Wiki source code of Users and roles
Last modified by Valentin Negoita on 2025/08/14 09:56
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | {{toc depth="1"/}} | ||
| 2 | |||
| 3 | = Role Model = | ||
| 4 | |||
| 5 | Each user who is a member of a project has to be in //exactly one// Project Role. Therefore it is not possible to have no or multiple roles in a project. | ||
| 6 | |||
| 7 | Different roles have different sets of permissions. Possible roles are: | ||
| 8 | |||
| 9 | |=(% style="text-align: left;" %)((( | ||
| 10 | Role | ||
| 11 | )))|=(% style="text-align: left;" %)((( | ||
| 12 | Decription | ||
| 13 | ))) | ||
| 14 | |(% style="text-align:left" %)((( | ||
| 15 | Admin | ||
| 16 | )))|(% style="text-align:left" %)((( | ||
| 17 | (% class="content-wrapper" %) | ||
| 18 | ((( | ||
| 19 | Full access, even to potentially dangerous operations like User and Project Provisioning. Can administer Project Members and Roles. | ||
| 20 | ))) | ||
| 21 | ))) | ||
| 22 | |(% style="text-align:left" %)((( | ||
| 23 | Master | ||
| 24 | )))|(% style="text-align:left" %)((( | ||
| 25 | Limited full access to avoid accidental data loss or other unrevertable changes. | ||
| 26 | ))) | ||
| 27 | |(% style="text-align:left" %)((( | ||
| 28 | Developer | ||
| 29 | )))|(% style="text-align:left" %)((( | ||
| 30 | Read-write access to contribute to the Project | ||
| 31 | ))) | ||
| 32 | |(% style="text-align:left" %)((( | ||
| 33 | Viewer | ||
| 34 | )))|(% style="text-align:left" %)((( | ||
| 35 | Read-only access to all not security-relevant data in the Project | ||
| 36 | ))) | ||
| 37 | |||
| 38 | Currently, the role assignment is applied for all tools within one project. | ||
| 39 | |||
| 40 | {{info}} | ||
| 41 | Note: | ||
| 42 | To ensure the integrity of the applications in the context of the managed service, no customer user is allowed to get system admin permissions for the tools. The maximum permissions for a customer user is the "Project Admin" role as described here | ||
| 43 | {{/info}} | ||
| 44 | |||
| 45 | = User Permissions in SDPortal = | ||
| 46 | |||
| 47 | (% class="relative-table" style="width:93.9554%" %) | ||
| 48 | (% class="active" %)|=((( | ||
| 49 | Role Type | ||
| 50 | )))|=(% colspan="2" style="text-align: left;" %)((( | ||
| 51 | (% style="text-align: center;" %) | ||
| 52 | Global Role | ||
| 53 | )))|=(% colspan="4" style="text-align: center;" %)((( | ||
| 54 | Project Role | ||
| 55 | ))) | ||
| 56 | (% class="active" %)|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" %)((( | ||
| 57 | **Role Name** | ||
| 58 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 59 | **User** | ||
| 60 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 61 | **Admin** | ||
| 62 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 63 | **Viewer** | ||
| 64 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 65 | **Developer** | ||
| 66 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 67 | **Master** | ||
| 68 | )))|(% class="highlight-#f4f5f7" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 69 | **Admin** | ||
| 70 | ))) | ||
| 71 | |Login to SDPortal|✅|✅|✅|✅|✅|✅ | ||
| 72 | |Logout from SDPortal|✅|✅|✅|✅|✅|✅ | ||
| 73 | |Change my password|✅|✅|✅|✅|✅|✅ | ||
| 74 | |Reset forgotten password|✅|✅|✅|✅|✅|✅ | ||
| 75 | |Display list of users|✅|✅|✅|✅|✅|✅ | ||
| 76 | |Search for user |✅|✅|✅|✅|✅|✅ | ||
| 77 | |Add or remove "Corporate Admin" role to user |❌|✅|❌|❌|❌|❌ | ||
| 78 | |Create User|❌|✅|❌|❌|❌|❌ | ||
| 79 | |Delete User|❌|✅|❌|❌|❌|❌ | ||
| 80 | |Lock User|❌|✅|❌|❌|❌|❌ | ||
| 81 | |Unlock User|❌|✅|❌|❌|❌|❌ | ||
| 82 | |Send invitation mail for first login|❌|✅|❌|❌|❌|❌ | ||
| 83 | |Display list of projects |❌|✅|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects | ||
| 84 | |Search for project |❌|✅|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects | ||
| 85 | |Create project |❌|✅|❌|❌|❌|❌ | ||
| 86 | |Delete project|❌|✅|❌|❌|❌|❌ | ||
| 87 | |Retire project |❌|✅|❌|❌|❌|⚠ Only his projects | ||
| 88 | |Reactivate project|❌|✅|❌|❌|❌|⚠ Only his projects | ||
| 89 | |Add User to Project|❌|✅|❌|❌|❌|⚠ Only his projects | ||
| 90 | |Remove User from Project|❌|✅|❌|❌|❌|⚠ Only his projects | ||
| 91 | |Display used storage by project/tool or total|❌|✅|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects | ||
| 92 | |||
| 93 | = JIRA Project Roles / Permission Scheme = | ||
| 94 | |||
| 95 | In JIRA the Project Roles are first added to Security / Project Roles and then they get their Permissions assigned in the SDCloud Permission Scheme which has to associated later with the Jira Projects. | ||
| 96 | |||
| 97 | (% class="responsive-table" %) | ||
| 98 | (% class="active" %)|=(% style="text-align: left;" %)((( | ||
| 99 | Permission / Role | ||
| 100 | )))|=(% style="text-align: left;" %)((( | ||
| 101 | Admin | ||
| 102 | )))|=(% style="text-align: left;" %)((( | ||
| 103 | Master | ||
| 104 | )))|=(% style="text-align: left;" %)((( | ||
| 105 | Developer | ||
| 106 | )))|=(% style="text-align: left;" %)((( | ||
| 107 | Viewer | ||
| 108 | ))) | ||
| 109 | (% class="active" %)|=(% colspan="1" style="text-align: left;" %)((( | ||
| 110 | Project Permissions | ||
| 111 | )))|(% class="highlight-#f4f5f7" colspan="1" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 112 | |||
| 113 | )))|(% class="highlight-#f4f5f7" colspan="1" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 114 | |||
| 115 | )))|(% class="highlight-#f4f5f7" colspan="1" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 116 | |||
| 117 | )))|(% class="highlight-#f4f5f7" colspan="1" data-highlight-colour="#f4f5f7" style="text-align:left" %)((( | ||
| 118 | |||
| 119 | ))) | ||
| 120 | |Administer projects | ||
| 121 | Enabled Extended project administration|✅|❌|❌|❌ | ||
| 122 | |Browse projects|✅|✅|✅|✅ | ||
| 123 | |Manage sprints|✅|✅|❌|❌ | ||
| 124 | |Service Desk Agent|✅|✅|✅|❌ | ||
| 125 | |View development tool|✅|✅|✅|✅ | ||
| 126 | |View (read-only) workflow|✅|✅|✅|✅ | ||
| 127 | (% class="active" %)|=Issue Permissions| | | | | ||
| 128 | |Assign issues|✅|✅|✅|❌ | ||
| 129 | |Assignable user|✅|✅|✅|❌ | ||
| 130 | |Close issues|✅|✅|❌|❌ | ||
| 131 | |Create issues|✅|✅|✅|❌ | ||
| 132 | |Delete issues|✅|❌|❌|❌ | ||
| 133 | |Edit issues|✅|✅|✅|❌ | ||
| 134 | |Link issues|✅|✅|✅|❌ | ||
| 135 | |Modify reporter|✅|✅|❌|❌ | ||
| 136 | |Move issues|✅|✅|❌|❌ | ||
| 137 | |Resolve issues|✅|✅|✅|❌ | ||
| 138 | |Schedule issues|✅|✅|❌|❌ | ||
| 139 | |Set issues security|✅|❌|❌|❌ | ||
| 140 | |Transition issues|✅|✅|✅|❌ | ||
| 141 | (% class="active" %)|=(% colspan="1" %)Voters & watchers permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) | ||
| 142 | |Manage watcher list|✅|✅|❌|❌ | ||
| 143 | |View voters and watchers|✅|✅|✅|❌ | ||
| 144 | (% class="active" %)|=(% colspan="1" %)Comments permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) | ||
| 145 | |Add comments|✅|✅|✅|❌ | ||
| 146 | |Delete all comments|✅|❌|❌|❌ | ||
| 147 | |Delete own comments|✅|✅|✅|❌ | ||
| 148 | |Edit all comments|✅|❌|❌|❌ | ||
| 149 | |Edit own comments|✅|✅|✅|❌ | ||
| 150 | (% class="active" %)|=(% colspan="1" %)Attachments permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) | ||
| 151 | |Create attachments|✅|✅|✅|❌ | ||
| 152 | |Delete all attachments|✅|❌|❌|❌ | ||
| 153 | |Delete own attachments|✅|✅|✅|❌ | ||
| 154 | (% class="active" %)|=(% colspan="1" %)Time-tracking Permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) | ||
| 155 | |Work on issues|✅|✅|✅|❌ | ||
| 156 | |Delete all worklogs|✅|❌|❌|❌ | ||
| 157 | |Delete own worklogs|✅|✅|✅|❌ | ||
| 158 | |Edit all worklogs|✅|❌|❌|❌ | ||
| 159 | |Edit own worklogs|✅|✅|✅|❌ | ||
| 160 | |||
| 161 | * Service Desk Agent is only available if the software was added to JIRA | ||
| 162 | |||
| 163 | = Confluence Project Roles = | ||
| 164 | |||
| 165 | See vendor documentation for the exact meaning: [[https:~~/~~/confluence.atlassian.com/doc/space-permissions-overview-139521.html>>url:https://confluence.atlassian.com/doc/space-permissions-overview-139521.html||rel="nofollow" shape="rect" style="text-decoration: none;" class="external-link"]]. | ||
| 166 | |||
| 167 | (% class="active" %)|=(% style="text-align: center;" %)((( | ||
| 168 | Space | ||
| 169 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
| 170 | All | ||
| 171 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
| 172 | Pages | ||
| 173 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
| 174 | Blog | ||
| 175 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
| 176 | Attachments | ||
| 177 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
| 178 | Comments | ||
| 179 | )))|=(% style="text-align: center;" %)((( | ||
| 180 | Restrictions | ||
| 181 | )))|=(% style="text-align: center;" %)((( | ||
| 182 | |||
| 183 | )))|=(% colspan="2" style="text-align: center;" %)((( | ||
| 184 | Space | ||
| 185 | ))) | ||
| 186 | |=(% colspan="1" %)Role/Operation|(% colspan="1" %)View|(% colspan="1" %)Delete Own|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add/Delete|(% colspan="1" %)Delete|(% colspan="1" %)Export|(% colspan="1" %)Admin | ||
| 187 | |=Admin|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅ | ||
| 188 | |=Master|✅|✅|✅|❌|✅|❌|✅|❌|✅|✅|✅|❌|✅|❌ | ||
| 189 | |=Developer|✅|✅|✅|❌|❌|❌|✅|❌|✅|❌|❌|❌|❌|❌ | ||
| 190 | |=Viewer|✅|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌ | ||
| 191 | |||
| 192 | = Bitbucket Project Roles = | ||
| 193 | |||
| 194 | (% class="active" %)|=(% style="text-align: left;" %)((( | ||
| 195 | |||
| 196 | )))|=(% style="text-align: left;" %)((( | ||
| 197 | (% style="color:#333333" %)Browse | ||
| 198 | )))|=(% style="text-align: left;" %)((( | ||
| 199 | (% style="color:#333333" %)Clone / Pull | ||
| 200 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
| 201 | (% style="color:#333333" %)Create, browse, comment on pull request | ||
| 202 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
| 203 | (% style="color:#333333" %)Merge pull request | ||
| 204 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
| 205 | (% style="color:#333333" %)Push | ||
| 206 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
| 207 | (% style="color:#333333" %)Create repositories | ||
| 208 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
| 209 | (% style="color:#333333" %)Edit settings / permissions | ||
| 210 | ))) | ||
| 211 | |Admin|✅|✅|✅|✅|✅|✅|✅ | ||
| 212 | |Master|✅|✅|✅|✅|✅|❌|❌ | ||
| 213 | |Developer|✅|✅|✅|✅|✅|❌|❌ | ||
| 214 | |Viewer|✅|✅|✅|❌|❌|❌|❌ | ||
| 215 | |||
| 216 | //Repository permissions are inherited from project permissions.// | ||
| 217 | |||
| 218 | = Jenkins Project Roles = | ||
| 219 | |||
| 220 | (% class="relative-table" style="width:1413.0px" %) | ||
| 221 | (% class="active" %)|=(% colspan="1" style="text-align: left;" %)((( | ||
| 222 | Permission | ||
| 223 | )))|=(% style="text-align: left;" %)((( | ||
| 224 | Role | ||
| 225 | )))|=(% style="text-align: left;" %)((( | ||
| 226 | Admin | ||
| 227 | )))|=(% style="text-align: left;" %)((( | ||
| 228 | Master | ||
| 229 | )))|=(% style="text-align: left;" %)((( | ||
| 230 | Developer | ||
| 231 | )))|=(% style="text-align: left;" %)((( | ||
| 232 | Viewer | ||
| 233 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
| 234 | Authenticated Users | ||
| 235 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
| 236 | Anonymous Users | ||
| 237 | )))|=(% colspan="1" style="text-align: left;" %)((( | ||
| 238 | Prometheus Tech User | ||
| 239 | ))) | ||
| 240 | |=(% rowspan="5" %)Credentials|Create|✅|✅|❌|❌|❌|❌|❌ | ||
| 241 | |Delete|✅|❌|❌|❌|❌|❌|❌ | ||
| 242 | |Manage Domains|✅|❌|❌|❌|❌|❌|❌ | ||
| 243 | |Update|✅|✅|❌|❌|❌|❌|❌ | ||
| 244 | |View|✅|✅|✅|❌|❌|❌|❌ | ||
| 245 | |=(% rowspan="10" %)Job|Build|✅|✅|✅|❌|❌|❌|❌ | ||
| 246 | |Cancel|✅|✅|❌|❌|❌|❌|❌ | ||
| 247 | |Configure|✅|✅|❌|❌|❌|❌|❌ | ||
| 248 | |Create|✅|✅|❌|❌|❌|❌|❌ | ||
| 249 | |Delete|✅|❌|❌|❌|❌|❌|❌ | ||
| 250 | |Discover|✅|✅|✅|✅|❌|❌|❌ | ||
| 251 | |ExtendedRead| | | | | | | | ||
| 252 | |Move|✅|❌|❌|❌|❌|❌|❌ | ||
| 253 | |Read|✅|✅|✅|✅|❌|❌|❌ | ||
| 254 | |Workspace|✅|✅|✅|❌|❌|❌|❌ | ||
| 255 | |=(% rowspan="3" %)Run|Delete|✅|❌|❌|❌|❌|❌|❌ | ||
| 256 | |Replay|✅|✅|✅|❌|❌|❌|❌ | ||
| 257 | |Update|✅|✅|✅|❌|❌|❌|❌ | ||
| 258 | |=Job Config History|DeleteEntry| | | | | | | | ||
| 259 | |=SCM|Tag|✅|✅|❌|❌|❌|❌|❌ | ||
| 260 | |=Metrics|HealthCheck| | | | | | | | ||
| 261 | | |ThreadDump| | | | | | | | ||
| 262 | | |View| | | | | | | | ||
| 263 | |||
| 264 | = GitLab = | ||
| 265 | |||
| 266 | Users are assigned to Groups in GitLab with the following roles assignment. Permissions within subordinated Subgroups and GitLab Projects are inherited. | ||
| 267 | |||
| 268 | (% class="active" %)|=((( | ||
| 269 | Project Role | ||
| 270 | )))|=((( | ||
| 271 | GitLab Group Members Permission | ||
| 272 | ))) | ||
| 273 | |((( | ||
| 274 | Viewer | ||
| 275 | )))|((( | ||
| 276 | Reporter | ||
| 277 | ))) | ||
| 278 | |((( | ||
| 279 | Developer | ||
| 280 | )))|((( | ||
| 281 | Developer | ||
| 282 | ))) | ||
| 283 | |(% colspan="1" %)((( | ||
| 284 | Master | ||
| 285 | )))|(% colspan="1" %)((( | ||
| 286 | Maintainer | ||
| 287 | ))) | ||
| 288 | |(% colspan="1" %)((( | ||
| 289 | Admin | ||
| 290 | )))|(% colspan="1" %)((( | ||
| 291 | Owner | ||
| 292 | ))) | ||
| 293 | |||
| 294 | Regarding permissions for Group Permissions in GitLab, see [[https:~~/~~/docs.gitlab.com/ee/user/permissions.html#group-members-permissions>>url:https://docs.gitlab.com/ee/user/permissions.html#group-members-permissions||shape="rect"]]. | ||
| 295 | |||
| 296 | = Harbor Project Roles = | ||
| 297 | |||
| 298 | Harbor manages images through projects. You provide access to these images to users by including the users in projects and assigning one of the following roles to them: | ||
| 299 | |||
| 300 | (% class="active" %)|=((( | ||
| 301 | Harbor | ||
| 302 | )))|=((( | ||
| 303 | Portal | ||
| 304 | )))|= | ||
| 305 | |=Role Name|=Role Id|=Project Role | ||
| 306 | |Project Admin|1|ADMIN | ||
| 307 | |Maintainer|4|MASTER | ||
| 308 | |Developer|2|DEVELOPER | ||
| 309 | |Guest|3|VIEWER | ||
| 310 | |||
| 311 | === Harbor Roles Permissions === | ||
| 312 | |||
| 313 | (% class="active" %)|=((( | ||
| 314 | Action | ||
| 315 | )))|=((( | ||
| 316 | Limited Guest | ||
| 317 | )))|=((( | ||
| 318 | Guest | ||
| 319 | )))|=((( | ||
| 320 | Developer | ||
| 321 | )))|=((( | ||
| 322 | Maintainer | ||
| 323 | )))|=((( | ||
| 324 | Project Admin | ||
| 325 | ))) | ||
| 326 | |See the project configurations|✅|✅|✅|✅|✅ | ||
| 327 | |Edit the project configurations|❌|❌|❌|❌|✅ | ||
| 328 | |See a list of project members| |✅|✅|✅|✅ | ||
| 329 | |Create/edit/delete project members|❌|❌|❌|❌|✅ | ||
| 330 | |See a list of project logs|✅|✅|✅|✅|❌ | ||
| 331 | |See a list of project replications|❌|❌|❌|✅|✅ | ||
| 332 | |See a list of project replication jobs|❌|❌|❌|❌|✅ | ||
| 333 | |See a list of project labels|❌|❌|❌|✅|✅ | ||
| 334 | |Create/edit/delete project labels|❌|❌|❌|✅|✅ | ||
| 335 | |See a list of repositories|✅|✅|✅|✅|✅ | ||
| 336 | |Create repositories|❌|❌|✅|✅|✅ | ||
| 337 | |Edit/delete repositories|❌|❌|❌|✅|✅ | ||
| 338 | |See a list of images|✅|✅|✅|✅|✅ | ||
| 339 | |Retag image|❌|✅|✅|✅|✅ | ||
| 340 | |Pull image|✅|✅|✅|✅|✅ | ||
| 341 | |Push image|❌|❌|✅|✅|✅ | ||
| 342 | |Scan/delete image|❌|❌|❌|✅|✅ | ||
| 343 | |Add scanners to Harbor *|❌|❌|❌|❌|❌ | ||
| 344 | |Edit scanners in projects|❌|❌|❌|❌|✅ | ||
| 345 | |See a list of image vulnerabilities|✅|✅|✅|✅|✅ | ||
| 346 | |Create list of project vulnerabilities|❌|❌|✅|✅|✅ | ||
| 347 | |Read list of project vulnerabilities|❌|❌|✅|✅|✅ | ||
| 348 | |Export list of project vulnerabilities|❌|❌|✅|✅|✅ | ||
| 349 | |See image build history|✅|✅|✅|✅|✅ | ||
| 350 | |Add/Remove labels of image|❌|❌|✅|✅|✅ | ||
| 351 | |See a list of helm charts|✅|✅|✅|✅|✅ | ||
| 352 | |Download helm charts|✅|✅|✅|✅|✅ | ||
| 353 | |Upload helm charts|❌|❌|✅|✅|✅ | ||
| 354 | |Delete helm charts|❌|❌|❌|✅|✅ | ||
| 355 | |See a list of helm chart versions|✅|✅|✅|✅|✅ | ||
| 356 | |Download helm chart versions|✅|✅|✅|✅|✅ | ||
| 357 | |Upload helm chart versions|❌|❌|✅|✅|✅ | ||
| 358 | |Delete helm chart versions|❌|❌|❌|✅|✅ | ||
| 359 | |Add/Remove labels of helm chart version|❌|❌|✅|✅|✅ | ||
| 360 | |See a list of project robots|❌|❌|❌|✅|✅ | ||
| 361 | |Create/edit/delete project robots|❌|❌|❌|❌|✅ | ||
| 362 | |See configured CVE allowlist|✅|✅|✅|✅|✅ | ||
| 363 | |Create/edit/remove CVE allowlist|❌|❌|❌|❌|✅ | ||
| 364 | |View webhook events|❌|❌|❌|✅|✅ | ||
| 365 | |Add new webhook events|❌|❌|❌|❌|✅ | ||
| 366 | |Enable/deactivate webhooks|❌|❌|❌|❌|✅ | ||
| 367 | |Create/delete tag retention rules|❌|❌|✅|✅|✅ | ||
| 368 | |Enable/deactivate tag retention rules|❌|❌|✅|✅|✅ | ||
| 369 | |Create/delete tag immutability rules|❌|❌|❌|✅|✅ | ||
| 370 | |Enable/deactivate tag immutability rules|❌|❌|❌|✅|✅ | ||
| 371 | |See project quotas|✅|✅|✅|✅|✅ | ||
| 372 | |Edit project quotas *|❌|❌|❌|❌|❌ | ||
| 373 | |Delete Project|❌|❌|❌|❌|✅ | ||
| 374 | |||
| 375 | ~* Only the Harbor system administrator can edit project quotas and add new scanners. | ||
| 376 | |||
| 377 | = Gitea = | ||
| 378 | |||
| 379 | Please note, that some terms used in DevOps-as-a-Service have different names in Gitea. Please check the following table to avoid any confusion. | ||
| 380 | |||
| 381 | (% class="active" %)|=((( | ||
| 382 | DevOps Portal | ||
| 383 | )))|=((( | ||
| 384 | Gitea | ||
| 385 | ))) | ||
| 386 | |((( | ||
| 387 | Project | ||
| 388 | )))|((( | ||
| 389 | Organization | ||
| 390 | ))) | ||
| 391 | |((( | ||
| 392 | Project Role | ||
| 393 | )))|((( | ||
| 394 | Team | ||
| 395 | ))) | ||
| 396 | |((( | ||
| 397 | Git Repository | ||
| 398 | )))|((( | ||
| 399 | Repository | ||
| 400 | ))) | ||
| 401 | |((( | ||
| 402 | Artifact Repository | ||
| 403 | )))|((( | ||
| 404 | Package | ||
| 405 | ))) | ||
| 406 | |((( | ||
| 407 | Issue Tracking | ||
| 408 | )))|((( | ||
| 409 | Project (currently disabled) | ||
| 410 | ))) | ||
| 411 | |||
| 412 | The **Owner** team has full admin permission in the Organization. This is a technical user used by the DevOps Portal for auto-provisioning. | ||
| 413 | |||
| 414 | (% class="active" %)|=((( | ||
| 415 | Gitea Role | ||
| 416 | )))|=((( | ||
| 417 | Portal Project Role | ||
| 418 | )))|=Permissions | ||
| 419 | |((( | ||
| 420 | Viewer | ||
| 421 | )))|Viewer|Read | ||
| 422 | |((( | ||
| 423 | Developer | ||
| 424 | )))|((( | ||
| 425 | Developer | ||
| 426 | )))|Read, Write | ||
| 427 | |(% colspan="1" %)((( | ||
| 428 | Master | ||
| 429 | )))|(% colspan="1" %)Master|Read, Write | ||
| 430 | |(% colspan="1" %)Admin|(% colspan="1" %)Admin|Read, Write, Repository create | ||
| 431 | |||
| 432 | = Nexus Project Roles = | ||
| 433 | |||
| 434 | For each role in a project a role in Nexus is created which includes one Privilege for each repository in the project. | ||
| 435 | |||
| 436 | (% class="relative-table" style="width:1450.0px" %) | ||
| 437 | (% class="active" %)|=(% style="text-align: left;" %)((( | ||
| 438 | Role | ||
| 439 | )))|=(% style="text-align: left;" %)((( | ||
| 440 | Admin | ||
| 441 | )))|=(% style="text-align: left;" %)((( | ||
| 442 | Master | ||
| 443 | )))|=(% style="text-align: left;" %)((( | ||
| 444 | Developer | ||
| 445 | )))|=(% style="text-align: left;" %)((( | ||
| 446 | Viewer | ||
| 447 | ))) | ||
| 448 | |(% style="text-align:left" %)((( | ||
| 449 | ID | ||
| 450 | )))|(% style="text-align:left" %)((( | ||
| 451 | PROJECTKEY-admin | ||
| 452 | )))|(% style="text-align:left" %)((( | ||
| 453 | PROJECTKEY-master | ||
| 454 | )))|(% style="text-align:left" %)((( | ||
| 455 | PROJECTKEY-developer | ||
| 456 | )))|(% style="text-align:left" %)((( | ||
| 457 | PROJECTKEY-viewer | ||
| 458 | ))) | ||
| 459 | |(% style="text-align:left" %)((( | ||
| 460 | Name | ||
| 461 | )))|(% style="text-align:left" %)((( | ||
| 462 | PROJECTKEY-admin | ||
| 463 | )))|(% style="text-align:left" %)((( | ||
| 464 | PROJECTKEY-master | ||
| 465 | )))|(% style="text-align:left" %)((( | ||
| 466 | PROJECTKEY-developer | ||
| 467 | )))|(% style="text-align:left" %)((( | ||
| 468 | PROJECTKEY-viewer | ||
| 469 | ))) | ||
| 470 | |(% style="text-align:left" %)((( | ||
| 471 | Privilege | ||
| 472 | )))|(% style="text-align:left" %)((( | ||
| 473 | PROJECTKEY-docker-admin | ||
| 474 | |||
| 475 | PROJECTKEY-maven-admin | ||
| 476 | |||
| 477 | PROJECTKEY-//repotype//-admin | ||
| 478 | )))|(% style="text-align:left" %)((( | ||
| 479 | PROJECTKEY-docker-master | ||
| 480 | |||
| 481 | PROJECTKEY-maven-master | ||
| 482 | |||
| 483 | PROJECTKEY-//repotype//-master | ||
| 484 | )))|(% style="text-align:left" %)((( | ||
| 485 | PROJECTKEY-docker-developer | ||
| 486 | |||
| 487 | PROJECTKEY-maven-developer | ||
| 488 | |||
| 489 | PROJECTKEY-//repotype//-developer | ||
| 490 | )))|(% style="text-align:left" %)((( | ||
| 491 | PROJECTKEY-docker-viewer | ||
| 492 | |||
| 493 | PROJECTKEY-maven-viewer | ||
| 494 | |||
| 495 | PROJECTKEY-//repotype//-viewer | ||
| 496 | ))) | ||
| 497 | |||
| 498 | For each role in a project a **Privilege of type Repository Content Selector** is created which combines Content Selector (Project), Repository (Docker Registry) and Actions depending on the role. | ||
| 499 | |||
| 500 | (% class="relative-table" style="width:1450.0px" %) | ||
| 501 | (% class="active" %)|=(% style="text-align: left;" %)((( | ||
| 502 | Privilege / Role | ||
| 503 | )))|=(% style="text-align: left;" %)((( | ||
| 504 | Admin | ||
| 505 | )))|=(% style="text-align: left;" %)((( | ||
| 506 | Master | ||
| 507 | )))|=(% style="text-align: left;" %)((( | ||
| 508 | Developer | ||
| 509 | )))|=(% style="text-align: left;" %)((( | ||
| 510 | Viewer | ||
| 511 | ))) | ||
| 512 | |(% style="text-align:left" %)((( | ||
| 513 | Name | ||
| 514 | )))|(% style="text-align:left" %)((( | ||
| 515 | PROJECTKEY-docker-admin | ||
| 516 | )))|(% style="text-align:left" %)((( | ||
| 517 | PROJECTKEY-docker-master | ||
| 518 | )))|(% style="text-align:left" %)((( | ||
| 519 | PROJECTKEY-docker-developer | ||
| 520 | )))|(% style="text-align:left" %)((( | ||
| 521 | PROJECTKEY-docker-viewer | ||
| 522 | ))) | ||
| 523 | |(% style="text-align:left" %)((( | ||
| 524 | Content Selector | ||
| 525 | )))|(% style="text-align:left" %)((( | ||
| 526 | PROJECTKEY-docker | ||
| 527 | )))|(% style="text-align:left" %)((( | ||
| 528 | PROJECTKEY-docker | ||
| 529 | )))|(% style="text-align:left" %)((( | ||
| 530 | PROJECTKEY-docker | ||
| 531 | )))|(% style="text-align:left" %)((( | ||
| 532 | PROJECTKEY-docker | ||
| 533 | ))) | ||
| 534 | |(% style="text-align:left" %)((( | ||
| 535 | Repository | ||
| 536 | )))|(% style="text-align:left" %)((( | ||
| 537 | docker-registry | ||
| 538 | )))|(% style="text-align:left" %)((( | ||
| 539 | docker-registry | ||
| 540 | )))|(% style="text-align:left" %)((( | ||
| 541 | docker-registry | ||
| 542 | )))|(% style="text-align:left" %)((( | ||
| 543 | docker-registry | ||
| 544 | ))) | ||
| 545 | |(% style="text-align:left" %)((( | ||
| 546 | Actions | ||
| 547 | )))|(% style="text-align:left" %)((( | ||
| 548 | delete, add, edit, browse, read | ||
| 549 | )))|(% style="text-align:left" %)((( | ||
| 550 | add, edit, browse, read | ||
| 551 | )))|(% style="text-align:left" %)((( | ||
| 552 | add, edit, browse, read | ||
| 553 | )))|(% style="text-align:left" %)((( | ||
| 554 | browse, read | ||
| 555 | ))) | ||
| 556 | |||
| 557 | See [[https:~~/~~/help.sonatype.com/repomanager3/security/privileges>>url:https://help.sonatype.com/repomanager3/nexus-repository-administration/access-control/privileges||shape="rect"]] for available Actions. |