we have an interesting
conundrum that I havnt been able to hack out yet. Please note that this is for a private cloud
installation – but for anyone who is interested in providing CI services to a
public cloud instance – you might want
to watch this space!
Currently – we have created
policy groups w/ specific sets of permissions for users of the UI and the
Management API.
Generally we are running
under the following assumptions:
1)We have an organization that might contain many different
classes of users who would have access only to the proxies, products, and applications
that they create.
2)Nobody
who is in these various groups is an org admin by design
3)Each
of these groups has the ability to CREATE proxies, CREATE products, and CREATE
apps
4)We have demonstrated that most of the time when a user in one of
these groups creates a proxy or a product in the UI, they are automatically
granted control over the app in the ui.
There are some exceptions to this which we are trying to pin down as
they cause mayhem in the organization –(but this isnt the point of this post!)
Here is the problem: when a permissioned user uses node tool to
create a proxy or product their group is NOT granted control over the proxy or
product they are creating. They are
unable to follow up a create with an edit.
They are unable to log into the UI and fix things. It takes the intervention of an ORG admin to
assign the correct permissions.
So does anyone have a
solution to this problem that does not include granting Org Admin permissions
to accounts performing CI activities?
LinkedIn
Twitter
