search

ansible / awx

AWX provides a web-based user interface, REST API, and task engine built on top of Ansible. It is one of the upstream projects for Red Hat Ansible Automation Platform.
Other
14.06k stars 3.42k forks source link

Feature: team-centric permissions #429

Open wenottingham opened 7 years ago

wenottingham commented 7 years ago
ISSUE TYPE
COMPONENT NAME
SUMMARY

Piggybacking on https://github.com/ansible/awx/issues/166, the idea is that things created by a user in a team are created in a 'team' context by default and accessible by that team.

Example:

ADDITIONAL INFORMATION

I think to do this in the most user-obvious and "makes sense" way, we'd need to logically map "the team that gave the user permission to do the thing" -> "the team that is assigned to it."

For example, a user may be in 3 teams A, B, and C, but if team B is the one who can access the job template, team B is the one that can modify the schedules they create for it.

wwitzel3 commented 6 years ago

@wenottingham If a user is a member of multiple teams and each of those teams is granting access to the resource, which team should be made owner of the resource?

wenottingham commented 6 years ago

Good question. I'd say pick the first one, but if that's not a stable sort, could say 'undefined'.

MrBones757 commented 5 years ago

Hi all, is there any update on this feature? My organisation holds an ansible tower licence and this functionality would be great. I was referred to this by red hat support.

As far as the issue of multiple team inheritance goes, I would prompt the user to select one or more teams if they are a member of more than one. This would seem like the most logical solution to avoid setting the object into an invalid state, business wise. Would also be nice to toggle this as a setting (even via the settings.py file would be fine.)