Checkbox 5.0 Permissions Guide Welcome to the Checkbox permissions guide. This document will walk you through the process of configuring permissions within the Checkbox application. Contents: - What are Checkbox permissions? - What is the difference between permissions and roles? - What is the difference between permissions for Respondents and Editors? - How to configure the permissions of a survey for your respondents - Survey Security Definitions - User Roles - How to configure default permissions for surveys, reports, folders, groups and email lists - Permissions Diagram - How to add users and user groups to a survey ACL - How to add users and user groups to a user group ACL - How to add users and user groups to a report ACL - How to configure permissions of a folder to allow non-acl access - Permissions Review What are Checkbox permissions? Permissions control which access-controllable entities a user can create, edit or view. Specifically, permissions can be set on Surveys, Reports, User Groups, Libraries, Folders and Email Lists. Throughout this guide, the shorthand entity will be used when discussing any of the previously mentioned access-controllable entities. What is the difference between permissions and roles? User roles dictate which permissions can be assigned to a particular user. Permissions dictate the access over Checkbox entities. Simply being in an Administrator role does not grant a user any additional permission (with the exception of System Administrators) over an entity. By default, a user has access to only the entities they have created, be that a survey, a report, a user group, etc. If you would like to grant a user access to use an entity they did not create, the user will need to have the correct role(s_ and have been granted permission(s). Checkbox 5.0 Permissions Guide - 1
What is the difference between permissions for Respondents and Editors? For Surveys and Reports you may set two different sets of permissions: - Permissions to allow users to Take a Survey or View a Report - Permissions to allow users to Edit a Survey or Edit a Report Registered Checkbox Users will only be able to create new surveys or reports if they have the correct roles assigned to their account. These users will only be able to edit or view Checkbox entities if they have been granted permissions to do so for each individual entry. By default, only the editor who created the survey and System Administrators have permission to view and edit a survey. If you would like additional users to be able to edit/view the survey, they will need to be added to the survey s ACL (Access Control List) and granted the appropriate permissions. This process is covered in more detail in the sections entailed How to configure permissions of a survey to allow other Survey Editors/Survey Administrators access How to configure the permissions of a survey for your respondents (most common permissions practice in Checkbox) By default, all surveys are set to Public upon creation; this means anyone provided with the survey URL will be able to respond to your survey. If you would like to restrict access to your survey/report to specified user(s) or group(s), then you can change the permissions the following way: Checkbox 5.0 Permissions Guide - 2
1. From the Survey Manager page, select the survey you want to configure permissions for. Note: This assumes you are the Survey Administrator for a survey that you have created or have the authority to change permissions 1. Select Permissions from the dashboard on the right-hand side. 2. Current permissions are summarized below the Permissions heading. To change permissions, select the Edit button. Checkbox 5.0 Permissions Guide - 3
The Permissions page contains multiple options that you may configure. Resume & Edit Options: This window is where you determine whether respondents are allowed to return to already visited survey pages, save the survey and resume it at a later date, or edit their completed responses to the survey. Checkbox 5.0 Permissions Guide - 4
Basic Security Settings: This window is where you determine access control for your survey. 1. Select a Survey Permission Type from the left-hand column. 2. Checkbox will tell you who can take this survey on the right-hand side of the window. 3. Checkbox will provide a description of the security setting you selected at the bottom of the window. Note: Each option changes the permissions of your survey for Respondents only. This section does not configure any permission for the users who will have the ability to edit your survey. This will be covered in a later section: How to allow other users the ability to edit surveys Checkbox 5.0 Permissions Guide - 5
Advanced Security Settings: From this window you can view current user permissions, change default permissions, and add users and/or groups to access lists. The ACL refers to the Access Control List. Many entities in Checkbox have an Access Control List. This list allows you to control permissions for your entities. For example, if you needed to grant an additional Survey Editor the ability to edit a survey you could grant them this permission using the ACL. If you chose Access List as your survey security setting in Basic Security Settings, select Save and move to the Advanced Security Settings tab (see screen shot above). 1. The left hand side of the editor (Permission List Entries) contains the list of users and groups currently in the access control list (ACL). Checkbox 5.0 Permissions Guide - 6
2. The Current Permissions pane (right hand side of the editor) contains the permissions that apply to the currently select user in the user list. When you are happy with your permissions/security configuration, select Save to save your changes. Survey Security Definitions Public: Survey has no access control. Any respondent, including those not registered in Checkbox as users, will be allowed to complete this survey. Responses will be anonymous. Password Protected: A survey-specific password will control access to this survey. Any respondent that knows the password may complete this survey. Responses will be anonymous. Access List: Only users specified in the access control list will be allowed to complete this survey. Users must log-in to Checkbox to take the survey and their user attributes will be linked to their responses. Select the "Respondents List" button (will appear once the Access List option is selected) to add users to your survey access list (see above image). All Registered Users: Any user that can log into Checkbox and is assigned the respondent role will be able to complete this survey. Invitation Only: Only respondents who have been invited via an email invitation sent by the Checkbox application will be able to respond to this survey. Checkbox Tip: By setting your survey to Public or Password Protected you are not requiring your respondents to be registered Checkbox Users. This means that each response will be captured as an Anonymous Respondent. If you would like to capture the user name of your respondent, you will need to create an account for your user and set permissions for your survey to Access List or All Registered Users Checkbox 5.0 Permissions Guide - 7
Anonymous Respondents By setting your survey to Public or Password Protected or Invitation Only, you are not requiring your respondents to be registered Checkbox Users. This means that each response will be captured as an Anonymous Respondent. If you would like to capture the user name of your respondent, you will need to create an account for your user and set permissions for your survey to Access List or All Registered Users. Access Control List The ACL Editor refers to the Access Control List Editor. Many entities in Checkbox have an Access Control List. Users may only be added to a particular entity's ACL if their individual user role(s) correspond with that entity. For example Report Viewers may be added to a report ACL. This list allows you to control permissions for your entities. For example, if you needed to grant an additional Survey Editor the ability to edit a survey you could grant them this permission using the ACL. WIthin the ACL you can also configure the 'Default Policy.' Under the Default Policy tab of an ACL you can set non-acl (anyone not specified on the ACL) access levels. User Roles Checkbox User Roles are configured when you create a new user and can be edited within the User Manager at any time by an administrator. You can select one or more user roles for any given user, depending on the level of access you wish to grant them within Checkbox. The following is a list of all Checkbox 5.0 Permissions Guide - 8
user roles and the actions each role is capable of: Systems Administrator: Can change the settings of the application and view/edit/respond to all items within Checkbox Survey Administrator: Can create/edit/activate surveys Survey Editor: Can modify surveys User Administrator: Can create new users Group Administrator: Can assign users to groups Report Administrator: Can view reports and create new ones Report Viewer: Can view existing reports Respondent: Can respond to surveys These roles are required in order to complete specific action(s) on a Checkbox entity. For example, if a particular user is a Survey Editor but has not been added to the ACL list of a specific survey, then they will not be able to edit that specific survey. Checkbox 5.0 Permissions Guide - 9
How to configure default permissions for Surveys, Reports, Folders, Groups and Email Lists Access control lists are used to control the permissions settings for surveys, reports, folders, groups and email lists. The "default policy" of a Checkbox entity determines what permissions are granted to users who are not on the ACL. For example, if the default policy for a survey grants Take Survey permission, any respondent can take that survey. To configure the default permissions for a survey, run through the following steps: 1. From the Permissions Editor select the Advanced Security Settings Tab 2. Select Default Policy to edit the default permissions Checkbox 5.0 Permissions Guide - 10
3. Enable the appropriate options you would like to grant all users to your installation 4. Select the Save Changes button to save your changes Checkbox Tip: ACL permissions supersede any default policy. Checkbox Tip: When adding a user group to an ACL, only users with user roles that correspond with that ACL entity will have access. Make sure all group members have the appropriate user role. Permissions Diagram The above flow chart illustrates the process Checkbox uses to evaluate permissions. From the diagram, the following key points about access control become clear: - An ACL policy cannot grant permission to a user who is not in a role that also grants the corresponding permission Checkbox 5.0 Permissions Guide - 11
- An ACL policy can deny permission to a user even if they normally have that permission (i.e. the user is in a role that has that permission and the default policy has been configured to grant access) - An ACL policy for a user or group can deny permission to that user or group even if the default policy grants that permission to every other user How to add users and user groups to a survey ACL After creating a survey you may want to grant other Checkbox users permission to view or edit your survey. This can be accomplished through the following steps: 1. From the Permissions Editor select the Advanced Security Settings Tab 2. Select Add Users/Groups to Access List Checkbox 5.0 Permissions Guide - 12
3. From the left pane, locate the user/group by using the Filter List field or by scrolling through the available list of users/groups 4. Add desired users/groups to access list by moving them into the right pane using the white arrow icons How to add users and user groups to a user group ACL By default only System Administrators are permitted to view other users groups in Checkbox. If you wish to grant a user or group of users the ability to view other Checkbox user groups you will need to add members to the ACL. Checkbox allows you to edit the permissions and add user(s) to the ACL (Access Control List) of any user group in your installation. Once you have added the desired user(s) to your user group ACL, you can configure the ACL of that user group to allow said user(s) the ability to edit, view or administer the group. Use the following steps to add a new user to the ACL of the Test Group user group: 1. Select Users from main Checkbox menu 2. Checkbox defaults to displaying the list of individual users. To view user groups, select User Groups from the Manage drop-down 3. Select desired user group (i.e. 'Test Group') 4. Select the 'Security' button from the user group dashboard to open the ACL for that group Checkbox 5.0 Permissions Guide - 13
Once you select 'Security' you are brought to the User ACL (Access Control List). From here you can view/change permissions of existing ACL users, change the default policy for users not on the ACL, and add new users/groups to the ACL. From the User ACL Access List tab you can see that there is currently only one entity, 'admin' in the 'Test Group' ACL. Checkbox 5.0 Permissions Guide - 14
Follow the steps below to add new users to the this group ACL: 1. Select the Add Users/Groups to Access List tab to add additional entities to this user group ACL 2. Add desired users/groups to the Users/Groups Added to Access List pane on the right-hand side using the white arrows Checkbox 5.0 Permissions Guide - 15
Select the Access List tab to view your updated User ACL. 1. To change individual ACL user permissions, select the white arrow to the left of the desired entity to view/change Current Permissions in the left pane 2. Select the Save button to save your changes Checkbox 5.0 Permissions Guide - 16
How to add users and user groups to a report ACL By default only System Administrators are permitted to view other reports in Checkbox. If you wish to grant a user or group of users access to a Checkbox report you will need to add members to the ACL (Access Control List). Make sure the user(s) you add has a 'Report Viewer' or 'Report Administrator' user role (configured in user's profile). Checkbox allows you to edit the permissions and add user(s) to the ACL of any individual report. Once you have added the desired user(s) to your report ACL, you can configure the ACL of that report to allow said user(s) the ability to edit, view or administer the report. Use the following steps to access a report ACL (make sure you are logged in as a Report Administrator or System Administrator): 1. Select a survey from the Survey Manager 2. Select the 'View All' button from the Reports menu in your survey dashboard to view a list of all available reports 3. Select a report, then select the 'Permissions' button from the report dashboard to open the ACL Editor Checkbox 5.0 Permissions Guide - 17
Once 'Permissions' is selected the report ACL will pop up. Follow the steps below to add a user and/or group of users to a report ACL: 1. Move to the 'Add Users/Groups to Access List' tab and move desired user group from the ' Users/Groups Available to Add to Access List' (left) to 'Users/Groups Added to Access List' (right) using the white arrows. 2. Once desired users have been added, move back to the 'Access List' tab. 3. To configure the permissions of your new ACL member, select the white arrow to the left of the user/group. Current permissions for that user/group should appear under 'Current Permissions' (left). Check off desired permissions and select Save Changes. Checkbox 5.0 Permissions Guide - 18
How to configure permissions of a folder to allow non-acl access Every survey folder within Checkbox contains its own access control list (ACL). The creator of the folder or a system administrator will need to grant access to the folder for other users. Note: Permissions of a folder DO NOT propagate down to survey listed inside a folder Use the the following steps to change the default permissions of a folder: 1. Log into Checkbox as an Administrator of your folder and open the folder you wish to edit permissions for 2. Select the Security option Checkbox 5.0 Permissions Guide - 19
Once you select 'Security' you are brought to the Folder ACL (Access Control List). From here you can view/change permissions of existing ACL entities, change the default policy for users not on the ACL, and add new users/groups to the ACL. 1. Select the Default Policy tab to set permissions for users who are not expressly on the permission list 2. To grant non-acl access to this folder, select one or more of the default permissions options 3. Select the Save button to save your changes Key Checkbox 5.0 Permissions Guide - 20
Permissions Review After reviewing this How to Guide the following major points should be easier to understand: - Checkbox allows you to set permissions on Surveys, Reports, User Groups and Email Lists. - Checkbox allows you to set different access roles for individual users within Checkbox. - Being assigned a role does not in of itself grant a user access to a Checkbox entity. Being a member of a role simply controls which permission can be granted to a given user. - Permissions can be set on a survey in three different places(survey Security, Access Control List and Default Policy within the Access Control List). - The System Administrator has rights over all entities of Checkbox and does not need to be configured on any ACL or security page. When testing surveys for your respondents DO NOT use the System Administrator account since permissions will be superseded and you will not have a proper representation of how your survey will behave. - If you configure the permissions of your survey correctly but a user still can t view/edit it then double check your Folder permissions to confirm you have set those permissions as well. Checkbox 5.0 Permissions Guide - 21