Single account for operators and users

[kderieg322079]

A problem I'm finding with current functionality is how an account with operator privileges for a collection/set of collections cannot search other collections as a user while logged in. This means I have to have two accounts: one for operator tasks and another one for searching all of Arctos. It become especially cumbersome when a record in one of my collections has a link to a record in another collection and I have to log out and log into my other user account to see that linked record.

I think it would be much more seamless if all collections could be searched while logged in as an operator. I understand that batch tools in the results table complicates this, but it seems straight forward (in my mind) to just restrict batch tools to when the results table contains only records from collections for which I am an operator. I imagine this functionality would be appreciated by others who both manage collections and use Arctos for their research, requiring searching other collections. I have students looking to do both and I can see them roll their eyes when I tell them they actually need to make two accounts.

I'd love to discuss this at the next working group meeting if that is an appropriate platform to do so.

[Jegelewicz]

@kderieg322079 it isn't just batch tools - operators can edit records when logged in.

[kderieg322079]

For sure, I'm guessing there are a lot of things that would make this complicated but I think it is worth a conversation about addressing this instead of all of us having to have two browser windows open to do different things in Arctos (I do the same). Like restricting edit access when on a record for another collection. We can restrict access to certain functions for users, couldn't we restrict those functions for users for certain collections? I realize this wouldn't be a small change, but I think it is worth talking about feasibility of a change like this.

[Jegelewicz]

I have to log out and log into my other user account to see that linked record.

My solution for this (and trust me I have to do this A LOT) is to log into my operator account in Firefox and log into Chrome with my gmail (non-operator) for general searching.

[ewommack]

I do the same.

[mkoo]

Unfortunately having two accounts is the best way to ensure secure row-level access that the Virtual Private Database functions in PostGRESQL allows. Doing what you suggest is not really possible in the current tenant model with our current resources. In the best case, it would introduce a lot of complexities that I think most engineers would not want to handle as well as introduce security issues.

So yes many of us have two (or more) accounts to see what the public sees and what a database operators sees. Or open things in Incognito mode. I see that as a bit of security blanket for my data, too, know that you have to log in/ get past TACC to do any kind of edits.