TACC-Cloud / tapis-cli

Next-generation Tapis CLI
BSD 3-Clause "New" or "Revised" License
14 stars 5 forks source link

System role grants in "tapis apps deploy" should not overwrite existing roles #319

Closed mwvaughn closed 4 years ago

mwvaughn commented 4 years ago

A helpful affordance provided by the "apps deploy" command is to automatically grant users USER role on private deployment and execution systems referenced by a private app. As implemented, this overwrites any grant that has been done out of band by the app or system owner. This breaks cases where, for instance, a portal role account is granted ADMIN on such systems.

The correct behavior is to check for existence of grants and not overwrite them.