Wiki source code of Users and roles
Last modified by Boris Folgmann on 2025/07/09 15:46
Show last authors
author | version | line-number | content |
---|---|---|---|
1 | {{toc depth="1"/}} | ||
2 | |||
3 | = Role Model = | ||
4 | |||
5 | Each user who is a member of a project has to be in //exactly one// Project Role. Therefore it is not possible to have no or multiple roles in a project. | ||
6 | |||
7 | Different roles have different sets of permissions. Possible roles are: | ||
8 | |||
9 | |=(% style="text-align: left;" %)((( | ||
10 | Role | ||
11 | )))|=(% style="text-align: left;" %)((( | ||
12 | Decription | ||
13 | ))) | ||
14 | |(% style="text-align:left" %)((( | ||
15 | Admin | ||
16 | )))|(% style="text-align:left" %)((( | ||
17 | (% class="content-wrapper" %) | ||
18 | ((( | ||
19 | Full access, even to potentially dangerous operations like User and Project Provisioning. Can administer Project Members and Roles. | ||
20 | ))) | ||
21 | ))) | ||
22 | |(% style="text-align:left" %)((( | ||
23 | Master | ||
24 | )))|(% style="text-align:left" %)((( | ||
25 | Limited full access to avoid accidental data loss or other unrevertable changes. | ||
26 | ))) | ||
27 | |(% style="text-align:left" %)((( | ||
28 | Developer | ||
29 | )))|(% style="text-align:left" %)((( | ||
30 | Read-write access to contribute to the Project | ||
31 | ))) | ||
32 | |(% style="text-align:left" %)((( | ||
33 | Viewer | ||
34 | )))|(% style="text-align:left" %)((( | ||
35 | Read-only access to all not security-relevant data in the Project | ||
36 | ))) | ||
37 | |||
38 | Currently, the role assignment is applied for all tools within one project. | ||
39 | |||
40 | {{info}} | ||
41 | Note: | ||
42 | To ensure the integrity of the applications in the context of the managed service, no customer user is allowed to get system admin permissions for the tools. The maximum permissions for a customer user is the "Project Admin" role as described here | ||
43 | {{/info}} | ||
44 | |||
45 | = User Permissions in SDPortal = | ||
46 | |||
47 | (% class="relative-table" style="width:93.9554%" %) | ||
48 | (% class="active" %)|=((( | ||
49 | Role Type | ||
50 | )))|=(% colspan="2" style="text-align: left;" %)((( | ||
51 | (% style="text-align: center;" %) | ||
52 | Global Role | ||
53 | )))|=(% colspan="4" style="text-align: center;" %)((( | ||
54 | Project Role | ||
55 | ))) | ||
56 | (% class="active" %)|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" %)((( | ||
57 | **Role Name** | ||
58 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
59 | **User** | ||
60 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
61 | **Admin** | ||
62 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
63 | **Viewer** | ||
64 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
65 | **Developer** | ||
66 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
67 | **Master** | ||
68 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
69 | **Admin** | ||
70 | ))) | ||
71 | |Login to SDPortal|✅|✅|✅|✅|✅|✅ | ||
72 | |Logout from SDPortal|✅|✅|✅|✅|✅|✅ | ||
73 | |Change my password|✅|✅|✅|✅|✅|✅ | ||
74 | |Reset forgotten password|✅|✅|✅|✅|✅|✅ | ||
75 | |Display list of users|✅|✅|✅|✅|✅|✅ | ||
76 | |Search for user |✅|✅|✅|✅|✅|✅ | ||
77 | |Add or remove "Corporate Admin" role to user |❌|✅|❌|❌|❌|❌ | ||
78 | |Create User|❌|✅|❌|❌|❌|❌ | ||
79 | |Delete User|❌|✅|❌|❌|❌|❌ | ||
80 | |Lock User|❌|✅|❌|❌|❌|❌ | ||
81 | |Unlock User|❌|✅|❌|❌|❌|❌ | ||
82 | |Send invitation mail for first login|❌|✅|❌|❌|❌|❌ | ||
83 | |Display list of projects |❌|✅|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects | ||
84 | |Search for project |❌|✅|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects | ||
85 | |Create project |❌|✅|❌|❌|❌|❌ | ||
86 | |Delete project|❌|✅|❌|❌|❌|❌ | ||
87 | |Retire project |❌|✅|❌|❌|❌|⚠ Only his projects | ||
88 | |Reactivate project|❌|✅|❌|❌|❌|⚠ Only his projects | ||
89 | |Add User to Project|❌|✅|❌|❌|❌|⚠ Only his projects | ||
90 | |Remove User from Project|❌|✅|❌|❌|❌|⚠ Only his projects | ||
91 | |Display used storage by project/tool or total|❌|✅|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects | ||
92 | |||
93 | = JIRA Project Roles / Permission Scheme = | ||
94 | |||
95 | In JIRA the Project Roles are first added to Security / Project Roles and then they get their Permissions assigned in the SDCloud Permission Scheme which has to associated later with the Jira Projects. | ||
96 | |||
97 | (% class="responsive-table" %) | ||
98 | (% class="active" %)|=(% style="text-align: left;" %)((( | ||
99 | Permission / Role | ||
100 | )))|=(% style="text-align: left;" %)((( | ||
101 | Admin | ||
102 | )))|=(% style="text-align: left;" %)((( | ||
103 | Master | ||
104 | )))|=(% style="text-align: left;" %)((( | ||
105 | Developer | ||
106 | )))|=(% style="text-align: left;" %)((( | ||
107 | Viewer | ||
108 | ))) | ||
109 | (% class="active" %)|=(% colspan="1" style="text-align: left;" %)((( | ||
110 | Project Permissions | ||
111 | )))|(% class="highlight-#f4f5f7" colspan="1" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
112 | |||
113 | )))|(% class="highlight-#f4f5f7" colspan="1" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
114 | |||
115 | )))|(% class="highlight-#f4f5f7" colspan="1" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
116 | |||
117 | )))|(% class="highlight-#f4f5f7" colspan="1" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
118 | |||
119 | ))) | ||
120 | |Administer projects | ||
121 | Enabled Extended project administration|✅|❌|❌|❌ | ||
122 | |Browse projects|✅|✅|✅|✅ | ||
123 | |Manage sprints|✅|✅|❌|❌ | ||
124 | |Service Desk Agent|✅|✅|✅|❌ | ||
125 | |View development tool|✅|✅|✅|✅ | ||
126 | |View (read-only) workflow|✅|✅|✅|✅ | ||
127 | (% class="active" %)|=Issue Permissions| | | | | ||
128 | |Assign issues|✅|✅|✅|❌ | ||
129 | |Assignable user|✅|✅|✅|❌ | ||
130 | |Close issues|✅|✅|❌|❌ | ||
131 | |Create issues|✅|✅|✅|❌ | ||
132 | |Delete issues|✅|❌|❌|❌ | ||
133 | |Edit issues|✅|✅|✅|❌ | ||
134 | |Link issues|✅|✅|✅|❌ | ||
135 | |Modify reporter|✅|✅|❌|❌ | ||
136 | |Move issues|✅|✅|❌|❌ | ||
137 | |Resolve issues|✅|✅|✅|❌ | ||
138 | |Schedule issues|✅|✅|❌|❌ | ||
139 | |Set issues security|✅|❌|❌|❌ | ||
140 | |Transition issues|✅|✅|✅|❌ | ||
141 | (% class="active" %)|=(% colspan="1" %)Voters & watchers permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) | ||
142 | |Manage watcher list|✅|❌|❌|❌ | ||
143 | |View voters and watchers|✅|✅|✅|❌ | ||
144 | (% class="active" %)|=(% colspan="1" %)Comments permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) | ||
145 | |Add comments|✅|✅|✅|❌ | ||
146 | |Delete all comments|✅|❌|❌|❌ | ||
147 | |Delete own comments|✅|✅|✅|❌ | ||
148 | |Edit all comments|✅|❌|❌|❌ | ||
149 | |Edit own comments|✅|✅|✅|❌ | ||
150 | (% class="active" %)|=(% colspan="1" %)Attachments permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) | ||
151 | |Create attachments|✅|✅|✅|❌ | ||
152 | |Delete all attachments|✅|❌|❌|❌ | ||
153 | |Delete own attachments|✅|✅|✅|❌ | ||
154 | (% class="active" %)|=(% colspan="1" %)Time-tracking Permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) | ||
155 | |Work on issues|✅|✅|✅|❌ | ||
156 | |Delete all worklogs|✅|❌|❌|❌ | ||
157 | |Delete own worklogs|✅|✅|✅|❌ | ||
158 | |Edit all worklogs|✅|❌|❌|❌ | ||
159 | |Edit own worklogs|✅|✅|✅|❌ | ||
160 | |||
161 | * Service Desk Agent is only available if the software was added to JIRA | ||
162 | |||
163 | = Confluence Project Roles = | ||
164 | |||
165 | See vendor documentation for the exact meaning: [[https:~~/~~/confluence.atlassian.com/doc/space-permissions-overview-139521.html>>url:https://confluence.atlassian.com/doc/space-permissions-overview-139521.html||rel="nofollow" shape="rect" style="text-decoration: none;" class="external-link"]]. | ||
166 | |||
167 | (% class="active" %)|=(% style="text-align: center;" %)((( | ||
168 | Space | ||
169 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
170 | All | ||
171 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
172 | Pages | ||
173 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
174 | Blog | ||
175 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
176 | Attachments | ||
177 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
178 | Comments | ||
179 | )))|=(% style="text-align: center;" %)((( | ||
180 | Restrictions | ||
181 | )))|=(% style="text-align: center;" %)((( | ||
182 | |||
183 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
184 | Space | ||
185 | ))) | ||
186 | |=(% colspan="1" %)Role/Operation|(% colspan="1" %)View|(% colspan="1" %)Delete Own|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add/Delete|(% colspan="1" %)Delete|(% colspan="1" %)Export|(% colspan="1" %)Admin | ||
187 | |=Admin|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅ | ||
188 | |=Master|✅|✅|✅|❌|✅|❌|✅|❌|✅|✅|✅|❌|✅|❌ | ||
189 | |=Developer|✅|✅|✅|❌|❌|❌|✅|❌|✅|❌|❌|❌|❌|❌ | ||
190 | |=Viewer|✅|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌ | ||
191 | |||
192 | = Bitbucket Project Roles = | ||
193 | |||
194 | (% class="active" %)|=(% style="text-align: left;" %)((( | ||
195 | |||
196 | )))|=(% style="text-align: left;" %)((( | ||
197 | (% style="color:#333333" %)Browse | ||
198 | )))|=(% style="text-align: left;" %)((( | ||
199 | (% style="color:#333333" %)Clone / Pull | ||
200 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
201 | (% style="color:#333333" %)Create, browse, comment on pull request | ||
202 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
203 | (% style="color:#333333" %)Merge pull request | ||
204 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
205 | (% style="color:#333333" %)Push | ||
206 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
207 | (% style="color:#333333" %)Create repositories | ||
208 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
209 | (% style="color:#333333" %)Edit settings / permissions | ||
210 | ))) | ||
211 | |Admin|✅|✅|✅|✅|✅|✅|✅ | ||
212 | |Master|✅|✅|✅|✅|✅|❌|❌ | ||
213 | |Developer|✅|✅|✅|✅|✅|❌|❌ | ||
214 | |Viewer|✅|✅|✅|❌|❌|❌|❌ | ||
215 | |||
216 | //Repository permissions are inherited from project permissions.// | ||
217 | |||
218 | = Jenkins Project Roles = | ||
219 | |||
220 | (% class="relative-table" style="width:1413.0px" %) | ||
221 | (% class="active" %)|=(% colspan="1" style="text-align: left;" %)((( | ||
222 | Permission | ||
223 | )))|=(% style="text-align: left;" %)((( | ||
224 | Role | ||
225 | )))|=(% style="text-align: left;" %)((( | ||
226 | Admin | ||
227 | )))|=(% style="text-align: left;" %)((( | ||
228 | Master | ||
229 | )))|=(% style="text-align: left;" %)((( | ||
230 | Developer | ||
231 | )))|=(% style="text-align: left;" %)((( | ||
232 | Viewer | ||
233 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
234 | Authenticated Users | ||
235 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
236 | Anonymous Users | ||
237 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
238 | Prometheus Tech User | ||
239 | ))) | ||
240 | |=(% rowspan="5" %)Credentials|Create|✅|✅|❌|❌|❌|❌|❌ | ||
241 | |Delete|✅|❌|❌|❌|❌|❌|❌ | ||
242 | |Manage Domains|✅|❌|❌|❌|❌|❌|❌ | ||
243 | |Update|✅|✅|❌|❌|❌|❌|❌ | ||
244 | |View|✅|✅|✅|❌|❌|❌|❌ | ||
245 | |=(% rowspan="10" %)Job|Build|✅|✅|✅|❌|❌|❌|❌ | ||
246 | |Cancel|✅|✅|❌|❌|❌|❌|❌ | ||
247 | |Configure|✅|✅|❌|❌|❌|❌|❌ | ||
248 | |Create|✅|✅|❌|❌|❌|❌|❌ | ||
249 | |Delete|✅|❌|❌|❌|❌|❌|❌ | ||
250 | |Discover|✅|✅|✅|✅|❌|❌|❌ | ||
251 | |ExtendedRead| | | | | | | | ||
252 | |Move|✅|❌|❌|❌|❌|❌|❌ | ||
253 | |Read|✅|✅|✅|✅|❌|❌|❌ | ||
254 | |Workspace|✅|✅|✅|❌|❌|❌|❌ | ||
255 | |=(% rowspan="3" %)Run|Delete|✅|❌|❌|❌|❌|❌|❌ | ||
256 | |Replay|✅|✅|✅|❌|❌|❌|❌ | ||
257 | |Update|✅|✅|✅|❌|❌|❌|❌ | ||
258 | |=Job Config History|DeleteEntry| | | | | | | | ||
259 | |=SCM|Tag|✅|✅|❌|❌|❌|❌|❌ | ||
260 | |=Metrics|HealthCheck| | | | | | | | ||
261 | | |ThreadDump| | | | | | | | ||
262 | | |View| | | | | | | | ||
263 | |||
264 | = GitLab = | ||
265 | |||
266 | Users are assigned to Groups in GitLab with the following roles assignment. Permissions within subordinated Subgroups and GitLab Projects are inherited. | ||
267 | |||
268 | (% class="active" %)|=((( | ||
269 | Project Role | ||
270 | )))|=((( | ||
271 | GitLab Group Members Permission | ||
272 | ))) | ||
273 | |((( | ||
274 | Viewer | ||
275 | )))|((( | ||
276 | Reporter | ||
277 | ))) | ||
278 | |((( | ||
279 | Developer | ||
280 | )))|((( | ||
281 | Developer | ||
282 | ))) | ||
283 | |(% colspan="1" %)((( | ||
284 | Master | ||
285 | )))|(% colspan="1" %)((( | ||
286 | Maintainer | ||
287 | ))) | ||
288 | |(% colspan="1" %)((( | ||
289 | Admin | ||
290 | )))|(% colspan="1" %)((( | ||
291 | Owner | ||
292 | ))) | ||
293 | |||
294 | Regarding permissions for Group Permissions in GitLab, see [[https:~~/~~/docs.gitlab.com/ee/user/permissions.html#group-members-permissions>>url:https://docs.gitlab.com/ee/user/permissions.html#group-members-permissions||shape="rect"]]. | ||
295 | |||
296 | = Harbor Project Roles = | ||
297 | |||
298 | Harbor manages images through projects. You provide access to these images to users by including the users in projects and assigning one of the following roles to them: | ||
299 | |||
300 | (% class="active" %)|=((( | ||
301 | Harbor | ||
302 | )))|=((( | ||
303 | Portal | ||
304 | )))|= | ||
305 | |=Role Name|=Role Id|=Project Role | ||
306 | |Project Admin|1|ADMIN | ||
307 | |Maintainer|4|MASTER | ||
308 | |Developer|2|DEVELOPER | ||
309 | |Guest|3|VIEWER | ||
310 | |||
311 | === Harbor Roles Permissions === | ||
312 | |||
313 | (% class="active" %)|=((( | ||
314 | Action | ||
315 | )))|=((( | ||
316 | Limited Guest | ||
317 | )))|=((( | ||
318 | Guest | ||
319 | )))|=((( | ||
320 | Developer | ||
321 | )))|=((( | ||
322 | Maintainer | ||
323 | )))|=((( | ||
324 | Project Admin | ||
325 | ))) | ||
326 | |See the project configurations|✅|✅|✅|✅|✅ | ||
327 | |Edit the project configurations|❌|❌|❌|❌|✅ | ||
328 | |See a list of project members| |✅|✅|✅|✅ | ||
329 | |Create/edit/delete project members|❌|❌|❌|❌|✅ | ||
330 | |See a list of project logs|✅|✅|✅|✅|❌ | ||
331 | |See a list of project replications|❌|❌|❌|✅|✅ | ||
332 | |See a list of project replication jobs|❌|❌|❌|❌|✅ | ||
333 | |See a list of project labels|❌|❌|❌|✅|✅ | ||
334 | |Create/edit/delete project labels|❌|❌|❌|✅|✅ | ||
335 | |See a list of repositories|✅|✅|✅|✅|✅ | ||
336 | |Create repositories|❌|❌|✅|✅|✅ | ||
337 | |Edit/delete repositories|❌|❌|❌|✅|✅ | ||
338 | |See a list of images|✅|✅|✅|✅|✅ | ||
339 | |Retag image|❌|✅|✅|✅|✅ | ||
340 | |Pull image|✅|✅|✅|✅|✅ | ||
341 | |Push image|❌|❌|✅|✅|✅ | ||
342 | |Scan/delete image|❌|❌|❌|✅|✅ | ||
343 | |Add scanners to Harbor *|❌|❌|❌|❌|❌ | ||
344 | |Edit scanners in projects|❌|❌|❌|❌|✅ | ||
345 | |See a list of image vulnerabilities|✅|✅|✅|✅|✅ | ||
346 | |Create list of project vulnerabilities|❌|❌|✅|✅|✅ | ||
347 | |Read list of project vulnerabilities|❌|❌|✅|✅|✅ | ||
348 | |Export list of project vulnerabilities|❌|❌|✅|✅|✅ | ||
349 | |See image build history|✅|✅|✅|✅|✅ | ||
350 | |Add/Remove labels of image|❌|❌|✅|✅|✅ | ||
351 | |See a list of helm charts|✅|✅|✅|✅|✅ | ||
352 | |Download helm charts|✅|✅|✅|✅|✅ | ||
353 | |Upload helm charts|❌|❌|✅|✅|✅ | ||
354 | |Delete helm charts|❌|❌|❌|✅|✅ | ||
355 | |See a list of helm chart versions|✅|✅|✅|✅|✅ | ||
356 | |Download helm chart versions|✅|✅|✅|✅|✅ | ||
357 | |Upload helm chart versions|❌|❌|✅|✅|✅ | ||
358 | |Delete helm chart versions|❌|❌|❌|✅|✅ | ||
359 | |Add/Remove labels of helm chart version|❌|❌|✅|✅|✅ | ||
360 | |See a list of project robots|❌|❌|❌|✅|✅ | ||
361 | |Create/edit/delete project robots|❌|❌|❌|❌|✅ | ||
362 | |See configured CVE allowlist|✅|✅|✅|✅|✅ | ||
363 | |Create/edit/remove CVE allowlist|❌|❌|❌|❌|✅ | ||
364 | |View webhook events|❌|❌|❌|✅|✅ | ||
365 | |Add new webhook events|❌|❌|❌|❌|✅ | ||
366 | |Enable/deactivate webhooks|❌|❌|❌|❌|✅ | ||
367 | |Create/delete tag retention rules|❌|❌|✅|✅|✅ | ||
368 | |Enable/deactivate tag retention rules|❌|❌|✅|✅|✅ | ||
369 | |Create/delete tag immutability rules|❌|❌|❌|✅|✅ | ||
370 | |Enable/deactivate tag immutability rules|❌|❌|❌|✅|✅ | ||
371 | |See project quotas|✅|✅|✅|✅|✅ | ||
372 | |Edit project quotas *|❌|❌|❌|❌|❌ | ||
373 | |Delete Project|❌|❌|❌|❌|✅ | ||
374 | |||
375 | ~* Only the Harbor system administrator can edit project quotas and add new scanners. | ||
376 | |||
377 | = Gitea = | ||
378 | |||
379 | Please note, that some terms used in DevOps-as-a-Service have different names in Gitea. Please check the following table to avoid any confusion. | ||
380 | |||
381 | (% class="active" %)|=((( | ||
382 | DevOps Portal | ||
383 | )))|=((( | ||
384 | Gitea | ||
385 | ))) | ||
386 | |((( | ||
387 | Project | ||
388 | )))|((( | ||
389 | Organization | ||
390 | ))) | ||
391 | |((( | ||
392 | Project Role | ||
393 | )))|((( | ||
394 | Team | ||
395 | ))) | ||
396 | |((( | ||
397 | Git Repository | ||
398 | )))|((( | ||
399 | Repository | ||
400 | ))) | ||
401 | |((( | ||
402 | Artifact Repository | ||
403 | )))|((( | ||
404 | Package | ||
405 | ))) | ||
406 | |((( | ||
407 | Issue Tracking | ||
408 | )))|((( | ||
409 | Project (currently disabled) | ||
410 | ))) | ||
411 | |||
412 | The **Owner** team has full admin permission in the Organization. This is a technical user used by the DevOps Portal for auto-provisioning. | ||
413 | |||
414 | (% class="active" %)|=((( | ||
415 | Gitea Role | ||
416 | )))|=((( | ||
417 | Portal Project Role | ||
418 | )))|=Permissions | ||
419 | |((( | ||
420 | Viewer | ||
421 | )))|Viewer|Read | ||
422 | |((( | ||
423 | Developer | ||
424 | )))|((( | ||
425 | Developer | ||
426 | )))|Read, Write | ||
427 | |(% colspan="1" %)((( | ||
428 | Master | ||
429 | )))|(% colspan="1" %)Master|Read, Write | ||
430 | |(% colspan="1" %)Admin|(% colspan="1" %)Admin|Read, Write, Repository create | ||
431 | |||
432 | = Nexus Project Roles = | ||
433 | |||
434 | For each role in a project a role in Nexus is created which includes one Privilege for each repository in the project. | ||
435 | |||
436 | (% class="relative-table" style="width:1450.0px" %) | ||
437 | (% class="active" %)|=(% style="text-align: left;" %)((( | ||
438 | Role | ||
439 | )))|=(% style="text-align: left;" %)((( | ||
440 | Admin | ||
441 | )))|=(% style="text-align: left;" %)((( | ||
442 | Master | ||
443 | )))|=(% style="text-align: left;" %)((( | ||
444 | Developer | ||
445 | )))|=(% style="text-align: left;" %)((( | ||
446 | Viewer | ||
447 | ))) | ||
448 | |(% style="text-align:left" %)((( | ||
449 | ID | ||
450 | )))|(% style="text-align:left" %)((( | ||
451 | PROJECTKEY-admin | ||
452 | )))|(% style="text-align:left" %)((( | ||
453 | PROJECTKEY-master | ||
454 | )))|(% style="text-align:left" %)((( | ||
455 | PROJECTKEY-developer | ||
456 | )))|(% style="text-align:left" %)((( | ||
457 | PROJECTKEY-viewer | ||
458 | ))) | ||
459 | |(% style="text-align:left" %)((( | ||
460 | Name | ||
461 | )))|(% style="text-align:left" %)((( | ||
462 | PROJECTKEY-admin | ||
463 | )))|(% style="text-align:left" %)((( | ||
464 | PROJECTKEY-master | ||
465 | )))|(% style="text-align:left" %)((( | ||
466 | PROJECTKEY-developer | ||
467 | )))|(% style="text-align:left" %)((( | ||
468 | PROJECTKEY-viewer | ||
469 | ))) | ||
470 | |(% style="text-align:left" %)((( | ||
471 | Privilege | ||
472 | )))|(% style="text-align:left" %)((( | ||
473 | PROJECTKEY-docker-admin | ||
474 | |||
475 | PROJECTKEY-maven-admin | ||
476 | |||
477 | PROJECTKEY-//repotype//-admin | ||
478 | )))|(% style="text-align:left" %)((( | ||
479 | PROJECTKEY-docker-master | ||
480 | |||
481 | PROJECTKEY-maven-master | ||
482 | |||
483 | PROJECTKEY-//repotype//-master | ||
484 | )))|(% style="text-align:left" %)((( | ||
485 | PROJECTKEY-docker-developer | ||
486 | |||
487 | PROJECTKEY-maven-developer | ||
488 | |||
489 | PROJECTKEY-//repotype//-developer | ||
490 | )))|(% style="text-align:left" %)((( | ||
491 | PROJECTKEY-docker-viewer | ||
492 | |||
493 | PROJECTKEY-maven-viewer | ||
494 | |||
495 | PROJECTKEY-//repotype//-viewer | ||
496 | ))) | ||
497 | |||
498 | For each role in a project a **Privilege of type Repository Content Selector** is created which combines Content Selector (Project), Repository (Docker Registry) and Actions depending on the role. | ||
499 | |||
500 | (% class="relative-table" style="width:1450.0px" %) | ||
501 | (% class="active" %)|=(% style="text-align: left;" %)((( | ||
502 | Privilege / Role | ||
503 | )))|=(% style="text-align: left;" %)((( | ||
504 | Admin | ||
505 | )))|=(% style="text-align: left;" %)((( | ||
506 | Master | ||
507 | )))|=(% style="text-align: left;" %)((( | ||
508 | Developer | ||
509 | )))|=(% style="text-align: left;" %)((( | ||
510 | Viewer | ||
511 | ))) | ||
512 | |(% style="text-align:left" %)((( | ||
513 | Name | ||
514 | )))|(% style="text-align:left" %)((( | ||
515 | PROJECTKEY-docker-admin | ||
516 | )))|(% style="text-align:left" %)((( | ||
517 | PROJECTKEY-docker-master | ||
518 | )))|(% style="text-align:left" %)((( | ||
519 | PROJECTKEY-docker-developer | ||
520 | )))|(% style="text-align:left" %)((( | ||
521 | PROJECTKEY-docker-viewer | ||
522 | ))) | ||
523 | |(% style="text-align:left" %)((( | ||
524 | Content Selector | ||
525 | )))|(% style="text-align:left" %)((( | ||
526 | PROJECTKEY-docker | ||
527 | )))|(% style="text-align:left" %)((( | ||
528 | PROJECTKEY-docker | ||
529 | )))|(% style="text-align:left" %)((( | ||
530 | PROJECTKEY-docker | ||
531 | )))|(% style="text-align:left" %)((( | ||
532 | PROJECTKEY-docker | ||
533 | ))) | ||
534 | |(% style="text-align:left" %)((( | ||
535 | Repository | ||
536 | )))|(% style="text-align:left" %)((( | ||
537 | docker-registry | ||
538 | )))|(% style="text-align:left" %)((( | ||
539 | docker-registry | ||
540 | )))|(% style="text-align:left" %)((( | ||
541 | docker-registry | ||
542 | )))|(% style="text-align:left" %)((( | ||
543 | docker-registry | ||
544 | ))) | ||
545 | |(% style="text-align:left" %)((( | ||
546 | Actions | ||
547 | )))|(% style="text-align:left" %)((( | ||
548 | delete, add, edit, browse, read | ||
549 | )))|(% style="text-align:left" %)((( | ||
550 | add, edit, browse, read | ||
551 | )))|(% style="text-align:left" %)((( | ||
552 | add, edit, browse, read | ||
553 | )))|(% style="text-align:left" %)((( | ||
554 | browse, read | ||
555 | ))) | ||
556 | |||
557 | See [[https:~~/~~/help.sonatype.com/repomanager3/security/privileges>>url:https://help.sonatype.com/repomanager3/nexus-repository-administration/access-control/privileges||shape="rect"]] for available Actions. |