Skip to content

Accounts, groups, and permissions

Your Canadian Astronomy Data Centre (CADC) account identifies you to CANFAR. A group lets a project share access with several accounts. Signing in confirms who you are; access to a directory or private image depends on the permissions its owner grants you.

Each request passes a chain of separate checks, and a refusal at any link looks like "access denied". Work down the chain when diagnosing one:

  1. Authentication: your credential is valid for the Identity Provider.
  2. Platform access: your account may use this Science Platform Server at all. The operator grants this once, through a platform access group or the deployment's permissions service.
  3. Group membership: you belong to the project's group.
  4. Allocation: the project has storage, and the path lies inside it.
  5. File permissions: the directory grants that group read or write.
  6. Registry role: for a private image, your registry account may pull it.

Create a project group

You need a CADC account to create a group. If your project already has one, ask one of its administrators to add you instead.

  1. Sign in to CADC Group Management.
  2. Select New Group and enter a descriptive Name and Description.
  3. Select Create and find the new group in the list.

Creating a group does not allocate project storage, set a quota, or create a container registry project. Contact CANFAR support to request a shared storage allocation and provide your group name.

Add members and administrators

You must be an administrator of the group to change its membership.

  1. Open the group's membership editor and find the Members section.
  2. Search for your colleague by username or full name, check the account in the results, and select Add member.
  3. To let a colleague manage membership too, use Add administrator in the Administrators section.
  4. Select Update to save changes. Reopen the group and confirm that the intended accounts appear in the member or administrator list.

Administrator status allows group management. It does not grant authority to allocate platform resources or edit data owned by someone else.

A Session reads your group memberships once, when it starts. After you are added to a group, start a new Session to work with that group's files; a Session that was already running keeps the memberships it started with.

Grant the group access to data

The directory owner or a person allowed to change its permissions must grant access separately from adding group members.

  1. Open Storage Management and navigate to the directory you want to share.
  2. Open its permissions editor and assign your group to Read for access without edits, or Read/Write if collaborators need to change the data.
  3. Save the change. Check the permissions on the files and subdirectories you intend to share; do not assume that changing one directory updates every existing child.
  4. Ask a group member to sign in with their own account and open a sample file. For write access, have them create and remove a small test file in the agreed directory.

A project directory on ARC is private to its group unless someone changes that. To release data publicly, place it on Vault and make it world-readable, in Storage Management or with vchmod o+r; for a citable release, use data publication.

If you cannot edit permissions, ask the directory owner or CANFAR support. Use the path supplied for your allocation rather than assuming it matches the group name.

Identity and server access

Authenticate with the Identity Provider (IDP) that owns the target Science Platform Server:

canfar login cadc
canfar server ls
canfar server use SERVER_NAME
canfar config get active.server

The names and capabilities in canfar server ls are deployment data. If the server is missing or login succeeds but a request is forbidden, your account lacks platform access on that Server: contact the operator for that Science Platform deployment. An account with one Identity Provider grants nothing on a Server that belongs to another. See the authentication guide for credential and server selection details.

Check access from the command line

For data operations, start by listing the identifiers and paths you can use:

canfar data ls -lh arc:/projects/PROJECT
canfar data info arc:/projects/PROJECT/catalog.csv

local: refers to the machine running the command. arc: and vault: are examples of configured remote identifiers; use the identifiers returned by your platform configuration and the storage guide for your deployment. A forbidden operation usually means that your account is not a member of the owning group, the path is outside the project's allocation, or the active credentials do not match the service.

Inside a Session, every process runs with your user ID and your groups, including a headless command, so a batch job can read and write exactly what you can. Ask the filesystem what it sees:

Terminal inside your Session
id
ls -ld /arc/projects/PROJECT
namei -l /arc/projects/PROJECT/results/catalog.csv

id lists the groups this Session started with. namei -l shows the owner, group, and mode of every directory on the way to a file, which reveals the one that blocks you. Change sharing in Storage Management, or with vchmod for a VOSpace Service.

Do not put credentials in a path, a notebook, an image, or a Session command. Use the configured Authentication Record or an explicitly supplied runtime credential as described in the HTTP client guide and storage guide.

Container images

Image visibility and push rights are controlled by the registry project. Find images visible to the active server with:

canfar image ls
canfar image ls --kind headless

Use the complete reference returned by the listing. A pull failure can mean a missing tag, a private project, or a registry that the target server cannot reach; ask the registry or platform operator which case applies. See Container Registry.

Session resources

Resource requests are checked when a Session is admitted. They do not change data permissions or project membership. For a rejected or long-running request, inspect the Session and its events:

canfar ps --all
canfar info SESSION_ID
canfar events SESSION_ID

See batch troubleshooting for Pending and image-pull checks.

When access is denied

Collect the smallest useful diagnostic set without exposing credentials:

  1. the active Server Name and Storage Identifier;
  2. the command shape and redacted path or image reference;
  3. the Session ID and status, if a Session is involved; and
  4. the exact error and relevant info/events output.

Ask the project administrator to confirm group membership and path ownership. If membership is correct, contact the service operator through support. Do not retry destructive operations while the ownership or path is uncertain.