, administrators can either limit the access of users and groups to a database or grant access without time limitation. If you want to enable limited access only, enter a start date in the Valid from box and define the end date in the Valid to box. If you want to allow unlimited access for the corresponding user/group, you can uncheck the boxes Valid from/to and define a start date only (by default, the date is set to the day you grant a user or group access to a database and set the permissions).

Permissions

Define the access rights at database level. These permissions are applied to the entire database. The following permissions are available:

  • Access to database
  • Read entries
  • Modify entries
  • Add entries
  • Delete entries
  • Use the function "Auto-Complete"
  • Auto-fill web forms using browser add-ons
  • Accept new entries from browser add-ons
  • Print entries
  • Export entries
  • Save local copy
  • Synchronize database
  • Share entries
  • Seal entries
  • Set second password

HINT: If you click View effective rights, you can see a user's or group's effective rights in a separate window more precisely.

NOTE: Enabled permissions in the General tab are global rights applied to the entire database. If you enable users/groups to Read/Modify/Add/Delete entries at database level, they can see and edit all entries within the corresponding database by default. If you want users/groups to only access specific folders and/or entries within the database, you should not enable the rights Read/Modify/Add/Delete at database level and thus remove the Allow tick accordingly. Attention: Only remove the tick but do not disable those rights! In the Permissions for Users chapter, you can learn more about correct rights management and how to ensure that unauthorized users do not see entries they are not allowed to.

Entries and folders

In the Entries and folders tab, you can assign users and groups access rights on individual folders and/or entries within a database. This way, administrators can define the user and group access rights in a way that each user/group can only see those objects they should actually be allowed to access.

The Entries and folders tab includes the following permissions:

  • Access to entries
  • Read entries
  • Modify entries
  • Add entries
  • Delete entries
  • Share entries
  • Seal entries
  • Set second password

Select individual entries or folders on the left and assign rights in the Permissions area afterwards.

HINT: If you click View effective rights, you can see a user's or group's effective rights for individual entries and folders in a separate window more precisely.

NOTE: Both the General and Entries and Folders tabs include special formatting to make rights management easier. By default, all permissions are depicted in green and bold letters. This means that these permissions are granted to users. On the other hand, denied permissions are depicted in red and bold letters. This way, the administrator can recognize from the start which permissions have been enabled or denied for individual users and groups.

Grant access to other users

This permission can be enabled either for the entire database or for individual entries and folders within a database only. If the server administrator enables the permission to grant access to entries and folders to other users, a user can share data with other Enterprise Server users in the client or with anyone who received a link using the HTTPS protocol. In this case, the administrator does not need to change the access rights in the Server Manager. For example, this is useful if a user wants to share data with another user temporarily.

Further information can be found under Shared Secrets.

Users can grant access to other users in the client only. The exact procedure is described in our Windows client manual.

Seal Entries

If a user has been granted access to an entry, the entry can additionally be sealed. In this case, accessing the entry will only be possible if the access has been approved or the seal removed by an authorized person in the Server Manager.

Sealed access to an entry is also set in the client. This feature is available when granting access to an entry to another user. The issuer who would like to share an entry can decide whether it should additionally be sealed or not.

The process of sealing entries is also described in detail in our Windows client manual.

Sealed access

If access to an entry in the database has been granted by user A to user B and the entry has been sealed by user A, it is first necessary that a user with sufficient rights on the Enterprise Server allows access to the selected entry so that access can be granted. The user who grants access determines which user on the server is required to approve the request.

To do this, the corresponding user logs on to the Enterprise Server with their access data. In the Databases → Permissions area, you can now see that user B has been granted access to an entry in the selected database. This shows the defined period of access, who created the access, and whether the entry has been sealed. The permissions can be opened with a double-click. Approval is granted in the Sealed access tab.

Here you can see the state of the entry, which may be set to Sealed, for example, provided the entry has been sealed. The corresponding state can be changed by clicking the Change seal status button. You can choose from the following states:

  • Sealed: An entry is still sealed and no attempt has been made to access the corresponding entry.
  • Unsealed: The seal has been removed.
  • Waiting for approval: The user who has been granted access is specifically asking for access permission. In this case, the user would like to open the corresponding entry and asks for permission to do so.
  • Approval granted: An authorized person has granted permission for accessing the entry accordingly.
  • Broken: A seal has been broken and thus an entry has been accessed.

After changing the seal state, the new state is displayed in the database permissions. If permission has been granted, the user who was granted access can now open the entry and break the seal.

Authorized persons can change an entry's seal state at any time. Server administrators can also add other authorized persons to change the seal state. This is done in the Sealed Access tab by clicking the Add... button.

EXAMPLE: User A grants user B access to an entry for 2 weeks in total and seals this entry. If the approval is granted, user B can break the seal and access the entry. If necessary, a server administrator can change the seal state again; for example, the admin can reseal the entry so that user B must ask for approval again if they want to access the entry.

HINT: For more information about this feature, feel free to visit our support portal: How to grant access to other users and seal entries in Password Depot.