Advanced user permissions to allow users to view some reports only

[mattab]

In Piwik a "view" or "admin" user can see all reports.

We could add a new Admin tab, or sub-tab to the Users tab, that would let Super User assign users a set of specific permissions, rather than the default "view all".

Implementation: we could use the existing hook in frontcontroller, that would let a plugin manage the permission to access this specific controller.action call:

Piwik_PostEvent('FrontController.dispatch', $params);

(Note: maybe needs to be moved inside the try block just below.

See a screenshot for an example from another tool.

Note:

• This ticket is related to another feature request, "Define User Groups which are set of pemissions, and assign to users a group".
  • Maybe we should implement this ticket using a "group" mechanism, or maybe not, to be discussed. definitely, definining groups would be better as it would allow to reuse a set of permissions (eg. View all reports except Ecommerce reports), and easily assign to other users.

Anyone interested and have some time, please let's discuss the implementation,

[mattab]

Attachment: Advanced permissions settings.png

[mattab]

Duplicated by #4488

Btw If you are interested by this feature, contact Piwik experts via: http://piwik.org/consulting/ and we can build it for you!

[matthar]

Hello @mattab ,

i'm very interested in this feature. I've been looking for something like this for hours, but couldn't find a similar solution.

Is this feature already in development?

[mattab]

@matthar This feature is not in development yet - and not scheduled. But it would be great to have this in Piwik. Maybe oAuth2 could be implemented as standard solution? #906

[pruss]

Do have any estimations how much time and money it would require to implement this feature, i.e. limit access to widgets for users? Pls drop PM.

[mattab]

A customer also requested the abilty to restrict "View" users and not allow them to create/edit custom dashboards. Maybe if we release an advanced permission system it would need to also handle these extra permissions...