Security and Permissions
SharePoint manages document access. Your deployment administrators manage HTTPS, the container host, the reverse proxy, and Redis.
Document permissions
Section titled “Document permissions”Give users the SharePoint permissions needed for their work:
| Access | Expected experience |
|---|---|
| View | Open and read a document. |
| Edit | Open, change, and save a document. |
| No access | The document cannot be opened. |
Check these roles with separate accounts after connecting SharePoint. When a user’s access changes, check that the new permissions apply to document access and saving. See SharePoint permission checks.
HTTPS connections
Section titled “HTTPS connections”Use an HTTPS certificate that matches the BoldDocServer hostname and is trusted by SharePoint and users’ browsers. Restrict access to the certificate’s private key.
With a reverse proxy, allow access to the application’s private port only from the proxy and authorized internal systems. If the proxy connects over HTTPS, it must trust the application’s certificate. Accept forwarded host and protocol headers only from configured proxies.
See Deploy BoldDocServer for HTTPS and proxy setup.
Credentials and access tokens
Section titled “Credentials and access tokens”Keep the license key, Redis password, registry credentials, private keys, and WOPI access tokens private. Access tokens authorize document requests and should be handled as credentials.
- Restrict access to
docker-compose.yamlafter entering your license key and connection string. - Keep credential files out of source control, or supply values through your deployment platform’s secret store.
- Remove credentials, tokens, and document content from logs and screenshots before sharing them for support.
Redis and network access
Section titled “Redis and network access”Keep Redis on a private network and allow access only from BoldDocServer and authorized administrators. Use the authentication and encrypted connections provided by your Redis service.
Expose only the public HTTPS endpoint needed by browsers and SharePoint. See Deployment Prerequisites for the connection list.
Host maintenance and logs
Section titled “Host maintenance and logs”Restrict administrative access to the container host and Docker runtime. Keep BoldDocServer, the host, and proxy software updated through your organization’s maintenance process.
Limit access to application and proxy logs. Store them according to your organization’s retention policy, and avoid recording tokens, passwords, license keys, or confidential document content.
See Lifecycle management for application update commands and Collect logs for support for diagnostic details.