.. _user-onboarding:

User Onboarding
===============

.. seealso::
    `Click here to apply for an SRCP Request User Access. <https://www.hpc.cam.ac.uk/srcp-request-user-access>`_

Requesting Access Process
**************************

This section describes how a new user requests access through `SRCP Request User Access <https://www.hpc.cam.ac.uk/srcp-request-user-access>`_ form, and is added to an SRCP Platform.

.. note::

    Although SRCPS is a generally advertised service, there is no general/free
    version of the service therefore it is expected that users will already know
    whether they should have access, or are entitled to, access to a particular
    part of the SRCPS and this process is not for speculative requests.


To gain access to an SRCP Platform a new user has to :ref:`read and accept policies governing the service <isms_docs>` by completing the `SRCP Request User Access <https://www.hpc.cam.ac.uk/srcp-request-user-access>`_. Using a `Raven <https://raven.cam.ac.uk/help/accounts.html>`_ authenticated session they need to identify the Platform's and after submitting an access request the SRCP Authorised Role will be contacted via email to confirm the application. Only then the user is added to the platform.

SRCP Authorised Roles
*********************

The SRCP has hierarchical role structure for purpose of managing access to different levels of SRCP account also known as tenancy.

::

  Account
  ├ Role:Client
  └── Platform
      ├ Role:Manager
      ├ Role:User
      ├ Role:Data Transfer User
      └── Project
          ├ Role:Manager
          └ Role:User

**Account Client:** An individual responsible for governance of access to SRCP platform. Takes overall responsibility for the specific SRCP account.
This individual does not have access to the platform unless they also nominate themselves as a Platform Manager.

**Platform Manager:** An individual with delegated responsibility for the platform. This role can be assigned by the Account Client.
These individuals will approve user access requests, as well as handle all data import and export tasks. They will have access to all projects.

**Platform User:** An individual with access to the Platform's default project. This role can be authorised by the Account Client or Platform Manager.

**Data Transfer User:** An individual with access only to upload and download data. This role can be authorised by the Account Client or Platform Manager.
These users have no association with projects as the upload/download area is not project-specific.

**Optional Projects**

By default a platform will have a default project "Shared" which all users have access to. Further projects can be created each with their own groups for access rules, quota and compute resources.

**Project Manager:** An individual with delegated responsibility for a project within the platform. This role can be assigned by the Account Client or Platform Manager.
These individuals will approve adding existing Platform Users to their project.

**Project User:** An individual with access to the Platform's project. This role can be authorised by the Account Client, Platform Manager or Project Manager.


.. note::

    Some of the roles may not be relevant for particular type of SRCP Platform.
    For example REDCap has no notion of the "Project" part of the hierarchy.

User Offboarding
================

To remove a user from a platform, please send an email to support@hpc.cam.ac.uk
requesting for the user to be removed from the platform, stating the username
and Platform ID. The service desk agent will confirm that the person making the
request is a platform manager for the platform in question and then remove them
from the platform users group, as well as check and terminate any active
sessions.