Resource permissions

The Resource Permissions page (route /resource-permissions-admin) grants access levels on resources, such as shares and generic TCP services used for SSH or database access.

Purpose

For a resource such as a share, a desktop, or a network service, permissions are access levels such as read/write, read-only, or owner. This page is the matrix that decides who may access each resource and at what level. Each row is an identity (a user, group, or service account), and the Permissions column holds chips in the form ():, for example pfsense-web-local-service-0(network):owner.

Why use it

Grant precisely the level of access each resource should allow.
See at a glance which identities can reach which resources and how.
Grant access to a whole resource group in one entry, so the group’s resources all receive the same level.
Combine with labels so policies can restrict access further (see Policies and permissions).

When to use it

When you expose a share, desktop, database, network, or other resource (see Resources overview).
When a user or group needs a specific access level on a resource.
During onboarding, to give a new person the resources they need.

Prerequisite: permission to administer permissions (an owner or administrator role).

How to use it

Open Access > Resource Permissions from the left navigation.
Review the table. Each row shows the identity and the permission chips assigned to it.

Adding a permission

Select ADD RESOURCE PERMISSION. A new row appears with an identity field.
Start typing in the identity field and select the user, group, or service account from the autocomplete.
Click into the Permissions column. A two-step autocomplete opens: first select the resource by name (suffixed with its type in brackets), then select the role.

Repeat to add more permissions. Each one appears as a chip.

Click outside the row to save. The permissions apply asynchronously. Remove a chip by selecting its remove icon, or tick the row and use DELETE RESOURCE PERMISSIONS to remove the identity and all its resource permissions.

Advanced configuration

Select the more menu on a row and choose Configure Permissions to open the transfer-list dialog for the identity’s permissions. It shows available and current permissions, with the same resource-then-role selection for adding entries.

Fields and controls reference

Control	Purpose	Required	Default	Valid values	Notes
Identity	The user, group, or service account being granted access	Yes	n/a	Any identity in the organisation	Autocomplete
Permissions	The resource access levels granted to the identity	No	None	Chips in `():` form	Uses the two-step resource and role selector
ADD RESOURCE PERMISSION	Adds a new editable row	n/a	n/a	n/a
DELETE RESOURCE PERMISSIONS	Removes the selected rows and their permissions	n/a	n/a	n/a	Bulk action on ticked rows

Dialogs and popups

Configure Permissions: the transfer-list dialog for editing an identity’s resource permissions.
Confirmation dialogs: deleting permissions confirms before acting.

Configuration versus diagnostics versus confirmation

Configuration: resource access levels per identity. Permission entries are written when the row saves.
Diagnostics: none on this screen; access decisions are recorded in Audits.
Confirmation: deleting a permission removes the identity’s access to that resource. Removing an identity row removes all of its resource permissions.

Pagination and async behaviour

The table pages at 25 rows per page. The Configure Permissions dialog pages at 10 rows per page.
Permission changes apply asynchronously. After adding or removing a permission, wait a few seconds and reload to confirm. Access changes propagate to the identity-aware proxy shortly after.

Troubleshooting

A resource is not offered in the selector: applications must define roles to appear; other resource types appear by name and type. Search for the resource by name.
A permission has no effect: confirm the identity is correct and the resource is the right one, then wait for the asynchronous update. If the resource belongs to a resource group, check the group’s permissions too.
The role list is empty for an application: the application has not defined any roles. Add roles on the application’s configuration (see Resources: applications).