Skip to content

Administrators

Group id 104, stored as [Administrators] (created by setup/PatchLibrary/Worker/Updates/Update_8_5_138.cs), enum value enum_IR.AdmistrativeRoles.Administrators. The role is the system-wide one: an administrator passes every administrative-role check, and a set of operations (libraries, property sets, document types, other users' recycle bins, the licence, the cache, the role groups themselves) is reserved for administrators alone. It is a system group: it belongs to no library (DOMAINID 0), it can be neither renamed nor deleted (UsergroupOperations.cs, group ids up to IRConstants.LastSystemUserGroupId = 1000 are system groups), and its members, like those of the other five role groups, are changed by administrators only: for IrAdminAction.UpdateGroupMembers on a group id up to 1000 IRSecurity.IsAllowed adds no role, so only the administrator check at the top of AccessAllowedforAdminFunctionsAsync passes.

How the role is checked

Who is an administrator. ThreadVariables.IsAdministrator() (IRNET/ThreadVariables.cs): the signed-in user is the sysadmin account (IRConstants.SysAdminAccountId, user id 4) or a member of group 104 (UserOperations.IsAdministrator, a UsergroupMembersStore.IsMemberOfGroupAsync read). The membership is read from the database at each call; nothing is cached in the session, so adding or removing a member takes effect on the member's next request. An anonymous caller (user id 0 or below) is never an administrator. When the check is about another user's account, IRSecurity.IsAdministratorAccountAsync applies the same definition to that user.

Where it is checked. Four places decide, and administrators pass all four:

  1. The role matrix, IRSecurity.AccessAllowedforAdminFunctionsAsync: its first line returns success for an administrator, before the "administrator's account" guard, before IsAllowed (self, role groups, library managers) and before the task-redirection special case. So an administrator passes every IrAdminAction, including the two for which the matrix adds no role at all: FlushApplicationCache and UpdateGroupMembers on a role group.
  2. Direct IsAdministrator() checks in IRNET and WebServices (the operations in the first table below). A refusal is errorCode="4030" with, in most places, "Only the system administrator can perform this operation" (Messages.OnlySystemAdministratorCanPerformOperation); UpdateApplicationLicense, RemoveAllSubscriptions and RestoreRecycleBinItem answer "Access denied." (Messages.AccessDenied).
  3. The Search & Category Administrators check, UserOperations.HasAdministrativeRoleAsync (used only by IRNET/SearchPages.cs): the sysadmin account passes, and the membership test is on the role group or group 104.
  4. The library-management and workflow-management checks, SecurityFunctions.CheckDomainManagementAsync and CheckWorkflowManagementAsync (IRNET/ModuleSecurityFunctions.cs): both return success for an administrator before looking at library managers or workflow supervisors.

Where it is not checked. The item-level permission check, IRSecurity.AccessAllowedAsync (the IrAction rights on documents and folders), has no administrator branch at all: it looks at library membership, the library policy, ownership, library-manager status, the access list and the user type. An administrator is treated like any other user there. See "What the role cannot do".

Refusal from the matrix (for a non-administrator): 4030, "Access denied. This action is restricted to the following roles: The system administrator, ..." followed by the roles the action admits (IRSecurity.IsAllowed).

What the role can do

Everything every other role page lists, plus the following. In the first table nobody else may do the action.

Administrators only

Action Web service calls Who else may do it Conditions
Create a library CreateDomain nobody else The licence's library count (LicenseInfo.MaxLibraryCount) is enforced. DomainOperations.CreateAsync
Rename a library, change its anonymous, hidden or welcome-message settings UpdateDomain nobody else The FORM TEMPLATES library cannot be renamed (4000). DomainExtensions.UpdateAsync
Delete a library DeleteDomain nobody else Refused (4000) while the library has workflow definitions, local users, local groups, folders or documents; FORM TEMPLATES never. DomainOperations.DeleteAsync
Archive or unarchive a library ArchiveDomain, UnarchiveDomain nobody else Archiving is refused (4000) while documents are checked out. DomainExtensions.ArchiveAsync / UnArchiveAsync
Create, change or delete a property set definition CreatePropertySetDefinition, CreatePropertySetDefinition1, UpdatePropertySetDefinition, UpdatePropertySetDefinition1, DeletePropertySetDefinition nobody else System property sets (attributes = 2) cannot be changed (4030) or deleted (4000). PropertySetOperations.CreatePropertySet, PropertySetExtensions.UpdateAsync, InfoRouter.DeletePropertySetAsync
Add or remove a property set field AddPropertySetField, DeletePropertySetField nobody else Not on system property sets (4030). PropertySetExtensions.AddFieldAsync / RemoveField
Add or remove an option of a field AddPropertySetFieldOption, DeletePropertySetFieldOption nobody else Adding needs a LIST BOX, COMBO BOX or RADIO BUTTON field (4000). PropertySetFieldExtensions
Set the lookup parameters of a LOOKUP field SetPropertySetLookupFieldParametersForSQLServer, SetPropertySetLookupFieldParametersForORACLE, SetPropertySetLookupFieldParametersForMYSQL nobody else The field must be of control type LOOKUP (4000). Checked in PropertySetServices.SetPropertySetLookupFieldParametersAsync and again in PropertySetFieldExtensions.SaveLookupParams
Create, change or delete a document type CreateDocumentTypeDef, CreateDocumentTypeDef1, UpdateDocumentTypeDef, UpdateDocumentTypeDef1, DeleteDocumentTypeDef nobody else The name "Generic document" (in any supported language) is reserved. DocumentTypeOperations
Search every user's recycle bin SearchRecycledItems, SearchRecycledItems1 nobody else RecycleBinServices.BuildSearchCriteriaAsync
Purge a recycled item of any user PurgeRecycleBinItem nobody else The item is queued for the purge job, not deleted at once. RecycleBinOperations.PurgeRecycledItemAsync
Restore an item from another user's recycle bin RestoreRecycleBinItem anyone signed in, from their own recycle bin RecycleBinOperations.RestoreRecycledDocumentAsync / RestoreRecycledFolderAsync
Flush the application cache FlushApplicationCache nobody else Matrix action with no role (IRSecurity.IsAllowed)
Update the licence UpdateApplicationLicense nobody else Refusal is "Access denied." (InfoRouterExtensions.UpdateLicenseInformation)
Add or remove members of the six role groups (ids 100 to 105) AddUsergroupMember, RemoveUsergroupMember nobody else (User Managers and library managers manage ordinary groups only) The sysadmin account cannot be removed from [Administrators] (4000); the last member of a group that holds a workflow role or task cannot be removed (4000). UsergroupExtensions.RemoveMemberAsync, UsergroupOperations.AddMemberTransactionAsync
Appoint yourself manager of a library AddManagerToDomain naming yourself; TransferUserDomainManagerRoles with yourself as the target nobody else; a User Manager may appoint other users 4030 "Only administrators can make themselves a library manager" for anyone else. DomainExtensions.SetDomainManagerAsync, UserTakeOverOperations.RunAsync
Change an administrator's account (the sysadmin account or any member of [Administrators]) UpdateUserProfile, ChangeUserStatus, ChangeUserType, UpdateUserPreferences, UpdateUserContactInfo, UpdateUserEmail, ChangeUserPassword, DeleteUser, DeleteUser1, SetUserTaskRedirection, RemoveUserTaskRedirection, AddPropertySetRowForUser, UpdatePropertySetRowForUser, DeletePropertySetRowForUser the administrator themselves, on the self-service calls (preferences, contact info, e-mail, password through ChangeUserPassword1, task redirections) The guard is IRSecurity.ChangesTheAccount (UpdateUserProfile, UpdateUserPreferences, SetUserPassword, DeleteUser, SetUserTaskRedirections, ApplyRemoveCustomMetaData) plus IsAdministratorAccountAsync on the target; refusal 4030 "Access denied. Only administrators can change an administrator's account." Reading an administrator's account is not guarded. The sysadmin account has further limits, see below
Take an administrator's work away the thirteen Transfer calls (TransferUserTasks, TransferUserDomainMemberships, TransferUserGroupMemberships, TransferUserDomainManagerRoles, TransferUserSecurityPermissions, TransferUserWorkflowDefinitions, TransferUserISOTasks, TransferUserCheckedOutDocuments, TransferUserFolderOwnerships, TransferUserDocumentOwnerships, TransferUserDocumentSubscriptions, TransferUserFolderSubscriptions, TransferUserExpirationNotices) when fromUserName is an administrator nobody else Giving work to an administrator is not guarded. UserTakeOverOperations.RunAsync
Move role-group memberships in a transfer TransferUserGroupMemberships nobody else: for any other caller the groups with id up to 1000 stay with the from-user and the answer carries warnings="Administrative role memberships were not transferred: only administrators can transfer them." UserTakeOverOperations.TransferUsergroupMembershipsAsync

More data, or exempt from a limit

Action Web service calls Who else may do it Conditions
See the connection details of a database lookup field GetPropertySetDefinition nobody else: others get looktype only The dbconnectionparams element (dbtype, server or service name, user name, database name; the password is always ****) is written only for an administrator. WebAPI/Serialization/PropertysetSerializationExtensions.cs
See every property set GetPropertySetDefinitions, GetPropertySetDefinitions1 others see the public sets and the sets of the libraries they are a member of; anonymous callers the public sets and those of anonymous libraries PropertySetOperations.GetAvailablePropertySetsForUserAsync (UserOperations.IsUserAdministrator), PropertySetStore.GetAvailableCategoryRowsForUserAsync
List the members below a right in any library, or in every library at once GetMembersWithoutAccess library managers, for the libraries they manage (4030 "Only library managers can perform this operation" for another library) An empty domainName means every library for an administrator, the managed ones for a library manager. LibraryServices.GetMembersWithoutAccessAsync
See every workflow task in every library getTasks, GetTasks1 library managers see the tasks of the libraries they manage; everyone else only tasks they are assigned to, assigned by or supervise Only when the criteria name no document and no flow and the caller is not the assignee, assigner or supervisor in the criteria. WorkflowOperations.GetTasksAsync
Upload a document larger than the maximum document size every upload: UploadDocument, UploadDocument1, UploadDocument2, UploadDocument3, UploadDocument4, UploadDocumentWithHandler, UploadDocumentWithHandler1, UploadDocumentWithHandler2, UploadDocumentWithHandler3, UploadNewDocumentWidthHandler, UploadTiffAsPDF, UploadTiffAsPDFWithHandler, the import, and WebDAV PUT nobody else: 4000 "Maximum document size limit exceeded." (WebDAV: HTTP 415) The general setting UploadSettings.DocumentMaxSize. Checked in DocumentServices.UploadDocumentAsync, DocumentPublishOperation.RunAsync (every path that publishes a version), DocumentImportOperation.IsMaxDocumentSizeExceededAsync and DAVCoreMiddleware/PutMethod.cs
Remove all subscriptions of another user RemoveAllSubscriptions the user themselves; the managers of the user's library, for a local user UserExtensions.UnSubscribeAllAsync; refusal "Access denied."
Get the extended application parameters getApplicationParameters nobody else: others get the basic block The extended block (INDEXCATALOG, LOGLOGINS, FILEUPLOADTIMEOUT, SMTP server, port, user name and password, the PWD... password policy values, the AuthenticationAuthorities element) is written only when LibraryServices.GetApplicationParametersAsync reports an administrator. WebAPI/SettingsWebServices.cs
Reach a library they are not a member of, by name or by id every library call that takes a DomainName (GetManagers, AddUserAsDomainMember, UpdateDomain, DeleteDomain and the rest) its members; anyone for an anonymous library; User Managers and Policy Managers for every library; a library's own managers DomainOperations.MayReachAsync: membership, or IrAdminAction.ListLibrariesForAdministration. Reaching a library is the lookup only; each call then makes its own check
Manage workflow definitions of any library CreateFlowDef, CreateFlowDef1, CreateFlowDef2, CreateFlowDef3, UpdateWorkflowDefinition, ActivateFlowDef, DeactivateFlowDef, AddFlowStepDef, AddFlowStepDef1, DeleteFlowStepDef, UpdateWorkflowStepDef, UpdateWorkflowTaskDef the library's managers; the members of the definition's supervisor list (not for creating a definition, which is CheckDomainManagementAsync: administrators and library managers only) SecurityFunctions.CheckWorkflowManagementAsync; refusal 4030 "Only administrators, library managers, or workflow supervisors can perform this operation."
Act as a Search & Category Administrator CreateSavedSearch without isPersonal, UpdateSavedSearch and DeleteSavedSearch on a system-wide search, GetSavedSearches and GetSavedSearch for every system-wide search members of group 105 UserOperations.HasAdministrativeRoleAsync passes the sysadmin account and members of group 104 without a membership of group 105

What the role cannot do

Action Web service calls Who can Error returned
Read, list or change documents and folders of a library they are not a member of every document and folder call (GetDocument, GetFoldersAndDocuments, Search, uploads, ...) members of the library with the right; anyone, for list and read, in a library that allows anonymous access 4030 "Insufficient rights. This action can only be performed by library members with appropriate rights." (IRSecurity.AccessAllowedAsync: no administrator branch)
Exceed their access-list right in a library they are a member of same the item's owner and the library's managers, as the library policy allows; users with the right on the access list; the holder of an active workflow task on the document 4030, the message the policy gives
Change anything as a Reader-type administrator every changing document and folder call Authors 4030 "Insufficient rights. Read-only users cannot perform this action."; a Reader's given right is capped at Read (IRSecurity.AccessAllowedAsync)
See the libraries they are not a member of in the ordinary library list GetDomains nobody: the list is membership-based for everyone (DomainsStore.GetLibrariesForUserAsync). Use GetLibrariesForAdministration none; the list is shorter
Delete the sysadmin account DeleteUser, DeleteUser1 nobody 4000 "Administrative account cannot be deleted." (UserOperations.DeleteUserAsync, after the role check)
Disable or retype the sysadmin account ChangeUserStatus, ChangeUserType nobody 4030 "This is a system account and cannot be changed." (UserExtensions.SetUserStatus / SetUserType). UpdateUserProfile does not refuse: it silently keeps the account Enabled and Author
Remove the sysadmin account from [Administrators] RemoveUsergroupMember nobody 4000 "The sysadmin account cannot be removed from the 'Administrators' user group"
Rename or delete a role group (ids up to 1000) UpdateUserGroupName, UpdateUserGroupName1, DeleteUsergroup nobody 4000 "System user groups cannot be renamed." / "System user groups cannot be deleted."
Change or delete a system property set (attributes = 2) UpdatePropertySetDefinition, AddPropertySetField, DeletePropertySetField, DeletePropertySetDefinition nobody 4030 "System property sets cannot be changed or deleted." (delete: 4000, same text)
Rename or delete the FORM TEMPLATES library UpdateDomain, DeleteDomain nobody 4000 "Form templates is a system library and cannot be renamed." / "... cannot be deleted."
Read, change or delete another user's personal saved search GetSavedSearch, UpdateSavedSearch, DeleteSavedSearch its owner only Read: 4030 "Access denied."; change or delete: 4030 "Access denied. Only the search page owner can perform this operation." (SearchPages.cs: a page with an owner is readable by its owner only)
Delete the Advanced search page (id 1) DeleteSavedSearch nobody 4030 "Advanced search page cannot be renamed or deleted."
Change their own password without the current one ChangeUserPassword on their own name nobody: use ChangeUserPassword1 4000 "infoRouter cannot change your own password without your current password. Call the 'CHANGEUSERPASSWORD1' method instead." (not asked with Windows authentication on, or for a non-infoRouter account)
Delete a user with DeleteUser while the password re-prompt policy covers user deletion DeleteUser nobody: use DeleteUser1 with the password 4000 "... Call the 'DELETEUSER1' method instead." (UserServices.DeleteUserAsync, everyone, Windows authentication off)
Empty or list another user's recycle bin EmptyRecycleBin, GetRecycleBinContent each user, their own; for others use SearchRecycledItems and PurgeRecycleBinItem none: both act on the caller's own bin (RecycleBinServices)

Finding out whether the signed-in user has this role

  • GetGroupMembershipsOfUser with the caller's own name: IrAdminAction.ListingGroupMembershipOfUser allows the self action, so every signed-in user may ask about themselves; a GroupID of 104 in the answer means the caller is an administrator. The sysadmin account (user id 4) is an administrator whether or not it is listed in the group (ThreadVariables.IsAdministrator).
  • getApplicationParameters: the extended block (INDEXCATALOG, SMTPSERVER, PWDMINLEN, AuthenticationAuthorities and the rest) is present only for an administrator (WebAPI/SettingsWebServices.cs), which makes the call a direct administrator test that also covers the sysadmin account.
  • GetLibrariesForAdministration answers every library for an administrator, but also for User Managers and Policy Managers (UserOperations.GetLibraryListForAdministrationAsync), so it does not single the role out.

Notes

  • Administrative versus item rights. The administrator bypass exists in the administrative checks only. Library membership, the access list and the library policy still decide what an administrator may do with a document or folder, and GetDomains lists only the libraries the administrator is a member of. A Control Panel page that works on content (not on settings, users, libraries or definitions) must not assume an administrator can open it. DomainMembersStore.IsDomainMemberAsync counts direct membership and membership through a global group that is a library member; being in [Administrators] is not, by itself, a membership of any library.
  • Who else counts as an administrator's account. The guard in AccessAllowedforAdminFunctionsAsync and the transfer guard (UserTakeOverOperations.RunAsync) use IsAdministratorAccountAsync: the sysadmin account or any member of group 104. Reading such an account (GetUser, GetUserStatistics, the activity lists) follows the ordinary rules; only changing it is reserved.
  • Transferring an administrator's memberships. An administrator running TransferUserGroupMemberships moves the role-group memberships too, [Administrators] included, so the to-user becomes an administrator. That is the intended administrator-only path; for anyone else the role groups stay behind.
  • UpdateApplicationLicense refuses with the generic "Access denied." while the other administrator-only writers say "Only the system administrator can perform this operation". Same code (4030), different text.
  • GetManagedDomainsByUser for another user is no longer administrators only: UserServices.cs lets whoever may look the user up read their managed libraries (administrators, User Managers, the user's library managers, co-workers).
  • Library lookup by name has the administrator bypass since commit 61e1fb36 (DomainOperations.MayReachAsync, shared by the by-name and by-id lookups).
  • Not an ISrv operation: the REST controller IRWebCore/Controllers/PortalsController.cs has api/Portals/UpdatePortalSecurity, administrators only (HTTP 401 "Access denied." otherwise).
  • The sysadmin user name may be changed; the reserved names SYSADMIN, ADMINISTRATOR and SYSTEM are refused for every other account (IrGeneral.IsValidFirstLastAndUserName).