EpiData User and Group

Administration.
A new model

With EpiData Manager and EntryClient 4.0 (2.1 during development) we will introduce a new optional
security model for projects, to embrace the need for multiple user colaborating on projects, but where a
finer control of data access is required.

The programs introduces two new concepts - Users and Groups. These are the two essential concepts
needed for a fine grained access control.

The user is the personal access to a project and contains simple information, such as a name, login,
password, pw. expiration date, etc.

The group is the logical container for rights, both in regards to project managment but also for allowing
data access. It contains the information for the current rights, which users belongs to the group and if
(and which) subgroups exists.

In EpiData we use a hierachial model for groups and associated rights, in which derived groups can
inherited rights. This means that the top most group (always named “Admins”) in a project always have
all possible rights and in derived groups it is only possible to have the same or less rights.

In addition rights are cumulative, ie. it is not posible to set a “negative” right. If a user obtains one set
of rights from group A and another set (posibly overlapping rights) from group B, the effective rights of
the user is the union of the rights from group A and B.

Building a user administrated project

All projects starts out with no administrative setup and must be prepared by creating the first user.

Step 1: (Add Access Control)

This is done by using the menu “User Access” -> “Extended Acces” - > “Add Group/User Admin..” .
After the initial warning box, the first user must be created. As a minimum login and password is
needed, all other information are optional.
For the access control to take effect, the project must first be save to disk, then re-opened and the user
must login with the newly created identity. Now the project is setup and ready to handle multiple users
and groups – they just need to be created!

Step 2: (Defining groups)

It is a good strategy to create all the needed group before adding users. Especially for more complex
project this step is essential since proper definition of groups will facilitate the addition of users to
appropriate groups.

The concept of a group can be hard to comprehend, so it may be easier to think of a group as a role
with a specific task. The task could be to reset password for user, another task could be to translate (still
to be implemented) the project, or to do the data entry.
Again, with large and complex projects involving a lot of persons defining these roles before creating
the users will in the end make maintaining the project easier.

With EpiData Manager you assign rights to a group. A right grants access to a specific task performed
with Manager, e.g. user administration, adding fields, exporting data. The complete list and
descriptions can be seen in the appendix.

By combining these rights it is possible to create groups with different purposes. For a local
administrator user rights would be essential and perhaps the groups right would be needed too. For a
group of translators, just the translate rights would be needed.

To create a new group, open the Define Group window from “User Access” -> “Extended Access”.
First time this window is opened there should be a single group already named “Admins” and this
group contains the user you created in Step 1.

Make sure that the parent group is selected - in the picture above that would be “Admins”, and click the
button (or use Ctrl/Cmd+N) just below the “Groups” caption. This will show a new form where
management rights can be assigned to the group and it may get a caption.
Step 3: (Defining Users)
With all the groups setup it is time to create some users. This is done much like we created the groups,
open then Define Users window from “User Access” -> “Extended Access”. It will bring up its own
window with a list of user.

To create a new user, just like in the Define Groups window, click the button (or use Ctrl/Cmd+N)
just below the “Users” caption. As with the Groups window, this will bring up a new window to define
the user.

As seen in the picture, creating a new user immediately allow for selecting the groups that the user
should belong to. The groups may also be chosen afterward in the “Define Group” window.

Observe that if a user is selected to be member of a group, that user is automatically also a member of
all derived groups. Eg. if a user (in the picture above) is selected to be a member of the “Local Admins”
then this user is also automatically a member of the “Entry Users” group. This will shown by marking
the “Entry Users” group with a semi-selected checkbox.
Step 4: (Assigning data entry rights)
The last step in creating a project with User/Group access control is to assign data entry rights. The
level of control for data in EpiData is implemented at the dataform level, which mean that if a user has
a certain entry right for a dataform then this right applies to all fields on that dataform.
With EntryClient the possible rights are:
• read: see data in the fields

• update: enter new values and edit existing data

• create: create new records

• delete: mark for deletion

The entry rights for a dataform are assigned to a group in the window “Define Entry Rights”

Here an entry right is assigned by setting a mark in the desired column for the intended group. If eg.
you wish to assign read rights to translators the click the “read” column besides the translators row.
Since the groups are hierachial structured assigning an entryright to a group will automatically assign
the same right to any parent groups. In the case with the “translators” group, assigning read rights will
also assign read right to the “translator admins” group.
Likewise the entry rights are also hierachial structured, so that the lowest entry right is none, then Read
and highest is Delete. So if you assign a group the Delete right all lower rights are also automatically
assigned to the same group.
As with the group management rights there is a special case with the Admins group. They will always
have full access (Read, Update, Create and Delete) to all dataforms, and hence cannot be deselected.
 Appendix:
Manager Administration Rights model:
• There will always exists a group called “Admins” and the first user created will automatically
belong to this group.
• A Group is “lowest” unit to which a management can be assigned to.
• A user with rights to manage groups, may:
◦ Create and Delete subgroups to the group the user is member of.
◦ Assign a (sub)set of rights to subgroups, from the set of rights assigned to the group the user
is member of.
• A user with rights to manage users may:
◦ Create new users
◦ Delete/Edit users if the users belong to all subgroups of saig user.
◦ Assign users to groups/subgroups the user belongs to.

Group Rights:
• Define Project:
In essens all that has to do with metadata and the structural part of the project. It allows for
modifying the studyinformation, design the dataforms, modify valuelabels, define key, etc.
• Prepare Double Entry:
Allows the user to prepare a project for double entry.
• Translate Project:
As the caption says – it allows for changing all captions in the project, but not names and
values.
• Manage Groups:
This right allow members of the group to create (delete and edit) additional derived groups.
• Manage Users:
A user with rights to manage other users may create (delete and edit) other users and assign
them to one or more groups that the user itself is part of.
• Reset Password:
Gives user the right to reset all users passwords – with the exception of users belonging to the
special Admins group.
• Export Data:
Gives the users the right to export data. WARNING: Once a project is exported the data is no
longer guarantied to be under access control. Use with caution!
• Extended Data:
Gives access to Append and Pack of data. In the future this right is meant for tools that may
manipulate data in EpiData Manager but where data is kept within the program and hence is
still under access control.
• Reports:
As the caption states, it allow for users to run reports on the data. Depending on the report it
may expose parts of the data, otherwise it is mainly aggregated data and overview.