Permissions needed for common tasks

To access the K2 Management site you need Admin or Export rights. With Admin rights, you see all nodes within K2 Management. With Export (deploy) rights you see limited nodes within K2 Management

To set this in K2 Management, go to the Workflow Server node, then select the Server Rights node and assign Admin or Export rights to the user.

For more information on how to set permissions, see the Server Rights topic.

To access K2 Management you need Admin or Export rights. With Admin rights you see all nodes within K2 Management. With Export rights, you see limited nodes within K2 Management

To set this in K2 Management, go to the Workflow Server node, then select theServer Rights node and assign Admin or Export rights to the user.

For more information on how to set permissions, see the Server Rights topic.

By default, all users see their Workspace and custom Workspaces.

For more information on Workspace, see the K2 Workspace topic.

To access K2 Designer you need View rights. To set this in K2 Management, go to the Designer node and assign View rights to the user.

For more information on configuration, see the Designer topic.

To access K2 Workflow Designer you need Export rights. To set this in K2 Management, go to the Workflow node, and then Server Rights and assign Export (deploy) rights to the user.

For more information on how to set the permission, see the Server Rights topic.

To install an app from the App Catalog, you need Export rights. To set this in K2 Management, go to the Workflow Server node, and then Server Rights, and assign Export rights to the user.

For more information on how to set the permission, see the Server Rights topic.

You also need to be a member of the Package and Deployment role. To set this in K2 Management, go to the Users node, and then Roles, and select Package and Deployment. Click Edit and add a user to the role

To access the App Administration page you need to be added to the Administrators list by your system administrator. From the App page, select the Admin option in the Build section. Then select the Security area and add the user name to the Administrators List.

For more information on administering your Apps, see the Administer Apps topic.

To deploy, edit or save a workflow, you need Export rights. To set this in K2 Management, go to the Workflow Server node, and then Server Rights, and assign Export rights to the user.

For more information on how to set the permission, see the Server Rights topic.

To run reports from K2 Management or Workspace, you need View or View Participate rights. To set this in K2 Management, go to the Workflow Server node, and then Workflows and then find and select the workflow. Click Rights and then assign View or View Participate rights to the user.

For more information on how to run reports from K2 Management, see the Reports topic.

For more information on how to run reports from Workspace, see the Reports topic.

To package and deploy K2 solutions you need Export rights. To set this in K2 Management, go to the Workflow Server node, and then Server Rights, and assign Export rights to the user.

For more information on Package and Deployment permissions, see the Package and Deploy Considerations topic.

To package and deploy K2 solutions you need to be a member of the Package and Deployment role. To set this in K2 Management, go to the Users node, and then Roles, and select Package and Deployment. Click Edit and add a user to the role.

For more information Roles see the Authorization Framework Overview topic.

For more information on Package and Deployment permissions, see the Package and Deploy Considerations topic.

To package and deploy K2 Solutions you need View right to all K2 objects. The Package and Deployment role grants its members global view rights, however, membership in this role does not override any Deny rights. If you have View rights denied to any item in the category system, you are prompted to update permissions to View the item or items.

To set this in K2 Management, go to Categories and select the K2 object. In the Security section, add the user and set View rights to Allow. This ensures that when dependencies are checked, Package and Deployment knows whether items exist (and need to be updated) or do not exist (need to be created).

For more information on permissions on K2 objects, see the K2 Objects section in the Authorization Framework Overview topic.

To grant rights you need to be a member of the Security Administrators role. To set this in K2 Management, go to the Users node, and then Roles, and select Security Administrators. Click Edit and add a user to the role.

For more information on roles, see the Roles section in the Authorization Framework Overview topic.

To modify and delete custom roles you need Modify and Delete rights. To set this in K2 Management, go to the Users node, and then Roles, and select the role. Click the Security button and add a user to the role.

Security Administrators have Security rights by default for all legacy and new custom roles (except system roles). Users that create their own roles are automatically granted Security rights on those roles.

For more information on roles, see the Roles section in the Authorization Framework Overview topic.

No error message shows. If you do not have security rights to a role, the Security button is disabled.

If you decide to deny Modify and Delete rights to someone's role the following messages show:

• User was not granted permissions to modify the role. Error: "K2:[domain]\[username] cannot perform Modify on custom role."
  
• User was not granted permission to delete the role. Error: "K2:[domain]\[username] cannot perform Delete on custom role."
  

To browse to K2 objects using the category tree in K2 Designer or K2 Management, you need View rights. To set this in K2 Management, go to the Categories node and select the K2 object. In the Security section add the user and set the View rights to Allow.

For more information on permissions on K2 Objects, see the K2 Objects section in the Authorization Framework Overview topic.

To interact with forms and run them, you need Execute rights. To set this in K2 Management, go to the Categories node and select the form. In the Security, section add the user and set the Execute rights to Allow.

For more information on permissions on K2 Objects, see the K2 Objects section in the Authorization Framework Overview topic.

To add, register and deploy the K2 for SharePoint App you need the following permissions:

• Global Admin (also known as the Tenant Admin)
• Site Collection Admin for the App Catalog site

• SharePoint Online Administrator or Site Collection Administrator for each site collection where the app is deployed to

To add a K2 web part in SharePoint you need the following permissions:

• App Catalog: Read

• SharePoint site: Edit Permission level and Add and Customize Pages

To create and deploy applications you need to configure the following:

K2 Permissions: Assign K2 Designer Edit rights in K2 Management site > Designer.

SharePoint Permissions:

• App Catalog: Read
• SharePoint site: Edit
• SharePoint site: K2 Solution Designers

To Start and View a workflow you need to configure the following:

In K2 Management, go to the Workflow Server node, and then Workflow, and select the workflow. Select Rights and assign Start and View rights to the user.

In SharePoint:

• App Catalog: Read

• SharePoint site: Read
• SharePoint site go to K2 Solution Participants Group: Read

• SharePoint lists and libraries: Read and Edit permissions for users as required by the functions performed by the application on the SharePoint Lists and Libraries

To share K2 applications with external users you need to configure the following SharePoint permissions:

• Permission based on Site Collection Group membership
• Global Admin required to enable sharing on the App Catalog

To administer K2 for SharePoint app you need to configure the following:

K2 Permissions: Admin

SharePoint Permissions: Global Admin

To read data from Azure Active Directory the K2 for AAD app is granted Read on configuration of the app by a Global Tenant administrator

To write data to Azure Active Directory, the K2 for AAD Management app needs Write permissions granted on configuration of the app by a Global Tenant administrator