diff --git a/src/pages/docs/best-practices/octopus-administration/users-roles-and-teams.md b/src/pages/docs/best-practices/octopus-administration/users-roles-and-teams.md index 9f9dd14c80..1da780c095 100644 --- a/src/pages/docs/best-practices/octopus-administration/users-roles-and-teams.md +++ b/src/pages/docs/best-practices/octopus-administration/users-roles-and-teams.md @@ -1,7 +1,7 @@ --- layout: src/layouts/Default.astro pubDate: 2023-01-01 -modDate: 2023-10-04 +modDate: 2026-08-12 title: Users, Roles, and Teams description: Guidelines and recommendations for managing RBAC in Octopus Deploy. navOrder: 80 @@ -13,6 +13,7 @@ A [user](/docs/security/users-and-teams/) is an entity that performs an action i A user can be directly or indirectly associated with a team. You can explicitly assign a user to a team. Or you can assign teams from [external auth providers](/docs/security/authentication) to Octopus Deploy teams. There are two kinds of users in Octopus Deploy: + - User Account: allowed to log in to both the Octopus Web Portal and Octopus API. Can be authenticated with external auth providers, username and password, or an Octopus API Key. - [Service Accounts](/docs/security/users-and-teams/service-accounts) are API-only accounts used for automated services that integrate with Octopus Deploy. It can only be authenticated with an Octopus API Key. @@ -36,6 +37,7 @@ We also recommend creating a unique service account per integration. For exampl **Octopus Deploy 2020.6** introduced the concept of expiring API keys. Our recommendation is to set up a periodic rotation of API keys following your companies policy on key expiration. If your company doesn't already have a policy, then our recommendation is: + - 90 days for service accounts. In other words, rotate the service account keys once a quarter. - 10-30 days for users. User account API keys should be used temporarily when writing an API script or testing an integration. @@ -43,32 +45,33 @@ If your company doesn't already have a policy, then our recommendation is: Octopus Deploy includes several built-in roles: -| User role | Description | -| -------------------- | ---------------------------------------- | -| Build Server | Build servers can publish packages, and create releases, deployments, runbook snapshots and runbook runs. | -| Certificate Manager | Certificate managers can edit certificates and export private-keys | -| Deployment Creator | Deployment creators can create new deployments and runbook runs. | -| Environment Manager | Environment managers can view and edit environments and their machines. | -| Environment Viewer | Environment viewers can view environments and their machines, but not edit them. | -| Package Publisher | Permits packages to be pushed to the Octopus Server's built-in NuGet feed. | -| Project Viewer | Project viewers have read-only access to a project. They can see a project in their dashboard, view releases and deployments. Restrict this role by project to limit it to a subset of projects, and restrict it by environment to limit which environments they can view deployments to. | -| Project Contributor | All project viewer permissions, plus: editing and viewing variables, editing the deployment steps. Project contributors can't create or deploy releases. | -| Project Initiator | All project viewer permissions, plus: create new projects. | -| Project Deployer | All project contributor permissions, plus: deploying releases, but not creating them. | -| Project Lead | All project contributor permissions, plus: creating releases, but not deploying them. | -| Release Creator | Release creators can create new releases and runbook snapshots. | -| Runbook Consumer | Runbook consumers can view and execute runbooks. | -| Runbook Producer | Runbook producers can edit and execute runbooks. | -| Space Managers | Space managers can do everything within the context of the space they own. | -| System Administrator | System administrators can do everything at the system level. | -| System Manager | System managers can do everything at the system level except certain system-level functions reserved for system administrators. | -| Tenant Manager | Tenant managers can edit tenants and their tags | +| User role | Description | +| --- | --- | +| Build Server | Build servers can publish packages, and create releases, deployments, runbook snapshots and runbook runs. They can't edit a runbook's steps or publish its snapshots. | +| Certificate Manager | Certificate managers can edit certificates and export private-keys | +| Deployment Creator | Deployment creators can create new deployments and runbook runs. | +| Environment Manager | Environment managers can view and edit environments and their machines. | +| Environment Viewer | Environment viewers can view environments and their machines, but not edit them. | +| Package Publisher | Permits packages to be pushed to the Octopus Server's built-in NuGet feed. | +| Project Viewer | Project viewers have read-only access to a project. They can see a project in their dashboard, view releases and deployments. Restrict this role by project to limit it to a subset of projects, and restrict it by environment to limit which environments they can view deployments to. | +| Project Contributor | All project viewer permissions, plus: editing and viewing variables, editing the deployment steps. Project contributors can't create or deploy releases. | +| Project Initiator | All project viewer permissions, plus: create new projects. | +| Project Deployer | All project contributor permissions, plus: deploying releases, but not creating them. | +| Project Lead | All project contributor permissions, plus: creating releases, but not deploying them. | +| Release Creator | Release creators can create new releases and runbook snapshots. | +| Runbook Consumer | Runbook consumers can view and execute runbooks. | +| Runbook Producer | Runbook producers can edit and execute runbooks. | +| Space Managers | Space managers can do everything within the context of the space they own. | +| System Administrator | System administrators can do everything at the system level. | +| System Manager | System managers can do everything at the system level except certain system-level functions reserved for system administrators. | +| Tenant Manager | Tenant managers can edit tenants and their tags | We recommend using the built-in roles as much as possible. When we write migration scripts or upgrade scripts that add additional permissions, we will ensure we update those built-in roles. Custom roles will be skipped, so we don't accidentally grant permissions. ## Teams Octopus Deploy includes four built-in teams: + - Everyone - Octopus Administrators - Octopus Managers @@ -83,20 +86,20 @@ Teams can either be a system team, meaning it can be used across all spaces, or Here are some of the more common scenarios we get asked about, along with the associated user roles and scope. For this example, our instance has four environments, **development**, **test**, **staging**, and **production**. - Developers have permissions to deploy to modify the deployment process and variables. Can deploy to the **development** and **test** environments. - - Add `Project Contributor` role to the Developers team, no scoping on environments or projects. - - Add `Release Creator` role to the Developers team, no scoping on environments or projects. - - Add `Environment Viewer` role to the Developers team, no scoping on environments or projects. - - Add `Deployment Creator` role to the Developers team, scope to **development** and **test** environments. + - Add `Project Contributor` role to the Developers team, no scoping on environments or projects. + - Add `Release Creator` role to the Developers team, no scoping on environments or projects. + - Add `Environment Viewer` role to the Developers team, no scoping on environments or projects. + - Add `Deployment Creator` role to the Developers team, scope to **development** and **test** environments. - QA has permissions to deploy to **test** and **staging**, cannot modify anything in the project. - - Add `Deployment Creator` role to the QA team, scope to **test**, and **staging**. - - Add `Project Viewer` role to the QA team, no scoping on environment or projects. + - Add `Deployment Creator` role to the QA team, scope to **test**, and **staging**. + - Add `Project Viewer` role to the QA team, no scoping on environment or projects. - Operations has permissions to deploy to **staging** and **production**, cannot modify the deployment process. They can add accounts, workers, and deployment targets. - - Add `Deployment Creator` role to the Operations team, scope to **test**, and **staging**. - - Add `Project Viewer` role to the Operations team, no scoping on environment or projects. - - Add `Environment Manager` role to the Operations team, no scoping on environment or projects. + - Add `Deployment Creator` role to the Operations team, scope to **test**, and **staging**. + - Add `Project Viewer` role to the Operations team, no scoping on environment or projects. + - Add `Environment Manager` role to the Operations team, no scoping on environment or projects. - Project Owners can only approve deployments; they cannot modify or deploy them. - - Add `Project Viewer` role to the Project Owners team, no scoping on environment or projects. - - Add `Environment Viewer` role to the Project Owners team, no scoping on environment or projects. + - Add `Project Viewer` role to the Project Owners team, no scoping on environment or projects. + - Add `Environment Viewer` role to the Project Owners team, no scoping on environment or projects. ## Further reading diff --git a/src/pages/docs/runbooks/runbook-permissions/index.md b/src/pages/docs/runbooks/runbook-permissions/index.md index 4c144332eb..dea2ad65ac 100644 --- a/src/pages/docs/runbooks/runbook-permissions/index.md +++ b/src/pages/docs/runbooks/runbook-permissions/index.md @@ -1,22 +1,27 @@ --- layout: src/layouts/Default.astro pubDate: 2023-01-01 -modDate: 2023-01-01 +modDate: 2026-08-12 title: Runbooks permissions description: Permissions are available to help you manage access to Runbooks. navOrder: 20 --- +:::div{.hint} +The `RunbookSnapshotCreate` permission is available from **Octopus 2026.3** onwards. Prior to this version, `RunbookEdit` covered creating snapshots. +::: + Permissions are available to help you manage access to Runbooks, these include: -| Permission | Description | +| Permission | Description | | ------------- | ------------- | -| RunbookView | You can view all things runbooks-related (from the runbooks themselves, to their process, runs and snapshots). | -| RunbookEdit | You can edit all things runbooks-related. | -| RunbookRunView | You can view runbook runs. | -| RunbookRunDelete | You can delete runbook runs. | -| RunbookRunCreate | You can create runbook runs (equivalent of `DeploymentCreate` in the deployment world). | +| RunbookView | You can view all things runbooks-related (from the runbooks themselves, to their process, runs and snapshots). | +| RunbookEdit | You can edit a runbook's process, and publish or delete its snapshots. | +| RunbookSnapshotCreate | You can create runbook snapshots. | +| RunbookRunView | You can view runbook runs. | +| RunbookRunDelete | You can delete runbook runs. | +| RunbookRunCreate | You can create runbook runs (equivalent of `DeploymentCreate` in the deployment world). | You can limit your teams ability to create runbooks by disabling these permissions. @@ -32,10 +37,10 @@ There are roles we include out-of-the-box to encapsulate these new permissions: Octopus Deploy is built API-first, which means everything you can do through the Octopus UI can be done with the API. In the API, we model the runbook and its process the same way, starting at the project: - Project -- Runbooks _(a project can have many runbooks, with RunbookView/RunbookEdit permissions.)_ -- RunbookProcess _(a runbook has one process / collection of steps, with ProcessEdit permissions.)_ -- RunbookSnapshots _(a runbook can have many snapshots, each with a unique name, with RunbookEdit permissions.)_ -- RunbookRuns _(a runbook snapshot will then be run/executed against an environment, with RunbookRunCreate permissions.)_ +- Runbooks *(a project can have many runbooks, with RunbookView/RunbookEdit permissions.)* +- RunbookProcess *(a runbook has one process / collection of steps, with ProcessEdit permissions.)* +- RunbookSnapshots *(a runbook can have many snapshots, each with a unique name. Creating a snapshot needs RunbookSnapshotCreate, and publishing or deleting one needs RunbookEdit.)* +- RunbookRuns *(a runbook snapshot will then be run/executed against an environment, with RunbookRunCreate permissions.)* We have provided lots of helpful functions for building your runbook process in the [.NET SDK](/docs/octopus-rest-api/octopus.client), or you can use the raw HTTP API if that suits your needs better. diff --git a/src/pages/docs/runbooks/runbook-publishing/index.md b/src/pages/docs/runbooks/runbook-publishing/index.md index f816c53a4b..9e9e00c327 100644 --- a/src/pages/docs/runbooks/runbook-publishing/index.md +++ b/src/pages/docs/runbooks/runbook-publishing/index.md @@ -1,21 +1,22 @@ --- layout: src/layouts/Default.astro pubDate: 2023-01-01 -modDate: 2023-01-01 +modDate: 2026-08-12 title: Runbooks publishing description: Publishing makes a runbook available to scheduled triggers and consumers. navOrder: 30 --- :::div{.success} -Config-as-code runbooks use branches instead of publishing. If your project uses config-as-code runbooks, read about [managing runbooks permissions using branches](/docs/runbooks/config-as-code-runbooks#permissions-by-branch) instead. +Config-as-code runbooks use branches instead of publishing. If your project uses config-as-code runbooks, read about [managing runbooks permissions using branches](/docs/runbooks/config-as-code-runbooks#permissions-by-branch) instead. ::: -Runbooks and deployments define their processes in exactly the same way. However, where a deployment has a [release](/docs/releases), a runbook has what is called a Snapshot. +Runbooks and deployments define their processes in exactly the same way. However, where a deployment has a [release](/docs/releases), a runbook has what is called a Snapshot. ## Snapshots For a given runbook, you can have two snapshots: + - Draft - Published @@ -26,16 +27,20 @@ Similar to releases, the version of any packages that are used in the runbook ar A draft snapshot of a runbook is exactly what it sounds like, a draft version of the currently published version. Drafts are meant to give you a place to work and save a runbook that is a work in progress or has not yet been approved for general use. :::div{.hint} -Draft snapshots can't be used to create a [scheduled runbook trigger](/docs/runbooks/scheduled-runbook-trigger), only published snapshots can. +Draft snapshots can't be used to create a [scheduled runbook trigger](/docs/runbooks/scheduled-runbook-trigger), only published snapshots can. ::: ## Published snapshot The concept of a published snapshot is designed to help avoid confusion when selecting a version of the runbook you're supposed to run if you're not the author. You can think of it as the "Production" ready version of the runbook, which has been approved for general use. -Publishing makes a runbook available to scheduled triggers and consumers (anyone with an appropriately scoped `RunbookRunCreate` permission, but without the `RunbookEdit` permission). Triggers and consumers will always execute the published snapshot. +:::div{.hint} +The `RunbookSnapshotCreate` permission is available from **Octopus 2026.3** onwards. Prior to this version, `RunbookEdit` covered creating snapshots. +::: + +Publishing makes a runbook available to scheduled triggers and consumers (anyone with an appropriately scoped `RunbookRunCreate` permission, but without the `RunbookSnapshotCreate` permission). Triggers and consumers will always execute the published snapshot. -The published snapshot contains the process, variables, and packages. This allows editing and testing the runbook without impacting the published version. +The published snapshot contains the process, variables, and packages. This allows editing and testing the runbook without impacting the published version. ### Publishing a snapshot @@ -53,8 +58,8 @@ Publish from process: ![Publish runbook from process page](/docs/img/runbooks/runbook-publishing/runbook-publish-process.png) ::: -When a producer (anyone with an appropriately scoped `RunbookEdit` permission) executes a runbook, they will have the option between executing the published version or the current draft. +When a producer (anyone with an appropriately scoped `RunbookSnapshotCreate` permission) executes a runbook, they will have the option between executing the published version or the current draft. Running the current draft allows testing changes before publishing. The latest version of the process and variables will be used and package versions will be prompted for. -![Run current draft](/docs/img/runbooks/runbook-publishing/runbook-run-draft.png) \ No newline at end of file +![Run current draft](/docs/img/runbooks/runbook-publishing/runbook-run-draft.png) diff --git a/src/pages/docs/security/users-and-teams/default-permissions.md b/src/pages/docs/security/users-and-teams/default-permissions.md index 9049219a1c..6fc32d21c8 100644 --- a/src/pages/docs/security/users-and-teams/default-permissions.md +++ b/src/pages/docs/security/users-and-teams/default-permissions.md @@ -1,7 +1,7 @@ --- layout: src/layouts/Default.astro pubDate: 2023-01-01 -modDate: 2025-11-20 +modDate: 2026-08-12 title: Default permissions for built-in user roles description: A listing of the default permissions for each of the built-in user roles. --- @@ -25,9 +25,9 @@ description: A listing of the default permissions for each of the built-in user | ProjectView | View the details of projects | | ReleaseCreate | Create a release for a project | | ReleaseView | View a release of a project | -| RunbookEdit | Edit runbooks | | RunbookRunCreate | Create runbook runs | | RunbookRunView | View runbook runs | +| RunbookSnapshotCreate | Create runbook snapshots | | RunbookView | View runbooks | | TaskView | View summary-level information associated with a task | | TenantView | View tenants | @@ -182,6 +182,7 @@ description: A listing of the default permissions for each of the built-in user | ReleaseView | View a release of a project | | RunbookEdit | Edit runbooks | | RunbookRunView | View runbook runs | +| RunbookSnapshotCreate | Create runbook snapshots | | RunbookView | View runbooks | | TaskCreate | Explicitly create (run) server tasks | | TaskView | View summary-level information associated with a task | @@ -237,6 +238,7 @@ description: A listing of the default permissions for each of the built-in user | RunbookEdit | Edit runbooks | | RunbookRunCreate | Create runbook runs | | RunbookRunView | View runbook runs | +| RunbookSnapshotCreate | Create runbook snapshots | | RunbookView | View runbooks | | TaskCancel | Cancel server tasks | | TaskCreate | Explicitly create (run) server tasks | @@ -331,6 +333,7 @@ description: A listing of the default permissions for each of the built-in user | ReleaseView | View a release of a project | | RunbookEdit | Edit runbooks | | RunbookRunView | View runbook runs | +| RunbookSnapshotCreate | Create runbook snapshots | | RunbookView | View runbooks | | TaskCreate | Explicitly create (run) server tasks | | TaskView | View summary-level information associated with a task | @@ -375,16 +378,17 @@ description: A listing of the default permissions for each of the built-in user ## Release Creator {#DefaultPermissions-ReleaseCreator} -| Space Permission | Description | -| ---------------- | ------------------------------------------------------------------ | -| EnvironmentView | View environments | -| FeedView | View package feeds and the packages in them | -| ProcessView | View the deployment process and channels associated with a project | -| ProjectView | View the details of projects | -| ReleaseCreate | Create a release for a project | -| ReleaseView | View a release of a project | -| RunbookEdit | Edit runbooks | -| RunbookView | View runbooks | +| Space Permission | Description | +| --------------------- | ------------------------------------------------------------------ | +| EnvironmentView | View environments | +| FeedView | View package feeds and the packages in them | +| ProcessView | View the deployment process and channels associated with a project | +| ProjectView | View the details of projects | +| ReleaseCreate | Create a release for a project | +| ReleaseView | View a release of a project | +| RunbookEdit | Edit runbooks | +| RunbookSnapshotCreate | Create runbook snapshots | +| RunbookView | View runbooks | ## Runbook Consumer {#DefaultPermissions-RunbookConsumer} @@ -444,6 +448,7 @@ description: A listing of the default permissions for each of the built-in user | RunbookRunCreate | Create runbook runs | | RunbookRunDelete | Delete runbook runs | | RunbookRunView | View runbook runs | +| RunbookSnapshotCreate | Create runbook snapshots | | RunbookView | View runbooks | | TaskCancel | Cancel server tasks | | TaskCreate | Explicitly create (run) server tasks | @@ -546,6 +551,7 @@ description: A listing of the default permissions for each of the built-in user | RunbookRunCreate | Create runbook runs | | RunbookRunDelete | Delete runbook runs | | RunbookRunView | View runbook runs | +| RunbookSnapshotCreate | Create runbook snapshots | | RunbookView | View runbooks | | SubscriptionCreate | Create subscriptions | | SubscriptionDelete | Delete subscriptions | diff --git a/src/pages/docs/security/users-and-teams/user-roles.md b/src/pages/docs/security/users-and-teams/user-roles.md index c03a83b0b8..31385a9551 100644 --- a/src/pages/docs/security/users-and-teams/user-roles.md +++ b/src/pages/docs/security/users-and-teams/user-roles.md @@ -1,7 +1,7 @@ --- layout: src/layouts/Default.astro pubDate: 2023-01-01 -modDate: 2023-01-01 +modDate: 2026-08-12 title: User roles description: User roles are a critical part of the Octopus security model whereby they are assigned to Teams and they dictate what the members of those teams can do in Octopus. --- @@ -12,25 +12,25 @@ User roles and group permissions play a major part in the Octopus security model Octopus comes with a set of built-in user roles that are designed to work for most common scenarios: -| User role | Description | -| -------------------- | ---------------------------------------- | -| Build Server | Build servers can publish packages, and create releases, deployments, runbook snapshots and runbook runs. | -| Certificate Manager | Certificate managers can edit certificates and export private-keys | -| Deployment Creator | Deployment creators can create new deployments and runbook runs. | -| Environment Manager | Environment managers can view and edit environments and their machines. | -| Environment Viewer | Environment viewers can view environments and their machines, but not edit them. | -| Package Publisher | Permits packages to be pushed to the Octopus Server's built-in NuGet feed. | -| Project Viewer | Project viewers have read-only access to a project. They can see a project in their dashboard, view releases and deployments. Restrict this role by project to limit it to a subset of projects, and restrict it by environment to limit which environments they can view deployments to. | -| Project Contributor | All project viewer permissions, plus: editing and viewing variables, editing the deployment steps. Project contributors can't create or deploy releases. | -| Project Initiator | All project viewer permissions, plus: create new projects. | -| Project Deployer | All project contributor permissions, plus: deploying releases, but not creating them. | -| Project Lead | All project contributor permissions, plus: creating releases, but not deploying them. | -| Release Creator | Release creators can create new releases and runbook snapshots. | -| Runbook Consumer | Runbook consumers can view and execute runbooks. | -| Runbook Producer | Runbook producers can edit and execute runbooks. | -| System Administrator | System administrators can do everything at the system level. | -| System Manager | System managers can do everything at the system level except certain system-level functions reserved for system administrators. | -| Tenant Manager | Tenant managers can edit tenants and their tags | +| User role | Description | +| --- | --- | +| Build Server | Build servers can publish packages, and create releases, deployments, runbook snapshots and runbook runs. They can't edit a runbook's steps or publish its snapshots. | +| Certificate Manager | Certificate managers can edit certificates and export private-keys | +| Deployment Creator | Deployment creators can create new deployments and runbook runs. | +| Environment Manager | Environment managers can view and edit environments and their machines. | +| Environment Viewer | Environment viewers can view environments and their machines, but not edit them. | +| Package Publisher | Permits packages to be pushed to the Octopus Server's built-in NuGet feed. | +| Project Viewer | Project viewers have read-only access to a project. They can see a project in their dashboard, view releases and deployments. Restrict this role by project to limit it to a subset of projects, and restrict it by environment to limit which environments they can view deployments to. | +| Project Contributor | All project viewer permissions, plus: editing and viewing variables, editing the deployment steps. Project contributors can't create or deploy releases. | +| Project Initiator | All project viewer permissions, plus: create new projects. | +| Project Deployer | All project contributor permissions, plus: deploying releases, but not creating them. | +| Project Lead | All project contributor permissions, plus: creating releases, but not deploying them. | +| Release Creator | Release creators can create new releases and runbook snapshots. | +| Runbook Consumer | Runbook consumers can view and execute runbooks. | +| Runbook Producer | Runbook producers can edit and execute runbooks. | +| System Administrator | System administrators can do everything at the system level. | +| System Manager | System managers can do everything at the system level except certain system-level functions reserved for system administrators. | +| Tenant Manager | Tenant managers can edit tenants and their tags | The built-in user roles can be modified to contain more or less roles to suit specific needs. But instead of modifying the built-in ones, we recommend that you leave them as an example and instead create your own user roles. @@ -40,13 +40,12 @@ To view the default permissions for each of the built-in user roles, please see ### Additional user roles for spaces - -| User Role | Description | -| -------------------- | ---------------------------------------- | -| Space Manager | Space managers can do everything within the context of the space they own. | +| User Role | Description | +| --- | --- | +| Space Manager | Space managers can do everything within the context of the space they own. | :::div{.success} -For more information regarding the _system or space level_, please see [system and space permissions](/docs/security/users-and-teams/system-and-space-permissions). +For more information regarding the *system or space level*, please see [system and space permissions](/docs/security/users-and-teams/system-and-space-permissions). ::: ## Creating user roles {#UserRoles-CreatingUserRoles} @@ -55,20 +54,20 @@ A custom User Role can be created with any combination of permissions. To create 1. Under the **Configuration** page, click **Roles**. - ![](/docs/img/security/users-and-teams/images/roles-link.png) + ![Roles link in the Configuration menu](/docs/img/security/users-and-teams/images/roles-link.png) 2. Click **Add custom role**. 3. Select the set of permissions you'd like this new User Role to contain, and give the role a name and description. These can be system or space level permissions. - ![](/docs/img/security/users-and-teams/images/select-permissions.png) + ![Selecting permissions for a custom user role](/docs/img/security/users-and-teams/images/select-permissions.png) Once the custom role is saved, the new role will be available to be assigned to teams in Octopus. [Some rules apply](/docs/security/users-and-teams/system-and-space-permissions/#SystemAndSpacePermissions-RulesOfTheRoad), depending on the mix of system or space level permissions you chose. When applying roles to a team, you can optionally specify a scope for each role applied. This enables some complex scenarios, like granting a team [different levels of access](/docs/security/users-and-teams/creating-teams-for-a-user-with-mixed-environment-privileges) based on the environment they are authorized for. :::figure -![](/docs/img/security/users-and-teams/images/define-scope-for-user-role.png) +![Defining scope for a user role in a team](/docs/img/security/users-and-teams/images/define-scope-for-user-role.png) ::: ## Troubleshooting permissions {#UserRoles-TroubleshootingPermissions} @@ -80,20 +79,20 @@ To test the permissions go to **Configuration ➜ Test Permissions** and select The results will show: - The teams of which the user is a member of. There are two separate Permission context that you can check. - - **Show System permissions** will show [System level permissions](/docs/security/users-and-teams/system-and-space-permissions) - - **Show permissions within a specific space** will show [Space specific Permissions](/docs/security/users-and-teams/system-and-space-permissions). + - **Show System permissions** will show [System level permissions](/docs/security/users-and-teams/system-and-space-permissions) + - **Show permissions within a specific space** will show [Space specific Permissions](/docs/security/users-and-teams/system-and-space-permissions). - A chart detailing each role and on which Environment/Project this permission can be executed. The chart can be exported to a CSV file by clicking the Export button. Once the file is downloaded it can viewed in browser using [Online CSV Editor and Viewer](https://www.convertcsv.com/csv-viewer-editor.htm). :::figure -![](/docs/img/security/users-and-teams/images/systempermissions.png) +![System permissions test results](/docs/img/security/users-and-teams/images/systempermissions.png) ::: -![](/docs/img/security/users-and-teams/images/spacelevelpermissions.png) +![Space level permissions test results](/docs/img/security/users-and-teams/images/spacelevelpermissions.png) If a user tries to perform an action without having enough permissions to do it, an error message will pop up showing which permissions the user is lacking, and which teams actually have these permissions. :::figure -![](/docs/img/security/users-and-teams/images/errors.png) +![Error message showing missing permissions](/docs/img/security/users-and-teams/images/errors.png) ::: :::div{.warning} diff --git a/src/shared-content/scripts/project-permissions-report.include.md b/src/shared-content/scripts/project-permissions-report.include.md index 426624503f..5487ca4cc3 100644 --- a/src/shared-content/scripts/project-permissions-report.include.md +++ b/src/shared-content/scripts/project-permissions-report.include.md @@ -516,6 +516,7 @@ foreach ($space in $spaceList) ArtifactViewPermissions = @() RunbookViewPermissions = @() RunbookEditPermissions = @() + RunbookSnapshotCreatePermissions = @() RunbookRunViewPermissions = @() RunbookRunCreatePermissions = @() ManualInterventionViewPermissions = @() @@ -590,6 +591,7 @@ foreach ($space in $spaceList) $projectPermission.RunbookViewPermissions = @(Get-UserPermission -space $space -project $project -userRole $userRole -projectPermissionList $projectPermission.RunbookViewPermissions -permissionToCheck "RunbookView" -environmentList $environmentList -tenantList $tenantList -user $user -scopedRole $scopedRole -includeScope $false -projectEnvironmentList $projectEnvironmentList) $projectPermission.RunbookEditPermissions = @(Get-UserPermission -space $space -project $project -userRole $userRole -projectPermissionList $projectPermission.RunbookEditPermissions -permissionToCheck "RunbookEdit" -environmentList $environmentList -tenantList $tenantList -user $user -scopedRole $scopedRole -includeScope $false -projectEnvironmentList $projectEnvironmentList) + $projectPermission.RunbookSnapshotCreatePermissions = @(Get-UserPermission -space $space -project $project -userRole $userRole -projectPermissionList $projectPermission.RunbookSnapshotCreatePermissions -permissionToCheck "RunbookSnapshotCreate" -environmentList $environmentList -tenantList $tenantList -user $user -scopedRole $scopedRole -includeScope $false -projectEnvironmentList $projectEnvironmentList) $projectPermission.RunbookRunViewPermissions = @(Get-UserPermission -space $space -project $project -userRole $userRole -projectPermissionList $projectPermission.RunbookRunViewPermissions -permissionToCheck "RunbookRunView" -environmentList $environmentList -tenantList $tenantList -user $user -scopedRole $scopedRole -includeScope $true -projectEnvironmentList $projectEnvironmentList) $projectPermission.RunbookRunCreatePermissions = @(Get-UserPermission -space $space -project $project -userRole $userRole -projectPermissionList $projectPermission.RunbookRunCreatePermissions -permissionToCheck "RunbookRunCreate" -environmentList $environmentList -tenantList $tenantList -user $user -scopedRole $scopedRole -includeScope $true -projectEnvironmentList $projectEnvironmentList) @@ -637,6 +639,7 @@ foreach ($permission in $permissionsReport) Write-PermissionList -permissionName "Runbook View" -permissionList $permission.RunbookViewPermissions -permission $permission -reportPath $reportPath Write-PermissionList -permissionName "Runbook Edit" -permissionList $permission.RunbookEditPermissions -permission $permission -reportPath $reportPath + Write-PermissionList -permissionName "Runbook Snapshot Create" -permissionList $permission.RunbookSnapshotCreatePermissions -permission $permission -reportPath $reportPath Write-PermissionList -permissionName "Runbook Run View" -permissionList $permission.RunbookRunViewPermissions -permission $permission -reportPath $reportPath Write-PermissionList -permissionName "Runbook Run Create" -permissionList $permission.RunbookRunCreatePermissions -permission $permission -reportPath $reportPath