[Feature request] Fine-Grained Access Controls for Ad-Hoc queries

kolide / fleet

A flexible control server for osquery fleets

https://kolide.com/fleet

MIT License

1.1k stars 261 forks source link

[Feature request] Fine-Grained Access Controls for Ad-Hoc queries #2077

Open chunyong-lin opened 5 years ago

chunyong-lin commented 5 years ago

Fleet server currently provisions only two roles within the web application: an administrator and a non-administrator. And both roles has permission to Ad-Hoc query against any endpoints.

In some cases, there will be different teams access the Fleet server and we would like to have more comprehensive authorization to allow certain user groups to query certain (group of) endpoints.

benbasscom commented 5 years ago

This feature, as well as preventing some users from creating packs, but allowing ad-hoc queries would be very useful as well.

jalseth commented 5 years ago

Agreed. I'd take this a step further and add the ability to create custom user groups that can have X Y and/or Z privileges inside of the Fleet UI and API. It would be even better if these user groups could be linked to attributes from SAML.