Seqr Local Instance Permission Groups

[anjalijain22]

Hello,

My team and I have installed a local instance of seqr and have some questions about the different permission groups. We know that the following groups exits on seqr -

1. Project Manager
2. Analyst
3. Superuser
4. Staff
5. Data Manager

Can you provide more clarity on the privileges that each of these groups have? Are there any other user groups that seqr provides apart from the ones mentioned above? Can I individually add permissions such as "permission to create project" for a user if I wanted to?

Thanks,
Anjali

[hanars]

Hi Anjali,

The permission levels work as follows

1. Project Manager: These are users who have permission to create new projects and update the pedigree information for existing projects. The existence of this role is generally very Broad-specific, as it assumes there are dedicated individuals who need to be the ones managing projects and pedigrees. By default for local installs this role does not exist, and superusers are granted all project manager privileges.
2. Analyst: This is another Broad-specific access tier, and is a way of creating a category of users who are granted manager access to all seqr projects, as well as access to some Broad-specifc reports. By default for local installs this role does not exist, but if you have many users who should have manager access to all projects in your seqr instance it may be worth enabling it, although it is generally better security practice to grant per-project access to the relevant users
3. Superuser: These are users who have full access to the seqr system. They have all the permissions of Data Managers, as well as an administrative view into the seqr database. For local installs, these users also have the Project Manager permissions described above. In general there should be relatively few of these users
4. Staff: This is not actually a role. Internally, Broad users often refer to Analysts as staff users so you may see tickets referring to staff users, but it just means analyst. There is also a database flag for users called is_staff which is used to mark in the database whether users are data managers or not, which may also lead to some confusion.
5. Data Manager: These are users who have the ability to add data to seqr projects. They have manager level access to all seqr projects, and have some additional administrative views into the elasticsearch backend and other data-loading specific views. In general there should be relatively few of these users

I also want to highlight that seqr users who do not have any of these levels of escalated privilege still have access to the seqr system. They will have project-specific permissions which determine which if any projects they can see and what they can do on those projects. On a per project basis their are two levels of access:

1. Collaborator: Users can view a project, do searches, and add tags and notes to variants and families.
2. Manager: Users have all the privileges as managers, as well as additional privileges like editing individual/ family specific data and granting/ revoking access to the projects

Note that users can have different access levels on different projects.

I hope this helps, let me know if you have any further questions

[hanars]

1. How can we enable "manager" access for users? Is this something we can do using the admin panel or is there a better way which is recommended?

This should be done on a per-project basis. Anyone who is a manger in a project can add anyone else to the project and set them as either manager or collaborator. The interface for this is available on the right hand side of the proejct page in the "Collaborators" section

2. Regarding project manager capabilities - On our local seqr, a user (who is a project manager) can create a project, but cannot "bulk edit individuals" or edit pedigree information on existing projects as it gives a "permission denied" error message. What may be the reason for this?

Project managers do not by default have access to all projects. In order to do these sorts of edits a user must be both a PM and have edit access to the project in question. In our seqr instance, we make all our PMs analysts as well as PMs to make sure they have edit access to the projects. For what its worth, we do not recommend enabling PM as a role unless there is a good reasons why your PMs should not just be supersusers

3. Regarding adding a user as collaborator - A user X (who is a project manager) creates a project ABC and successfully adds user Y (new user) as a collaborator. However, User Y's project page is still empty and cannot view/access project ABC.

In general, if a user with manager access to a project adds another user to that project that other user should be able to see the project, so something is not going right here, but it is hard to tell what without more detail. When user X goes to project ABC do they see user Y listed as a collaborator for the project? Does user X themselves have manager access to this project? When user Y logs into seqr without trying to go to the project page, what do they see?

[anjalijain22]

Hi Hanars,

This should be done on a per-project basis. Anyone who is a manger in a project can add anyone else to the project and set them as either manager or collaborator. The interface for this is available on the right hand side of the proejct page in the "Collaborators" section

Ah I completely missed seeing that button! I'm now able to set up manage access for users, thank you!

Project managers do not by default have access to all projects. In order to do these sorts of edits a user must be both a PM and have edit access to the project in question. In our seqr instance, we make all our PMs analysts as well as PMs to make sure they have edit access to the projects. For what its worth, we do not recommend enabling PM as a role unless there is a good reasons why your PMs should not just be supersusers

I see. This is my understanding and please correct me if I'm wrong - the superuser has full access to seqr and can view all projects. The main reason why we do not want out Project Managers to also be superusers is because we'd like to limit the projects they can view and edit.

Ideally, we would like to follow your recommendation for granting per-project access to users and not have the PM and analyst roles enabled. But in this situation, all the data handling responsibilities (i.e creating projects, uploading datasets, and pedigree information etc) would be in the hands of the superusers alone, correct? If we wanted, is there a way we could give "managers" of projects the permission to add datasets and pedigree info while also not being able to view projects created by other users?

Regarding adding a user as collaborator - A user X (who is a project manager) creates a project ABC and successfully adds user Y (new user) as a collaborator. However, User Y's project page is still empty and cannot view/access project ABC.

This issue was automatically resolved. I think there was a lag between adding the user as a collaborator and the changes being reflected on the user's project page.

[hanars]

If we wanted, is there a way we could give "managers" of projects the permission to add datasets and pedigree info while also not being able to view projects created by other users?

Only someone with the "Data Manager" role can add data to a project, PMs currently do not have this access. For editing pedigree info, there is a way to allow project managers to edit this information, you need to enable the "case review" feature on the project. This does also enable an additional "case review" view of the project but you can just not go to that page and so theres no harm in enabling this feature.

[AlessandroLas]

from the previous replies....
5. Data Manager: These are users who have the ability to add data to seqr projects. They have manager level access to all seqr projects, and have some additional administrative views into the elasticsearch backend and other data-loading specific views. In general there should be relatively few of these users.

"Only someone with the "Data Manager" role can add data to a project, PMs currently do not have this access."

Maybe the opposite should be more effective.

If I got what in point 5, there are few differences between the superuser and the data manager. The data manager can't log in to the /admin section.
From what I see in my local install, the data manager is who has the flag "staff status". This type of user can access (AND EDIT, AND ADD SAMPLES) all the projects. The data manager can also view and delete indexes in the elasticsearch.

The point is: how to give a data manager permission only for a given project?

Why seqr lacks a wiky page or a user/admin manual?

[hanars]

The point is: how to give a data manager permission only for a given project?

You can not give a data manger access only to a specific project. This is not supported in seqr, nor do we have any plans to support it. Supersuers and data managers can add data to a project, they are the only ones who can do this, and they can do this for any project. You need to find someone in your group you trust with this permission

Why seqr lacks a wiky page or a user/admin manual?

Because this is free, open source academic research software that we provide to the community because we want to help. We have a 2 person development team and no real user experience, communications, etc team because we have no resources to pay them. If you, as a community member who benefits from us making seqr free with such limited resources, wanted to give back to the community by writing up documentation we would welcome your help

[anjalijain22]

Hi @hanars,
I have a follow up question regarding the permissions.
(Note: Currently, we have the recommended permission groups set-up on our local instance. Therefore, analyst and Project Manager roles are not enabled.)

The issue: When I try to edit the proband relation by going into a project's Edit Families & Individuals > Edit Individuals tab, I encounter a permission denied error:

I believe this feature is locked behind the user being an "analyst". I wanted to understand from you if there was a way by which any other user (such as the superuser) could edit this without us having to enable the analyst role in our local instance?

[hanars]

This functionality is generally limited to "project managers", but in projects with case review enabled it is available to anyone with permission to edit the project. If you do not have the "Project Manager" role enabled, then superusers are considered to have the project manager permissions.

In general, if you can see the interface to edit something you should have permission to edit it. Can you clarify what your configuration is, and what the permission level of the the project and user are where you are seeing this issue?

[anjalijain22]

Hi @hanars, I just wanted to follow up on this issue. To clarify, the user is a superuser and a data manager. We are working with a local installation so by default do not have the analyst and project manager roles enabled. I tried enabling the "case review" for the project but I still get a "permission denied" when I try to edit the proband relationship.

PS. My apologies for the the very delayed response!!

[hanars]

Internal fields are limited to analysts - if you do not have an analyst role configured you should not be able to see or edit these fields at all. Feel free to put in a bug ticket for seqr saying you are incorrectly being shown this field as an option to edit and we can make sure it is removed from the UI for you. However, unless you enable the analyst role, this field is not available.

It is also worth noting that fields designated as analyst -only in seqr are disabled by default for local installations because they are finicky fields that are only used for specific Broad reports and we do not think they should be used by anyone else. The pedigree in seqr is a much more effective way to show users the relationship between individuals in a family so if there is a family where relationships are confusing we recommend you edit the pedigree to mak it clearer ather than enabling and updating these fields. You can also add free text notes to individuals if theres is a particularly confusing relationship you want to discribe

[anjalijain22]

I see, that makes sense! I can open up a bug ticket detailing this. Thank you for taking the time to clarify this, much appreciated!