Security overview¶

DMS security combines authentication, ACL permissions, visibility rules, encrypted storage, and auditing.

Authentication¶

DMS supports:

local usernames and passwords;
LDAP or Active Directory;
OIDC providers;
TOTP two-factor authentication.

SAML is present only as a scaffold and is not functional. Use local, LDAP/AD, or OIDC.

Authorization¶

Access is enforced at several layers:

ACL — resource:action allow/deny entries for users and groups.
Sharing rules — conditional visibility.
Case-level access — restrictions on a case and its documents.
Restricted repositories — repositories hidden without explicit permission.
Internal taxonomy — system repositories and groups hidden from configuration.
Upload restrictions — what a user may upload or reclassify.
Confidential and hidden metadata — field-level visibility.

Sessions and browser security¶

The web UI uses server-side sessions, CSRF protection, and a Content Security Policy with nonces. Embedded BPM sessions can be read-only.

Encryption¶

Passwords are hashed, sensitive fields can be encrypted at rest, and API and integration secrets are stored as configuration. See Encryption and sessions.

Audit¶

DMS keeps a temporal audit log and publishes events to the shared audit service. The temporal log is not a permanent compliance archive. See Audit and retention.