Wiki source code of Users and roles
Version 6.2 by Boris Folgmann on 2026/05/20 12:43
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
| |
1.1 | 1 | {{toc depth="1"/}} |
| 2 | |||
| 3 | = Role Model = | ||
| 4 | |||
| 5 | Each user who is a member of a project has to be in //exactly one// Project Role. Therefore it is not possible to have no or multiple roles in a project. | ||
| 6 | |||
| 7 | Different roles have different sets of permissions. Possible roles are: | ||
| 8 | |||
| |
5.1 | 9 | |=((( |
| |
1.1 | 10 | Role |
| |
5.1 | 11 | )))|=((( |
| |
1.1 | 12 | Decription |
| 13 | ))) | ||
| |
5.1 | 14 | |((( |
| |
1.1 | 15 | Admin |
| |
5.1 | 16 | )))|((( |
| |
1.1 | 17 | Full access, even to potentially dangerous operations like User and Project Provisioning. Can administer Project Members and Roles. |
| 18 | ))) | ||
| |
5.1 | 19 | |((( |
| |
1.1 | 20 | Master |
| |
5.1 | 21 | )))|((( |
| |
1.1 | 22 | Limited full access to avoid accidental data loss or other unrevertable changes. |
| 23 | ))) | ||
| |
5.1 | 24 | |((( |
| |
1.1 | 25 | Developer |
| |
5.1 | 26 | )))|((( |
| |
1.1 | 27 | Read-write access to contribute to the Project |
| 28 | ))) | ||
| |
5.1 | 29 | |((( |
| |
1.1 | 30 | Viewer |
| |
5.1 | 31 | )))|((( |
| |
1.1 | 32 | Read-only access to all not security-relevant data in the Project |
| 33 | ))) | ||
| 34 | |||
| 35 | Currently, the role assignment is applied for all tools within one project. | ||
| 36 | |||
| 37 | {{info}} | ||
| 38 | Note: | ||
| 39 | To ensure the integrity of the applications in the context of the managed service, no customer user is allowed to get system admin permissions for the tools. The maximum permissions for a customer user is the "Project Admin" role as described here | ||
| 40 | {{/info}} | ||
| 41 | |||
| |
5.1 | 42 | = User Permissions in DevOps Portal = |
| |
1.1 | 43 | |
| |
5.1 | 44 | |=((( |
| |
1.1 | 45 | Role Type |
| |
5.1 | 46 | )))|=(% colspan="3" rowspan="1" %)((( |
| 47 | Portal Role | ||
| 48 | )))|=(% rowspan="23" %) |=(% colspan="4" %)((( | ||
| |
1.1 | 49 | Project Role |
| 50 | ))) | ||
| |
5.1 | 51 | |((( |
| |
1.1 | 52 | **Role Name** |
| |
5.1 | 53 | )))|((( |
| |
1.1 | 54 | **User** |
| |
5.1 | 55 | )))|((( |
| |
1.1 | 56 | **Admin** |
| |
5.1 | 57 | )))|((( |
| 58 | **Creator ** | ||
| 59 | )))|((( | ||
| |
1.1 | 60 | **Viewer** |
| |
5.1 | 61 | )))|((( |
| |
1.1 | 62 | **Developer** |
| |
5.1 | 63 | )))|((( |
| |
1.1 | 64 | **Master** |
| |
5.1 | 65 | )))|((( |
| |
1.1 | 66 | **Admin** |
| 67 | ))) | ||
| |
5.1 | 68 | |Login to DevOps Portal|✅|✅|✅|✅|✅|✅|✅ |
| 69 | |Logout from DevOps Portal|✅|✅|✅|✅|✅|✅|✅ | ||
| 70 | |Change my password|✅|✅|✅|✅|✅|✅|✅ | ||
| 71 | |Reset forgotten password|✅|✅|✅|✅|✅|✅|✅ | ||
| 72 | |Display list of users|✅|✅|✅|✅|✅|✅|✅ | ||
| 73 | |Search for user |✅|✅|✅|✅|✅|✅|✅ | ||
| 74 | |Add or remove "Corporate Admin" role to user |❌|✅|❌|❌|❌|❌|❌ | ||
| 75 | |Create User|❌|✅|✅|❌|❌|❌|❌ | ||
| 76 | |Delete User|❌|✅|❌|❌|❌|❌|❌ | ||
| 77 | |Lock User|❌|✅|❌|❌|❌|❌|❌ | ||
| 78 | |Unlock User|❌|✅|❌|❌|❌|❌|❌ | ||
| 79 | |Send invitation mail for first login|❌|✅|❌|❌|❌|❌|❌ | ||
| 80 | |Display list of projects |❌|✅|❌|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects | ||
| 81 | |Search for project |❌|✅|❌|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects | ||
| 82 | |Create project |❌|✅|✅|❌|❌|❌|❌ | ||
| 83 | |Delete project|❌|✅|❌|❌|❌|❌|❌ | ||
| 84 | |Retire project |❌|✅|❌|❌|❌|❌|⚠ Only his projects | ||
| 85 | |Reactivate project|❌|✅|❌|❌|❌|❌|⚠ Only his projects | ||
| 86 | |Add User to Project|❌|✅|❌|❌|❌|❌|⚠ Only his projects | ||
| 87 | |Remove User from Project|❌|✅|❌|❌|❌|❌|⚠ Only his projects | ||
| 88 | |Display used storage by project/tool or total|❌|✅|❌|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects|⚠ Only his projects | ||
| |
1.1 | 89 | |
| 90 | = JIRA Project Roles / Permission Scheme = | ||
| 91 | |||
| 92 | In JIRA the Project Roles are first added to Security / Project Roles and then they get their Permissions assigned in the SDCloud Permission Scheme which has to associated later with the Jira Projects. | ||
| 93 | |||
| |
5.1 | 94 | |=((( |
| |
1.1 | 95 | Permission / Role |
| |
5.1 | 96 | )))|=((( |
| |
1.1 | 97 | Admin |
| |
5.1 | 98 | )))|=((( |
| |
1.1 | 99 | Master |
| |
5.1 | 100 | )))|=((( |
| |
1.1 | 101 | Developer |
| |
5.1 | 102 | )))|=((( |
| |
1.1 | 103 | Viewer |
| 104 | ))) | ||
| |
5.1 | 105 | |=(% colspan="1" %)((( |
| |
1.1 | 106 | Project Permissions |
| |
5.1 | 107 | )))|(% colspan="1" %)((( |
| |
1.1 | 108 | |
| |
5.1 | 109 | )))|(% colspan="1" %)((( |
| |
1.1 | 110 | |
| |
5.1 | 111 | )))|(% colspan="1" %)((( |
| |
1.1 | 112 | |
| |
5.1 | 113 | )))|(% colspan="1" %)((( |
| |
1.1 | 114 | |
| 115 | ))) | ||
| 116 | |Administer projects | ||
| 117 | Enabled Extended project administration|✅|❌|❌|❌ | ||
| 118 | |Browse projects|✅|✅|✅|✅ | ||
| 119 | |Manage sprints|✅|✅|❌|❌ | ||
| 120 | |Service Desk Agent|✅|✅|✅|❌ | ||
| 121 | |View development tool|✅|✅|✅|✅ | ||
| 122 | |View (read-only) workflow|✅|✅|✅|✅ | ||
| |
5.1 | 123 | |=Issue Permissions| | | | |
| |
1.1 | 124 | |Assign issues|✅|✅|✅|❌ |
| 125 | |Assignable user|✅|✅|✅|❌ | ||
| 126 | |Close issues|✅|✅|❌|❌ | ||
| 127 | |Create issues|✅|✅|✅|❌ | ||
| 128 | |Delete issues|✅|❌|❌|❌ | ||
| 129 | |Edit issues|✅|✅|✅|❌ | ||
| 130 | |Link issues|✅|✅|✅|❌ | ||
| 131 | |Modify reporter|✅|✅|❌|❌ | ||
| 132 | |Move issues|✅|✅|❌|❌ | ||
| 133 | |Resolve issues|✅|✅|✅|❌ | ||
| 134 | |Schedule issues|✅|✅|❌|❌ | ||
| 135 | |Set issues security|✅|❌|❌|❌ | ||
| 136 | |Transition issues|✅|✅|✅|❌ | ||
| |
5.1 | 137 | |=(% colspan="1" %)Voters & watchers permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |
| |
3.1 | 138 | |Manage watcher list|✅|✅|❌|❌ |
| |
1.1 | 139 | |View voters and watchers|✅|✅|✅|❌ |
| |
5.1 | 140 | |=(% colspan="1" %)Comments permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |
| |
1.1 | 141 | |Add comments|✅|✅|✅|❌ |
| 142 | |Delete all comments|✅|❌|❌|❌ | ||
| 143 | |Delete own comments|✅|✅|✅|❌ | ||
| 144 | |Edit all comments|✅|❌|❌|❌ | ||
| 145 | |Edit own comments|✅|✅|✅|❌ | ||
| |
5.1 | 146 | |=(% colspan="1" %)Attachments permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |
| |
1.1 | 147 | |Create attachments|✅|✅|✅|❌ |
| 148 | |Delete all attachments|✅|❌|❌|❌ | ||
| 149 | |Delete own attachments|✅|✅|✅|❌ | ||
| |
5.1 | 150 | |=(% colspan="1" %)Time-tracking Permissions|(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |(% colspan="1" %) |
| |
1.1 | 151 | |Work on issues|✅|✅|✅|❌ |
| 152 | |Delete all worklogs|✅|❌|❌|❌ | ||
| 153 | |Delete own worklogs|✅|✅|✅|❌ | ||
| 154 | |Edit all worklogs|✅|❌|❌|❌ | ||
| 155 | |Edit own worklogs|✅|✅|✅|❌ | ||
| 156 | |||
| 157 | * Service Desk Agent is only available if the software was added to JIRA | ||
| 158 | |||
| 159 | = Confluence Project Roles = | ||
| 160 | |||
| |
5.1 | 161 | See vendor documentation for the exact meaning: [[https:~~/~~/confluence.atlassian.com/doc/space-permissions-overview-139521.html>>url:https://confluence.atlassian.com/doc/space-permissions-overview-139521.html]]. |
| |
1.1 | 162 | |
| |
5.1 | 163 | |=((( |
| |
1.1 | 164 | Space |
| |
5.1 | 165 | )))|=(% colspan="2" %)((( |
| |
1.1 | 166 | All |
| |
5.1 | 167 | )))|=(% colspan="2" %)((( |
| |
1.1 | 168 | Pages |
| |
5.1 | 169 | )))|=(% colspan="2" %)((( |
| |
1.1 | 170 | Blog |
| |
5.1 | 171 | )))|=(% colspan="2" %)((( |
| |
1.1 | 172 | Attachments |
| |
5.1 | 173 | )))|=(% colspan="2" %)((( |
| |
1.1 | 174 | Comments |
| |
5.1 | 175 | )))|=((( |
| |
1.1 | 176 | Restrictions |
| |
5.1 | 177 | )))|=((( |
| |
1.1 | 178 | |
| |
5.1 | 179 | )))|=(% colspan="2" %)((( |
| |
1.1 | 180 | Space |
| 181 | ))) | ||
| 182 | |=(% colspan="1" %)Role/Operation|(% colspan="1" %)View|(% colspan="1" %)Delete Own|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add|(% colspan="1" %)Delete|(% colspan="1" %)Add/Delete|(% colspan="1" %)Delete|(% colspan="1" %)Export|(% colspan="1" %)Admin | ||
| 183 | |=Admin|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅|✅ | ||
| 184 | |=Master|✅|✅|✅|❌|✅|❌|✅|❌|✅|✅|✅|❌|✅|❌ | ||
| 185 | |=Developer|✅|✅|✅|❌|❌|❌|✅|❌|✅|❌|❌|❌|❌|❌ | ||
| 186 | |=Viewer|✅|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌|❌ | ||
| 187 | |||
| 188 | = Bitbucket Project Roles = | ||
| 189 | |||
| |
5.1 | 190 | |=((( |
| |
1.1 | 191 | |
| |
5.1 | 192 | )))|=((( |
| 193 | Browse | ||
| 194 | )))|=((( | ||
| 195 | Clone / Pull | ||
| 196 | )))|=(% colspan="1" %)((( | ||
| 197 | Create, browse, comment on pull request | ||
| 198 | )))|=(% colspan="1" %)((( | ||
| 199 | Merge pull request | ||
| 200 | )))|=(% colspan="1" %)((( | ||
| 201 | Push | ||
| 202 | )))|=(% colspan="1" %)((( | ||
| 203 | Create repositories | ||
| 204 | )))|=(% colspan="1" %)((( | ||
| 205 | Edit settings / permissions | ||
| |
1.1 | 206 | ))) |
| 207 | |Admin|✅|✅|✅|✅|✅|✅|✅ | ||
| |
4.1 | 208 | |Master|✅|✅|✅|✅|✅|✅|❌ |
| |
1.1 | 209 | |Developer|✅|✅|✅|✅|✅|❌|❌ |
| 210 | |Viewer|✅|✅|✅|❌|❌|❌|❌ | ||
| 211 | |||
| 212 | //Repository permissions are inherited from project permissions.// | ||
| 213 | |||
| 214 | = Jenkins Project Roles = | ||
| 215 | |||
| |
5.1 | 216 | |=(% colspan="1" %)((( |
| |
1.1 | 217 | Permission |
| |
5.1 | 218 | )))|=((( |
| |
1.1 | 219 | Role |
| |
5.1 | 220 | )))|=((( |
| |
1.1 | 221 | Admin |
| |
5.1 | 222 | )))|=((( |
| |
1.1 | 223 | Master |
| |
5.1 | 224 | )))|=((( |
| |
1.1 | 225 | Developer |
| |
5.1 | 226 | )))|=((( |
| |
1.1 | 227 | Viewer |
| |
5.1 | 228 | )))|=(% colspan="1" %)((( |
| |
1.1 | 229 | Authenticated Users |
| |
5.1 | 230 | )))|=(% colspan="1" %)((( |
| |
1.1 | 231 | Anonymous Users |
| |
5.1 | 232 | )))|=(% colspan="1" %)((( |
| |
1.1 | 233 | Prometheus Tech User |
| 234 | ))) | ||
| 235 | |=(% rowspan="5" %)Credentials|Create|✅|✅|❌|❌|❌|❌|❌ | ||
| 236 | |Delete|✅|❌|❌|❌|❌|❌|❌ | ||
| 237 | |Manage Domains|✅|❌|❌|❌|❌|❌|❌ | ||
| 238 | |Update|✅|✅|❌|❌|❌|❌|❌ | ||
| 239 | |View|✅|✅|✅|❌|❌|❌|❌ | ||
| 240 | |=(% rowspan="10" %)Job|Build|✅|✅|✅|❌|❌|❌|❌ | ||
| 241 | |Cancel|✅|✅|❌|❌|❌|❌|❌ | ||
| 242 | |Configure|✅|✅|❌|❌|❌|❌|❌ | ||
| 243 | |Create|✅|✅|❌|❌|❌|❌|❌ | ||
| 244 | |Delete|✅|❌|❌|❌|❌|❌|❌ | ||
| 245 | |Discover|✅|✅|✅|✅|❌|❌|❌ | ||
| 246 | |ExtendedRead| | | | | | | | ||
| 247 | |Move|✅|❌|❌|❌|❌|❌|❌ | ||
| 248 | |Read|✅|✅|✅|✅|❌|❌|❌ | ||
| |
2.1 | 249 | |Workspace|✅|✅|✅|❌|❌|❌|❌ |
| |
1.1 | 250 | |=(% rowspan="3" %)Run|Delete|✅|❌|❌|❌|❌|❌|❌ |
| 251 | |Replay|✅|✅|✅|❌|❌|❌|❌ | ||
| 252 | |Update|✅|✅|✅|❌|❌|❌|❌ | ||
| 253 | |=Job Config History|DeleteEntry| | | | | | | | ||
| 254 | |=SCM|Tag|✅|✅|❌|❌|❌|❌|❌ | ||
| 255 | |=Metrics|HealthCheck| | | | | | | | ||
| 256 | | |ThreadDump| | | | | | | | ||
| 257 | | |View| | | | | | | | ||
| 258 | |||
| 259 | = GitLab = | ||
| 260 | |||
| 261 | Users are assigned to Groups in GitLab with the following roles assignment. Permissions within subordinated Subgroups and GitLab Projects are inherited. | ||
| 262 | |||
| |
5.1 | 263 | |=((( |
| |
1.1 | 264 | Project Role |
| 265 | )))|=((( | ||
| 266 | GitLab Group Members Permission | ||
| 267 | ))) | ||
| 268 | |((( | ||
| 269 | Viewer | ||
| 270 | )))|((( | ||
| 271 | Reporter | ||
| 272 | ))) | ||
| 273 | |((( | ||
| 274 | Developer | ||
| 275 | )))|((( | ||
| 276 | Developer | ||
| 277 | ))) | ||
| 278 | |(% colspan="1" %)((( | ||
| 279 | Master | ||
| 280 | )))|(% colspan="1" %)((( | ||
| 281 | Maintainer | ||
| 282 | ))) | ||
| 283 | |(% colspan="1" %)((( | ||
| 284 | Admin | ||
| 285 | )))|(% colspan="1" %)((( | ||
| 286 | Owner | ||
| 287 | ))) | ||
| 288 | |||
| |
5.1 | 289 | Regarding permissions for Group Permissions in GitLab, see [[https:~~/~~/docs.gitlab.com/ee/user/permissions.html#group-members-permissions>>url:https://docs.gitlab.com/ee/user/permissions.html#group-members-permissions]]. |
| |
1.1 | 290 | |
| 291 | = Harbor Project Roles = | ||
| 292 | |||
| 293 | Harbor manages images through projects. You provide access to these images to users by including the users in projects and assigning one of the following roles to them: | ||
| 294 | |||
| |
5.1 | 295 | |=((( |
| |
1.1 | 296 | Harbor |
| 297 | )))|=((( | ||
| 298 | Portal | ||
| 299 | )))|= | ||
| 300 | |=Role Name|=Role Id|=Project Role | ||
| 301 | |Project Admin|1|ADMIN | ||
| 302 | |Maintainer|4|MASTER | ||
| 303 | |Developer|2|DEVELOPER | ||
| 304 | |Guest|3|VIEWER | ||
| 305 | |||
| 306 | === Harbor Roles Permissions === | ||
| 307 | |||
| |
5.1 | 308 | |=((( |
| |
1.1 | 309 | Action |
| 310 | )))|=((( | ||
| 311 | Limited Guest | ||
| 312 | )))|=((( | ||
| 313 | Guest | ||
| 314 | )))|=((( | ||
| 315 | Developer | ||
| 316 | )))|=((( | ||
| 317 | Maintainer | ||
| 318 | )))|=((( | ||
| 319 | Project Admin | ||
| 320 | ))) | ||
| 321 | |See the project configurations|✅|✅|✅|✅|✅ | ||
| 322 | |Edit the project configurations|❌|❌|❌|❌|✅ | ||
| 323 | |See a list of project members| |✅|✅|✅|✅ | ||
| 324 | |Create/edit/delete project members|❌|❌|❌|❌|✅ | ||
| 325 | |See a list of project logs|✅|✅|✅|✅|❌ | ||
| 326 | |See a list of project replications|❌|❌|❌|✅|✅ | ||
| 327 | |See a list of project replication jobs|❌|❌|❌|❌|✅ | ||
| 328 | |See a list of project labels|❌|❌|❌|✅|✅ | ||
| 329 | |Create/edit/delete project labels|❌|❌|❌|✅|✅ | ||
| 330 | |See a list of repositories|✅|✅|✅|✅|✅ | ||
| 331 | |Create repositories|❌|❌|✅|✅|✅ | ||
| 332 | |Edit/delete repositories|❌|❌|❌|✅|✅ | ||
| 333 | |See a list of images|✅|✅|✅|✅|✅ | ||
| 334 | |Retag image|❌|✅|✅|✅|✅ | ||
| 335 | |Pull image|✅|✅|✅|✅|✅ | ||
| 336 | |Push image|❌|❌|✅|✅|✅ | ||
| 337 | |Scan/delete image|❌|❌|❌|✅|✅ | ||
| 338 | |Add scanners to Harbor *|❌|❌|❌|❌|❌ | ||
| 339 | |Edit scanners in projects|❌|❌|❌|❌|✅ | ||
| 340 | |See a list of image vulnerabilities|✅|✅|✅|✅|✅ | ||
| 341 | |Create list of project vulnerabilities|❌|❌|✅|✅|✅ | ||
| 342 | |Read list of project vulnerabilities|❌|❌|✅|✅|✅ | ||
| 343 | |Export list of project vulnerabilities|❌|❌|✅|✅|✅ | ||
| 344 | |See image build history|✅|✅|✅|✅|✅ | ||
| 345 | |Add/Remove labels of image|❌|❌|✅|✅|✅ | ||
| 346 | |See a list of helm charts|✅|✅|✅|✅|✅ | ||
| 347 | |Download helm charts|✅|✅|✅|✅|✅ | ||
| 348 | |Upload helm charts|❌|❌|✅|✅|✅ | ||
| 349 | |Delete helm charts|❌|❌|❌|✅|✅ | ||
| 350 | |See a list of helm chart versions|✅|✅|✅|✅|✅ | ||
| 351 | |Download helm chart versions|✅|✅|✅|✅|✅ | ||
| 352 | |Upload helm chart versions|❌|❌|✅|✅|✅ | ||
| 353 | |Delete helm chart versions|❌|❌|❌|✅|✅ | ||
| 354 | |Add/Remove labels of helm chart version|❌|❌|✅|✅|✅ | ||
| 355 | |See a list of project robots|❌|❌|❌|✅|✅ | ||
| 356 | |Create/edit/delete project robots|❌|❌|❌|❌|✅ | ||
| 357 | |See configured CVE allowlist|✅|✅|✅|✅|✅ | ||
| 358 | |Create/edit/remove CVE allowlist|❌|❌|❌|❌|✅ | ||
| 359 | |View webhook events|❌|❌|❌|✅|✅ | ||
| 360 | |Add new webhook events|❌|❌|❌|❌|✅ | ||
| 361 | |Enable/deactivate webhooks|❌|❌|❌|❌|✅ | ||
| 362 | |Create/delete tag retention rules|❌|❌|✅|✅|✅ | ||
| 363 | |Enable/deactivate tag retention rules|❌|❌|✅|✅|✅ | ||
| 364 | |Create/delete tag immutability rules|❌|❌|❌|✅|✅ | ||
| 365 | |Enable/deactivate tag immutability rules|❌|❌|❌|✅|✅ | ||
| 366 | |See project quotas|✅|✅|✅|✅|✅ | ||
| 367 | |Edit project quotas *|❌|❌|❌|❌|❌ | ||
| 368 | |Delete Project|❌|❌|❌|❌|✅ | ||
| 369 | |||
| 370 | ~* Only the Harbor system administrator can edit project quotas and add new scanners. | ||
| 371 | |||
| 372 | = Gitea = | ||
| 373 | |||
| 374 | Please note, that some terms used in DevOps-as-a-Service have different names in Gitea. Please check the following table to avoid any confusion. | ||
| 375 | |||
| |
5.1 | 376 | |=((( |
| |
1.1 | 377 | DevOps Portal |
| 378 | )))|=((( | ||
| 379 | Gitea | ||
| 380 | ))) | ||
| 381 | |((( | ||
| 382 | Project | ||
| 383 | )))|((( | ||
| 384 | Organization | ||
| 385 | ))) | ||
| 386 | |((( | ||
| 387 | Project Role | ||
| 388 | )))|((( | ||
| 389 | Team | ||
| 390 | ))) | ||
| 391 | |((( | ||
| 392 | Git Repository | ||
| 393 | )))|((( | ||
| 394 | Repository | ||
| 395 | ))) | ||
| 396 | |((( | ||
| 397 | Artifact Repository | ||
| 398 | )))|((( | ||
| 399 | Package | ||
| 400 | ))) | ||
| 401 | |((( | ||
| 402 | Issue Tracking | ||
| 403 | )))|((( | ||
| 404 | Project (currently disabled) | ||
| 405 | ))) | ||
| 406 | |||
| 407 | The **Owner** team has full admin permission in the Organization. This is a technical user used by the DevOps Portal for auto-provisioning. | ||
| 408 | |||
| |
5.1 | 409 | |=((( |
| |
1.1 | 410 | Gitea Role |
| 411 | )))|=((( | ||
| 412 | Portal Project Role | ||
| 413 | )))|=Permissions | ||
| 414 | |((( | ||
| 415 | Viewer | ||
| 416 | )))|Viewer|Read | ||
| 417 | |((( | ||
| 418 | Developer | ||
| 419 | )))|((( | ||
| 420 | Developer | ||
| 421 | )))|Read, Write | ||
| 422 | |(% colspan="1" %)((( | ||
| 423 | Master | ||
| 424 | )))|(% colspan="1" %)Master|Read, Write | ||
| 425 | |(% colspan="1" %)Admin|(% colspan="1" %)Admin|Read, Write, Repository create | ||
| 426 | |||
| 427 | = Nexus Project Roles = | ||
| 428 | |||
| 429 | For each role in a project a role in Nexus is created which includes one Privilege for each repository in the project. | ||
| 430 | |||
| |
5.1 | 431 | |=((( |
| |
1.1 | 432 | Role |
| |
5.1 | 433 | )))|=((( |
| |
1.1 | 434 | Admin |
| |
5.1 | 435 | )))|=((( |
| |
1.1 | 436 | Master |
| |
5.1 | 437 | )))|=((( |
| |
1.1 | 438 | Developer |
| |
5.1 | 439 | )))|=((( |
| |
1.1 | 440 | Viewer |
| 441 | ))) | ||
| |
5.1 | 442 | |((( |
| |
1.1 | 443 | ID |
| |
5.1 | 444 | )))|((( |
| |
1.1 | 445 | PROJECTKEY-admin |
| |
5.1 | 446 | )))|((( |
| |
1.1 | 447 | PROJECTKEY-master |
| |
5.1 | 448 | )))|((( |
| |
1.1 | 449 | PROJECTKEY-developer |
| |
5.1 | 450 | )))|((( |
| |
1.1 | 451 | PROJECTKEY-viewer |
| 452 | ))) | ||
| |
5.1 | 453 | |((( |
| |
1.1 | 454 | Name |
| |
5.1 | 455 | )))|((( |
| |
1.1 | 456 | PROJECTKEY-admin |
| |
5.1 | 457 | )))|((( |
| |
1.1 | 458 | PROJECTKEY-master |
| |
5.1 | 459 | )))|((( |
| |
1.1 | 460 | PROJECTKEY-developer |
| |
5.1 | 461 | )))|((( |
| |
1.1 | 462 | PROJECTKEY-viewer |
| 463 | ))) | ||
| |
5.1 | 464 | |((( |
| |
1.1 | 465 | Privilege |
| |
5.1 | 466 | )))|((( |
| |
1.1 | 467 | PROJECTKEY-docker-admin |
| 468 | |||
| 469 | PROJECTKEY-maven-admin | ||
| 470 | |||
| 471 | PROJECTKEY-//repotype//-admin | ||
| |
5.1 | 472 | )))|((( |
| |
1.1 | 473 | PROJECTKEY-docker-master |
| 474 | |||
| 475 | PROJECTKEY-maven-master | ||
| 476 | |||
| 477 | PROJECTKEY-//repotype//-master | ||
| |
5.1 | 478 | )))|((( |
| |
1.1 | 479 | PROJECTKEY-docker-developer |
| 480 | |||
| 481 | PROJECTKEY-maven-developer | ||
| 482 | |||
| 483 | PROJECTKEY-//repotype//-developer | ||
| |
5.1 | 484 | )))|((( |
| |
1.1 | 485 | PROJECTKEY-docker-viewer |
| 486 | |||
| 487 | PROJECTKEY-maven-viewer | ||
| 488 | |||
| 489 | PROJECTKEY-//repotype//-viewer | ||
| 490 | ))) | ||
| 491 | |||
| 492 | For each role in a project a **Privilege of type Repository Content Selector** is created which combines Content Selector (Project), Repository (Docker Registry) and Actions depending on the role. | ||
| 493 | |||
| |
5.1 | 494 | |=((( |
| |
1.1 | 495 | Privilege / Role |
| |
5.1 | 496 | )))|=((( |
| |
1.1 | 497 | Admin |
| |
5.1 | 498 | )))|=((( |
| |
1.1 | 499 | Master |
| |
5.1 | 500 | )))|=((( |
| |
1.1 | 501 | Developer |
| |
5.1 | 502 | )))|=((( |
| |
1.1 | 503 | Viewer |
| 504 | ))) | ||
| |
5.1 | 505 | |((( |
| |
1.1 | 506 | Name |
| |
5.1 | 507 | )))|((( |
| |
1.1 | 508 | PROJECTKEY-docker-admin |
| |
5.1 | 509 | )))|((( |
| |
1.1 | 510 | PROJECTKEY-docker-master |
| |
5.1 | 511 | )))|((( |
| |
1.1 | 512 | PROJECTKEY-docker-developer |
| |
5.1 | 513 | )))|((( |
| |
1.1 | 514 | PROJECTKEY-docker-viewer |
| 515 | ))) | ||
| |
5.1 | 516 | |((( |
| |
1.1 | 517 | Content Selector |
| |
5.1 | 518 | )))|((( |
| |
1.1 | 519 | PROJECTKEY-docker |
| |
5.1 | 520 | )))|((( |
| |
1.1 | 521 | PROJECTKEY-docker |
| |
5.1 | 522 | )))|((( |
| |
1.1 | 523 | PROJECTKEY-docker |
| |
5.1 | 524 | )))|((( |
| |
1.1 | 525 | PROJECTKEY-docker |
| 526 | ))) | ||
| |
5.1 | 527 | |((( |
| |
1.1 | 528 | Repository |
| |
5.1 | 529 | )))|((( |
| |
1.1 | 530 | docker-registry |
| |
5.1 | 531 | )))|((( |
| |
1.1 | 532 | docker-registry |
| |
5.1 | 533 | )))|((( |
| |
1.1 | 534 | docker-registry |
| |
5.1 | 535 | )))|((( |
| |
1.1 | 536 | docker-registry |
| 537 | ))) | ||
| |
5.1 | 538 | |((( |
| |
1.1 | 539 | Actions |
| |
5.1 | 540 | )))|((( |
| |
1.1 | 541 | delete, add, edit, browse, read |
| |
5.1 | 542 | )))|((( |
| |
1.1 | 543 | add, edit, browse, read |
| |
5.1 | 544 | )))|((( |
| |
1.1 | 545 | add, edit, browse, read |
| |
5.1 | 546 | )))|((( |
| |
1.1 | 547 | browse, read |
| 548 | ))) | ||
| 549 | |||
| |
5.1 | 550 | See [[https:~~/~~/help.sonatype.com/repomanager3/security/privileges>>url:https://help.sonatype.com/repomanager3/nexus-repository-administration/access-control/privileges]] for available Actions. |