Skip to content

Commit 13ed724

Browse files
VeljkoMaksimovicVeljkoMaksimovic
committed
Adding rbac related stuff without custom roles
1 parent 9dee20b commit 13ed724

File tree

4 files changed

+292
-0
lines changed

4 files changed

+292
-0
lines changed

‎docs/security/default-roles.md

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
Default roles are available to all Semaphore users, regardless of the plan they are on.
2+
3+
### Organization roles
4+
<table style="background-color: rgb(255, 255, 255);">
5+
<thead>
6+
<tr>
7+
<td>
8+
Role name
9+
</td>
10+
<td>
11+
Permissions
12+
</td>
13+
<td>
14+
Notes
15+
</td>
16+
</tr>
17+
</thead>
18+
<tbody>
19+
<tr>
20+
<td>
21+
**Member**
22+
</td>
23+
<td>
24+
<ul>
25+
<li>Can create new projects.</li>
26+
<li>Can view existing notifications and settings.</li>
27+
</ul>
28+
</td>
29+
<td>
30+
</td>
31+
</tr>
32+
<tr>
33+
<td>
34+
**Admin**
35+
</td>
36+
<td>
37+
<ul>
38+
<li>Can do everything a member can.</li>
39+
<li>Can view, manage, and modify everything within the organization
40+
(people, secrets, pre-flight checks,
41+
notifications, etc), except general settings and financial information.</li>
42+
</ul>
43+
</td>
44+
<td>
45+
Each of the organization's Admins is also Admin within every project owned by the given organization automatically.
46+
</td>
47+
</tr>
48+
<tr>
49+
<td>
50+
**Owner**
51+
</td>
52+
<td>
53+
<ul>
54+
<li>Can do everything within the organization, including changing general
55+
settings and deleting it.</li>
56+
</ul>
57+
</td>
58+
<td>
59+
By default, this role is assigned to the user that creates the organization.
60+
<br/>
61+
Each of the organization's Owners is also Admin within every project owned by the given organization.
62+
</td>
63+
</tr>
64+
</tbody>
65+
</table>
66+
67+
### Project roles
68+
<table style="background-color: rgb(255, 255, 255);">
69+
<thead>
70+
<tr>
71+
<td>
72+
Role name
73+
</td>
74+
<td>
75+
Permissions
76+
</td>
77+
<td>
78+
Notes
79+
</td>
80+
</tr>
81+
</thead>
82+
<tbody>
83+
<tr>
84+
<td>
85+
**Reader**
86+
</td>
87+
<td>
88+
<ul>
89+
<li>Can view project activity, workflows, and jobs executed within those workflows.</li>
90+
</ul>
91+
</td>
92+
<td>
93+
Intended for someone who should monitor what is being done, but isn't a developer and shouldn't
94+
modify anything. Perhaps an Engineering Project Manager.
95+
</td>
96+
</tr>
97+
<tr>
98+
<td>
99+
**Contributor**
100+
</td>
101+
<td>
102+
<ul>
103+
<li>Can manually run, modify and stop workflows/jobs.</li>
104+
<li>Can view project-level secrets and organization-wide secrets scoped for the given project.</li>
105+
<li>Can attach to running jobs or debug jobs and projects.</li>
106+
<li>Can view schedulers, project insights, and repository info.</li>
107+
<li>Can manually run schedulers.</li>
108+
<li>Can view, modify and delete artifacts for that project.</li>
109+
</ul>
110+
</td>
111+
<td>
112+
For developers who are currently working on the project, but aren't responsible for maintaining it
113+
and setting up/modifying the environment in which the project exists.
114+
</td>
115+
</tr>
116+
<tr>
117+
<td>
118+
**Admin**
119+
</td>
120+
<td>
121+
<ul>
122+
<li>Can do everything within the project, including deleting it.</li>
123+
</ul>
124+
</td>
125+
<td>
126+
By default, this role is assigned to the user that created the project, and
127+
this user is a primary repository token holder.
128+
</td>
129+
</tr>
130+
</tbody>
131+
</table>
132+

‎docs/security/rbac-authorization.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
Description: This page explains the RBAC model that Semaphore 2.0 uses for user authorization. Here, you will find information about existing permissions, roles, and role management.
3+
---
4+
5+
# Rbac model
6+
7+
Semaphore 2.0 uses a **Role-Based Access Control** model for user authorization.
8+
This page will give a brief overview of permissions, roles, and how to manage them.
9+
10+
## Roles on Semaphore
11+
12+
All of the roles (and permissions) within the Semaphore are divided into __organization-level__ and __project-level__.<br />
13+
Organization-level roles define access to functionalities and assets that apply to the entire organization (Audit Logs, Billing,
14+
Organization Members, Projects, etc.).<br/>
15+
On the other hand, project-level roles are assigned within a single project, and grant access
16+
to information scoped only to that one project (Schedulers, Insights, Workflows, Artifacts).
17+
To get any project-level role, you have to be a part of the organization
18+
which owns that project (you must have a role within the organization).
19+
20+
There is a set of pre-defined [default roles](/security/default-roles) that are available to all users.
21+
22+
## Role Management
23+
24+
#### Organization roles
25+
26+
To be considered a part of the organization, the user must have a role within that organization.
27+
Each user can have up to one role assigned to them directly. Other than that
28+
users can have one role within the organization assigned to them indirectly through each of the groups
29+
they are a part of.<br/>
30+
If the user has more than one role, all permissions those roles grant are combined to
31+
make a full set of permissions the user has within the given organization.
32+
33+
#### Organization role to project role mappings
34+
35+
Some organization roles can grant you automatically a project-level role on each project
36+
that the organization owns. For example, the Organization Admin role makes you an Admin on all
37+
of the organization's projects. To see which organization roles grant you project-level
38+
access, see the "*Notes*" column of [this table](/security/default-roles/#organization-roles).
39+
40+
#### Project roles
41+
42+
Project role assignment works similarly to the organization role assignment, only there
43+
are two additional ways a user can get a role within the project.<br/>
44+
If the user has access to the project's remote repository, that automatically grants them
45+
a role within the Semaphore project according to these ["*repo-to-role mapping*"
46+
rules](/security/repository-to-role-mappings/).<br/>
47+
Next, each organization-level role can grant access to the organization's projects, as mentioned
48+
[above](organization-role-to-project-role-mappings). Finally, user can be assigned a role
49+
within the project directly (from projects Admin).
50+
51+
**Example**:<br/> *Owen* has access to the project's GitHub repository, which automatically makes him
52+
a Contributor to that project on Semaphore. He is the organization's Admin, which makes him Admin on
53+
all of the organization's projects, and someone assigned him directly the role of Reader.
54+
So, *Owen* has three roles within this project: Contributor, Admin, and Reader, and
55+
same as with organization roles, the sum of permissions that those roles grant make a total set
56+
of permission *Owen* has within this project.
57+
58+
#### Retracting roles
59+
60+
Only roles that were assigned to a user directly can be retracted. If the user has a role
61+
through a membership in some group, he either has to be removed from the group, or
62+
the role has to be retracted from the entire group.
63+
64+
If a project role was assigned through access to the remote repository, the only way to remove that
65+
role is to remove the user from the repository, and if it was assigned through an organization-level
66+
role, that role has to be retracted.
67+

‎docs/security/repository-to-role-mappings.md

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
Description: This page describes how access to remote repository grants you access to Semaphore projects.
3+
---
4+
5+
# Repository-to-role mappings
6+
7+
On Semaphore, each project has to stem from a code base on a remote repository, like GitHub
8+
or Bitbucket. Semaphore keeps track of all accounts that have access to those remote
9+
repositories (collaborators), and if any of them is associated with a Semaphore account, that
10+
Semaphore user is given access to the project (if he is a member of the organization which owns it).
11+
12+
## Rules for assigning project roles
13+
14+
Depending on user's premissions within the remote repository, a different role
15+
is assigned to them on the Semaphore project.
16+
17+
#### GitHub:
18+
19+
<table style="background-color: rgb(255, 255, 255);">
20+
<thead>
21+
<tr>
22+
<td>Repository permission level</td>
23+
<td>Semaphore project role</td>
24+
</tr>
25+
</thead>
26+
<tbody>
27+
<tr>
28+
<td>
29+
Admin
30+
</td>
31+
<td>
32+
Admin
33+
</td>
34+
</tr>
35+
<tr>
36+
<td>
37+
Push
38+
</td>
39+
<td>
40+
Contributor
41+
</td>
42+
</tr>
43+
<tr>
44+
<td>
45+
Pull
46+
</td>
47+
<td>
48+
Reader
49+
</td>
50+
</tr>
51+
</tbody>
52+
</table>
53+
54+
#### Bitbucket:
55+
56+
<table style="background-color: rgb(255, 255, 255);">
57+
<thead>
58+
<tr>
59+
<td>Repository permission level</td>
60+
<td>Semaphore project role</td>
61+
</tr>
62+
</thead>
63+
<tbody>
64+
<tr>
65+
<td>
66+
Admin
67+
</td>
68+
<td>
69+
Admin
70+
</td>
71+
</tr>
72+
<tr>
73+
<td>
74+
Write
75+
</td>
76+
<td>
77+
Contributor
78+
</td>
79+
</tr>
80+
<tr>
81+
<td>
82+
Read
83+
</td>
84+
<td>
85+
Reader
86+
</td>
87+
</tr>
88+
</tbody>
89+
</table>

‎mkdocs.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -230,6 +230,10 @@ nav:
230230
- "Okta integration":
231231
- Overview: security/okta/overview.md
232232
- Installation: security/okta/installation.md
233+
- "User authorization":
234+
- RBAC overview: security/rbac-authorization.md
235+
- Default roles: security/default-roles.md
236+
- Repository-to-role mappings: security/repository-to-role-mappings.md
233237
- Score:
234238
- Insights: score/project-insights.md
235239
- Custom dashboards: score/custom-dashboards.md

0 commit comments

Comments
 (0)