Making progress! I found a link in the console that explained attaching
roles to pipelines which works, but I'd like to be able to say that I want
a user to have permissions on a pipeline group through a role, but I only
want them to run pipelines with TEST in the name and not and PROD
pipelines. In the role I've tried adding deny to administer * * but the
role permission on the pipeline group doesn't get modified.
Is this just a fringe case we've put ourselves into and its not possible to
manage things in this way? We've been using pipeline groups to contain all
pipelines using a particular template type so PROD and TEST both are in the
same pipeline group. If this isn't possible we can probably just split our
groups out into 2x with a prod and dev/test group separately.
I'm just confused on what I can and can't do with roles since its not a
centrally managed feature but the roles can be reused for membership.
Thanks!
On Tuesday, March 21, 2023 at 10:29:01 AM UTC-5 Funkycybermonk wrote:
> Hello!
>
> I'm sure I'm missing something simple, but I'm trying to lock down access
> to certain tasks. We'll have some temporary users accessing our system and
> I want to control what they can and can't do. I get the whole allow/deny
> and I'm hoping that the View/Administer will be flexible enough to let me
> limit what users can do to pipelines, but my initial test goal is to have a
> working permissions set that does anything with pipelines.
>
> when I set a system administrator everyone gets their permissions dropped
> as expected. But once I start adding them to a role containing a policy
> that says for example Allow - Administer - Environments - *, I get the
> ability as that user to see all environments but I can't see pipelines in
> those environments.
>
> Setting Allow - Administer - All - * also doesn't let me see pipelines.
>
> How can I use roles/policies to give users permissions to basic items in
> the system such as: I want a user to be able to run pipelines containing a
> certain wildcarded name filter or I want them to be able to view all but
> only execute certain environments, say only pipelines assigned in the
> environment labeled TEST.
>
> The documentation doesn't give specific cases that are helpful in this
> case. For example it says that Admnister on UI gives list, create, update,
> delete, agent status and elastic profiles usage but the closes I can see in
> the policy is the allow administer * * which doesn't let my user see any
> pipelines.
>
> I'm running 22.3 with LDAP as my authentication provider if that
> helps/affects anything.
>
> Any tips on how to get permissions set up to filter what can and can't be
> accessed by non-systemadmins?
>
> Thanks!
>
--
You received this message because you are subscribed to the Google Groups
"go-cd" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to go-cd+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/go-cd/4dbc8c4f-ad7e-444e-9113-f85c358b87den%40googlegroups.com.
