Devguard multi-level permission and fine-grained permission

[knoobie]

We are currently evaluating devguard in comparison to tools like dependencytrack and we are looking for a way to get proper role and permission structures. Looking through the docs, I could get a pretty good picture overall here (https://devguard.org/explanations/core-concepts/organization-groups-repos). But I'm still wondering about the following possibilities of devguard (I haven't had the time to start my own instance to check - just searched the docs).

We would like to create one org, e.g. My Corp. Within the org, we have different departments, a security department and different units which are in charge of their products. The security department is allowed to see all products, while each unit is only "allowed" to manage their own project/assets, e.g.:

• My Corp
  • product1 (devguard's "group")
    • repo1
    • repo1
  • product2 (devguard's "group")
    • repo3
    • repo4

We would like to:

• assign users to a "group" / structure called "sec_team" which is allowed to read all products (we do not want the sec team to create releases etc. - they should only be allowed to read stuff)
• assign users to a "group" / structure called "product1_team" which is allowed to have write access to product1
• assign a dedicated user the admin "role" for product1
• Users should be able to be in multiple "groups" so that User A can be part of "product1_team" and "product2_team"
• managing read, edit, publish, delete for repos / reports etc should be possible to be configured on the "group" / structure -level instead of at every single user

Is this already possible with devguard or on the roadmap?

[knoobie]

@seb-kw Sorry for the ping.. I was wondering if this discussion-tab is the correct for this kind of question or if you guys wanna have issues for this discussions / questions

[timbastin]

Hi @knoobie currently we have a simple RBAC system in place. So you can invite users to projects and assign them roles there. Currently there is nothing like user groups in devguard, nevertheless, we are using casbin as rbac backend: https://casbin.org/, it should be pretty straightforward to implement user groups.

[knoobie]

Thanks for the reply! Looks possible with casbin. Might be of interest for you, once the user base grows it's pretty hard to keep track of proper role management for hundreds of users.