Roles

As we have some requests for changes and additions of "Groups" in VisualCron we are now opening this separate thread for discussion. Please feel free to join and give any comments.

Adding the support for roles/groups will break a lot of existing functionality in VisualCron. Besides for the major code changes the permissions on user probably have to be redefined. Because of that, it is important to set the level and functionality right the first time as changes later will be hard.

Basic list of changes and thoughts:

* a new Roles window will be created. Maybe as a part of Permissions/Users. Add/Remove/Edit/Clone roles. The role should now be carrying all permissions - and a role/group name and Id. The old permissions are removed from the User object in users.xml and will from now on only contain basic contact information - and a link to a role.
* a new tab is created in the Job window - called Permissions. Here you can select which roles that have access to this Job
* Permissions are moved from users.xml to roles.xml. This file needs to be added for export and import.
* By default, a new user is getting all admin roles unless specified else. But first time always admin
* we will probably add support for defining default group/role
* roles/groups should work on existing users - independent if they are AD users or not

Questions:

1. do we need more detailed permissions in Roles? It is a good time for adding and removing permissions when doing a change like this
2. is there any reason to have more than one role per user?
3. where do we need to select roles? In Jobs, in Tasks - in more places?

---

+1 for this.

1. do we need more detailed permissions in Roles? It is a good time for adding and removing permissions when doing a change like this

Permissions look fine to me

2. is there any reason to have more than one role per user?

A server with QA/Staging/Prod jobs on it. I'd have a role for each group and want to assign the role to that group i.e. QA job group would have QA Read / QA Action / QA Admin roles. A developer might have access to QA Admin / Staging Action / Prod Read while an OPs person would have QA/Staging Admin / Prod Action.

3. where do we need to select roles? In Jobs, in Tasks - in more places?

At the job group level as well.

1. do we need more detailed permissions in Roles? It is a good time for adding and removing permissions when doing a change like this

Read Permission. If a user is not part of a Role assigned to a specific Job, the Job should not be shown either by the VC Client or API calls. Apart from users not having visibility to jobs that don’t concern them, jobs filtered out by the server would cut down on traffic generated by a VC connection on the LAN/WAN/VPN.

2. is there any reason to have more than one role per user?

Ideally a user should be able to belong to multiple Roles but how to handle permission collisions. This would happen if Roles assigned to a job contains the same user with conflicting permissions.

3. where do we need to select roles? In Jobs, in Tasks - in more places?

I would suggest that you don’t want to go any lower than Jobs when assigning Roles.
Allowing Roles to be added at a Group level would really simplify things. Again the question comes up about the handling of security collisions and how to deal with it.

Thanks
Anton

We are currently working on this and have created a document regarding this:

https://docs.google.com/...k6nuqbdLJl_oDroR7pE/edit 

Please post any comments or questions here. Especially read the part "User permissions on Job level" and give us feedback about implementation.

Thank you!

---

Version released with group and Job permission support:

http://www.visualcron.co....aspx?g=posts&t=2505 

---

I see from searching the forums, that an early request for the permissions support included a request for
"3) Give a user the ability to "Inactivate/Reactive" a Job or Task without giving the user Edit ability"

This is a permission that I am specifically looking for, as I want on-call workers to have the ability to de-activate a problematic job without deleting it or editing it, and re-activate it if a data problem is resolved, or leave it to me or another VC job maintainer to edit the job if necessary.

Am I overlooking functionality that is there already, or has this not been added? If it has not been added, can it be?
and what is "Lists" permission? It's not documented in the Help file for 8.0.0.

Also, it's kind of awkward getting to the dialog to configure a new permissions group. I have to first edit an existing user, even if that user isn't going to be in the group that I want to add or edit.

I currently have version 8.0.0 on my remote client, and 8.1.0 (I think) on the server.

Thanks,

Rebeccah