search

itk-dev-rpa / OpenOrchestrator

MIT License
1 stars 4 forks source link

Make it possible to restrict processes to certain users/machines #82

Open hbpe-aarhus opened 6 months ago

hbpe-aarhus commented 6 months ago

Currently, if multiple schedulers are connected to a single orchestrator database, it is not possible to control which user/machine combination executes a specific process.

We would like to be able to dedicate certain combinations of user/machine to specific processes. Both to reduce the number of orchestrator databases needed, but also to dedicate resources to time-critical processes.

Restriction could either be at process-level or at trigger-level.

A possible solution could be to let each scheduler have its own whitelist of processes that it is allowed to execute. The whitelist could be an extra option that needs to be enabled such that current setups are unaffected. Alternatively, one could make it possible to configure from the orchestrator GUI.

ghbm-itk commented 6 months ago

This should be possible to implement. It would probably be best if it's controlled in the Orchestrator application. It could be given as a list of pc names on the trigger where an empty list means that it can run wherever.

hbpe-aarhus commented 6 months ago

Yes, I agree that controlling it centrally from the Orchestrator application would be preferable.

Am I correct in assuming that it's not feasible to run several service accounts on the same machine? If so, the machine name would be sufficient, as you suggest. Although from a permissions perspective, I think mapping to the service account could make more sense.