ownCloud Roles


ownCloud provides several roles a user can have. This description gives an overview of these roles.

User Request for Changing a Role

Users can request a change of their current role under User Name  Settings  Personal  General  Account. When clicking the button Request new role, the new role can be entered and an email will be sent to the admin group for further processing.


  • Is not a regular user.

  • Has access to specific content made available via public links.

    • Can be password-protected (optional, enforced, policy-enforced).

    • Can have an expiration date (optional, enforced, enforced dependent on password).

  • Has no personal space

  • Has no file ownership (ownership of uploaded/created files is directed to sharer).

  • Has no use of clients.

  • Quota is that of the sharer.

  • Permissions are those granted by the sharer for specific content, e.g., view-only, edit, and File Drop.

  • Can only use file and viewer apps, such as PDF Viewer and Collabora Online.


  • The Guests app is available on the ownCloud Marketplace. You must install and enable it first.

  • Is a regular user with restricted permissions, identified via e-mail address.

  • Has no personal space.

  • Has no file ownership (ownership of uploaded/created files is directed to sharer).

  • Has access to shared space. The permissions are granted by the sharer.

  • Is not bound to the inviting user.

    • Can log in as long as shares are available.

    • Becomes deactivated when no shares are left; this is the shared with guests filter.

    • Reactivated when a share is received.

    • Administrators will be able to automate user cleanup ("disabled for x days").

  • Can use all clients.

  • Fully auditable in the enterprise edition.

  • Can be promoted to group administrator or administrator, but will still have no personal space.

  • Apps are specified by the admin (whitelist).

The Shared with Guests Filter

This filter makes it easy for sharers to view and remove their shares with a guest, which also removes their responsibility for guests. When all of a guest’s shares are removed, the guest is then disabled and can no longer login.

Standard User

  • Is a regular user (from LDAP, ownCloud user backend, or another backend).

  • Has personal space. Permissions are granted by the administrator.

  • Shared space: Permissions as granted by sharer.

  • Apps: All enabled, might be restricted by group membership.

Federated User

  • Is not an internal user.

  • Can trust a federated system.

  • Has access to shared space through users on the considered ownCloud system.

  • Can share data with the considered system (accept-/rejectable).

ownCloud Group Administrator

  • Is a regular user, such as from LDAP, an ownCloud user backend, or another backend.

  • Can manage users in their groups, such as adding and removing them, and changing quota of users in the group.

  • Can add new users to their groups and can manage guests.

  • Can enable and disable users.

  • Can impersonate users in their groups.

  • Custom group creation may be restricted to group admins.

ownCloud Administrator

  • Is a regular user (from LDAP, ownCloud user backend, or another backend).

  • Can configure ownCloud features via the UI, such as sharing settings, app-specific configurations, and external storages for users.

  • Can manage users, such as adding and removing, enabling and disabling, quota and group management.

  • Can restrict app usage to groups, where applicable.

  • Configurable access to log files.

  • Mounting of external shares and local shares (of external filesystems) is disabled by default.

System Administrator

  • Is not an ownCloud user.

  • Has access to ownCloud code (e.g., config.php and apps folders) and command-line tool (occ occ).

  • Configures and maintains the ownCloud environment (PHP, Webserver, DB, Storage, Redis, Firewall, Cron, and LDAP, etc.).

  • Maintains ownCloud, such as updates, backups, and installs extensions.

  • Can manage users and groups, such as via occ.

  • Has access to the master key when storage encryption is used.

  • Storage admin: Encryption at rest, which prevents the storage administrator from having access to data stored in ownCloud.

  • DB admin: Calendar/Contacts etc. DB entries not encrypted.


  • Is not an ownCloud user.

  • Conducts usage and compliance audits in enterprise scenarios.

  • App logs (especially Auditlog) can be separated from ownCloud log. This separates the Auditor and Sysadmin roles. An audit.log file can be enabled, which the Sysadmin can’t access.

  • Best practice: parse separated log to an external analyzing tool.