Account and Access Management

• 1: Control Document Account Access
• 2: Document Temporary Storage
• 3: Managing Document Account Backups
• 4: Managing Document Account Owners
• 5: Using Start Paths in Document Accounts

1 - Control Document Account Access

Four types of access restrictions are available for an account: Private, Workspace, Member Only, and Security Group. The type of restriction set for a user is editable at any time from the account form.

Updating Account Access

1. Select Document > Manage Accounts within PlaidCloud
2. Enter the edit mode on the account you wish to change
3. Select the desired access level restriction located under Security Model
4. Select the Save button

Restriction Options

All Workspace Members

This access is the simplest since it provides access to all members of the workspace and does not require any additional assignment of members.

Specific Members Only

This access setting requires assignment of each member to an account. This option is particularly useful when combined with the single sign-on option of assigning members based on a list of groups sent with the authentication. However, for workspaces with large numbers of members, this approach can often require more effort than desired, which is where security groups become useful. To choose specific members only:

1. Select the members icon from the Manage Accounts list
2. Drag the desired members from the Unassigned Members column on the left, to the Assigned Members column on the right
3. To remove members, do the opposite
4. Select the Save button

Specific Security Groups Only

With this option, permission to access an account is granted to specific security groups rather than just individuals. With access restrictions relying on association with a security group or groups, the administration of accounts with much larger user counts becomes much simpler. To edit assigned groups:

1. Select the groups icon from the Manage Accounts list
2. Drag the desired groups from the Unassigned Groups column on the left, to the Assigned Groups column on the right
3. To remove groups, do the opposite
4. Select the Save button

Remote agents

PlaidLink agents will often use Document accounts to store files or move files among systems. To allow remote agents access to Document accounts, agents MUST have permission granted. This is a security feature to limit unwanted access to potentially sensitive information. To add agents:

1. Select the agent icon from the Manage Accounts list
2. Drag desired agents from the Unassigned Agents column on the left, to the Assigned Agents column on the right
3. To remove agents, do the opposite
4. Select the Save button

2 - Document Temporary Storage

Temporary storage may sound counter-intuitive, but real-world use has shown it to be valuable. Typically, permanent storage is used to move large files between members or among other systems, and file cleanup in these storage locations often happens haphazardly, at best. This causes storage to fill with files that shouldn’t be there, eventually requiring manual cleanup.

Temporary storage is perfect for sharing or transferring these types of large files because the files are automatically deleted after 24 hours.

To view temporary storage options

1. Go To the Document > Temp Share in PlaidCloud

Shared Temporary Storage

Shared temporary storage is viewable by all members of the workspace but is not viewable across workspaces. To access the shared temporary storage area, select the Temp Share menu and click Workspace Temp Share to display a table of files currently in the workspace’s Temp Share area.

To add new files to a shared temporary storage location

1. Select the Temp Share menu along the top of the main Document page
2. Click Workspace Temp Share
3. Click Browse to browse locally stored items
4. Select the desired file and click Open
5. Click Upload to upload the file to the temporary storage location

To download existing files from temporary storage

1. Click on left-most icon, which represents the file type

To manually delete a file

1. Click the red delete icon to the left of the file name.

Additional details on file management can be found below under “File Explorer”.

Personal Temporary Storage

Personal temporary storage is only viewable by the member to which the temp share belongs. This storage option is beneficial because it’s accessible across workspaces. This functionality makes it easy to move or use files across workspaces if the member is working in multiple workspaces simultaneously.

All members of the workspace can upload files to a members personal share as a dropbox.

To upload a file to another member’s personal share:

1. Select the Temp Share menu along the top of the main Document page
2. Select Drop File to Member Temp. A list of members will be displayed.
3. Click the left-most icon associated with the member of your choosing
4. Click Browse to browse locally stored items
5. Select desired file and then click Open
6. Click Upload to upload the file to the member’s personal storage

Additional details on file uploading can be found below under “File Explorer”.

3 - Managing Document Account Backups

Document enables the backup of any account on a nightly basis. This feature permits backup across different cloud storage providers and on local systems. Essentially, any account is a valid target for the backup of another account.

The backup process is not limited to a single backup destination. It is possible to have multiple redundant backup locations specified if this is a desired approach. For example, the backup of an internal server to another server may be one location with a second backup sent to Amazon S3 for off-site storage.

By using the prefix feature, it’s possible to have a single backup account contain the backups from multiple other accounts. Each account backup set begins its top level folder(s) with a different prefix, making it easy to distinguish the originating location and the restoration process. For example, if you have three different Document accounts but want to set their backup destination to the same location, using a prefix would allow all three accounts to properly backup without the fear of a name collision.

Reviewing Current Backup Settings

1. Go to Document > Manage Accounts
2. Select the backup icon for the account you wish to review

Creating a Backup Set

1. Go to Document > Manage Accounts
2. Select the backup icon for the account for which to create a backup
3. Select the New Backup Set button
4. Complete the required fields
5. Select the Create button

The backup process is now scheduled to run nightly (US Time).

Updating a Backup Set

1. Go to Document > Manage Accounts
2. Select the backup icon for the account for which to edit a backup
3. Select the edit icon of the desired backup set
4. Adjust the desired information
5. Select the Update button

Deleting a Backup Set

1. Go to Document > Manage Accounts
2. Select the backup icon for the account for which to edit a backup
3. Select the delete icon of the desired backup set
4. Select the Delete button

4 - Managing Document Account Owners

The member who creates the account is assigned as the owner by default. However, Document accounts are designed to support multiple owners. This feature is helpful when a team is responsible for managing account access or when there is member turnover. Adding and removing owners is similar to adding and removing access permissions.

Add or Remove Owners

1. Go to Document > Management Accounts in PlaidCloud
2. Select the owners icon in the Manage Accounts list
3. Drag new owners from the Unassigned Members column on the left to the Assigned Members column on the right
4. To remove owners, do the opposite
5. Select the Save button

Because only owners have the ability to view and edit an account, account administration is set up with two levels:

• The member needs security access to view and manage accounts in general, and
• The member must be an owner of the account to view, manage, and change settings of accounts

5 - Using Start Paths in Document Accounts

The account management form allows the configuration of the storage connection information and a start path. A start path allows those who use the account to begin browsing the directory structure further down the directory tree. This particular option is useful when you have multiple teams that need segregated file storage, but you only want one underlying storage service account.

The Start Path option in Document accounts is useful for the following reasons:

• When controlling access to sub-directories for specific teams and groups
• Granting access to only one bucket

For example, setting a start path of teams/team_1/ for the Team 1 Document account and teams/team_2 for the Team 2 Document account provides different start points on a shared account. When a member opens the Team 1 Document account they will begin file navigation inside team/team_1. They will not be able to move up the tree and see anything above teams/team_1.

Team 2 would have a similar restriction of not being able to navigate into Team 1's area.

This provides the ability to restrict specific teams to lower levels of the tree while allowing other teams higher level access to the tree while not needing any additional cloud storage complexity like additional buckets or special permissions.

Adding and Updating the Start Path

1. Go to Document > Manage Accounts
2. Select the account you wish to edit and enter the edit mode
3. Add a Start Path in the Start Path text field
4. Select the save button

Start Path Format

The path always begins with the bucket name followed by the sub-directories.

<my-bucket>/folder1/folder2/