User/Pipeline Permissions

[rmb938]

In a multi-user environment it would be nice to have user permissions.

i.e only the admin can add/remove users.

It would also be useful to have pipeline permissions so the viewing/modification/triggering of a pipeline can be limited to a specific user or group of users.

This would also allow easy integration into SSO (single sign on) systems like OpenID Connect.

[michelvocks]

Welcome @rmb938. Thanks a lot for your feedback. You are absolutely right! We need this definitively!

If someone wants to pick up a challenge and wants to contribute: Welcome!
Happy to support here.

[speza]

Idea

Summary

Any software that allows user based authentication generally has a permission system. This is to allow granular access to specific resources. Gaia requires something like this so that we can control what users can do throughout the tool.

I believe a simple policy based permission system (think simplified AWS IAM) would be a good solution.

Concept

• Users can be assigned individual permissions such as PipelineCreate or SecretDelete
• 'Permission Groups'' can be assigned to users
• Default groups are available such as 'Admin' (which would allow everything)

Example features/resources

Resources would be categorised into areas such as 'Pipeline' or 'Secret'

• Pipeline > PipelineCreate, PipelineDelete, PipelineModify
• Secret > SecretCreate, SecretDelete, SecretModify

I expect we may eventually have more granular permissions that aren't just Create/Delete/Modify. That's why I have avoided just having Read/Write.

We can also expand upon this to allow users specific access to certain resources.

What do you guys think? Willing to jump on this 👍

[michelvocks]

@speza In my opinion that is exactly what we need! 😄

We can also expand upon this to allow users specific access to certain resources.

I think this is quite important, too. I often used this in jenkins and it would be awesome to have this in Gaia. I think we can also add this later in another PR but we should keep this in mind when we work now on the authorization system.

Looking forward to see some work here from you! 🤗

[michelvocks]

Most of this is done by #154. Missing feature (groups) is now tracked in a separate issue #164.