Administering roles and permissions

Help for domain administration: Index

Domain administration overview
  Adding and editing user accounts
  You are here: Administering roles and permissions
  - Understanding roles and permissions
  - Editing user role assignments
  - Editing roles
  - Adding roles
  - About resources and actions
  Creating and editing user groups
  Creating and editing project groups
  Approving, disapproving, or deferring projects
  Using domain administration tools
Back to main Help index

Understanding roles and permissions

Every user on this site is able to access features and conduct activities based upon roles the user has been granted. There are two kinds of roles:

- Domain roles give users access to generalized information and actions throughout the site. Domain Administrators assign and configure domain roles to all users on this site. Every new user automatically gets the "registered user" domain role by virtue of being registered on your domain. It is also possible to create other domain roles; more about this is covered in the Adding roles section of this document.

- Project roles are limited to information and actions within a project. Domain Administrators also can configure project roles, but by design Project Owners usually assign project roles to users when they become project members.

Roles are either assigned to users through membership in a project, or through association with project groups or user groups. All roles have a default set of permissions associated with them. These permissions govern the users' ability to conduct certain actions on this site.

As Domain Administrator, you can:

- Use and assigning existing roles "as is."

- Alter existing roles by changing the permissions, actions, and/or resources are associated with them.

- Create entirely new roles and designate permissions for them. (You cannot, however, create new permissions.) See Adding roles.

You can also tailor roles and permissions for sets of users by creating user groups, and for sets of projects by making project groups. For more information about this, see Creating and editing project groups and Creating and editing user groups.

Editing user role assignments

The fields and options in the bottom section of the Edit User page enable you to view and change the individual user's role assignments.

Group Memberships
  The user's affiliation with any user group or project categories in this domain are listed here. User groups and project groups are created and configured by you as the Domain Administrator. See Creating and editing project groups and Creating and editing user groups for more information.

Domain-wide Roles
  Domain roles assigned or conferred to the user are listed here. These are generalized roles that permit the user to view site pages and conduct site actions not associated with specific projects. See previous Understanding roles and permissions section.

Roles in domain's public projects
  Every public project hosted on this domain is automatically part of the default project group labeled (not surprisingly) "All public projects." Any roles the user holds in such projects are flagged here. See Creating and editing project groups for more information.

Submit Changes
  This button submits any modifications to the individual user account made in the fields above. Modifications to the user's roles are separate actions.

Project Roles
  Roles the user holds that are associated with specific projects are listed here, grouped by project name. Project names link to project home pages. This list includes both open source and private, proprietary projects. See Understanding roles and permission section for a more comprehensive discussion of roles.

Detailed Role Info
  These links lead to secondary screens with more detailed role information associated with the current user:

  - Direct and derived roles displays two different sets roles held by the user. Direct roles are those roles expressly assigned to the user. For example, the user requested and was approved for a certain role in a project. Derived roles are roles conferred to this user because she/he is a member of a project specifically associated with a project group's set of roles, or belongs to a user group assigned a unique set of roles.

  - Details of permissions displays a screen rather unceremoniously entitled Permission Dump because it tabulates literally every single permission the user holds in your domain.

  Note that when individual users are part of particular project groups or user groups, you can assign attributes and modify multiple user accounts associated with those groups by using the Project Group Edit or User Group Edit screens. See Creating and editing project groups and Creating and editing user groups for more information.

Other operations: Delete User
  This link removes the current user account. A confirmation message prompts you for verification before this action is completed.

  Editing roles

  This site features a set of default roles that you may view using the Administer Roles link in the "Admin Options" of your Start Page. This displays the Role List page with all site roles listed as either domain or project-level. A brief description of each role is included.

  To view a list of individual permissions associated with this role, click on the role name link in the Role List page. Each permission listed on the Editing Role page is characterized by both the site resource and site action that it enables, i.e. "Project - Suggest" or "Version Control - Update." The far right "Resource(s)" column defines in which site resources each permission is effective. The default is for each permission to apply to all available resources.

  As domain administrator, you have the option to modify this site's pre-packaged roles by changing the permissions associated with them as needed. Placing a check mark in the boxes next to a permission removes this permission from the role.

  If you wish to add permissions to a role, click the Add New Permission link at the top of the Editing Role page. This screen gives you a list of all available permissions. To add permissions, place check marks in the appropriate boxes.

  In addition to editing roles by adding and removing permissions, you can modify or limit which resources the permissions associated with that role will apply to. The resource section at the bottom of the Add Permission to Role page lets you determine in which site resources to allocate the role's new permissions.

  - Selecting "All available resources .*" applies the selected permissions for this role universally to all site resources available to this role, including both web content and source code.

  - Choosing "All web pages /www/.*" limits the selected permission for this role specifically to web pages. This means the scope of these permissions does not pertain to any source code level access, but only to web page content. For example, assigning the "Version Control - Commit" permission to a role and designating "All web pages /www/.*" as the resource results in users with this role only being able to check out and commit web page content, not project source code.
  After you have selected the permissions to add and determined the site resources to apply these to, click the Add Permissions button at the bottom of the page.

  See the section on Viewing and adding resources for more information about site resources.

  Adding roles

  If your site has special requirements that none of the default roles meet, you can also create custom roles and assign the appropriate permissions to them. To do this, in the Role List page click the "Add New Role" link in either the domain or project section, depending upon the type of role you want to create. Depending upon which one you click, this displays either the Add Domain Role or Add Project Role page. You can switch between these pages using the links at the top of this page.

  You must determine what you want the scope of your newly created role to be. If you want to create a role that enables certain user actions universally across the site, add the new role as a domain role. If you want to create a role with permissions that are not universally enabled across this site, you should add the new role as a project role. When project roles are assigned, their associated permissions are granted to the user only within that project.

  The Add Domain Role and Add Project Role pages list every permission/action available at that level. Use this feature with extreme caution! Assigning permissions to roles may have security implications.

  About resources and actions

  Resources are all of the different elements used in this site including tools, content, projects, and web pages. User roles and permissions on this site are defined by the specific resources they apply to. For example, each of these permissions -- "Mailing List - View," "Project - Suggest," "Version Control - Commit" -- is comprised of a certain resource on this site and the action being permitted within that resource. In these three examples, the resources are, respectively: mailing list, project, and version control.

  Resources are described on this site using regular expressions. Thus, the pattern or regular expression meaning all available resources is ".*".

  You can view a complete list of all available resources on this site by clicking the Resource List link at the top of the Editing Role page. The default items in the Resource List page are "All available resources (.*)" and "All web pages (/www/.*)". Clicking on the resource link displays the Edit Resource screen where there is short, identifying description and the pattern that represents the resource as a regular expression.

  As the domain administrator, you can also create new resources and define them using the Add New Resource link at the top of the Editing Role page. This is a powerful and flexible administrative feature. For example, you might decide that you want to create new user roles with permissions that only apply to certain types of files. If these were java files, you could define that as a resource using the regular expression "*.java". Then you could either create new roles or modify existing roles by adding permissions defined with this "*.java" resource. Your newly created resource automatically appears in the Add Permission to Role page. When you grant these roles to users, their permissions are limited to java files only.

  Back to Help for domain administration
  Back to main Help index