Improve this page

Permissions

Permissions are used to control user actions. Rather than provide a fixed set of roles we use a broader set of permissions that can be applied in any combination to establish the security you need.

Codenvy also provides a mechanisms and layers which allow to define “who” is allowed to do “what”. Any user and administrator can control resources managed by Codenvy and allow certain actions or behaviors for other users or groups. For example as owner of a workspace, you can grant other users permission to see and/or use your workspace.

Permissions can be applied to: - Workspace - Organization - Stack - Recipe - System

Permissions can be assigned to: - Users - Group of users (see teams)

Workspace Permissions

The user who creates a workspace is the workspace owner and has all permissions by default. Workspace owners can invite other users into the workspace and control their permissions for the workspace.

The following permissions are applicable to workspaces:

Permission	Description
read	Allows reading a workspace’s configuration.
use	Allows using a workspace and interacting with it.
run	Allows starting and stopping a workspace.
configure	Allows defining and changing a workspace configuration.
setPermissions	Allows updating workspace permissions for other users.
delete	Allows deleting the workspace.

Organization Permissions

An organization is a named set of users. Organizations are the underlying layer for teams in Codenvy.

The following permissions are applicable to organizations:

Permission	Description
update	Allows editing of organization settings and information.
delete	Allows deleting an organization.
manageSuborganizations	Allows creating and managing sub-organizations.
manageResources	Allows redistribution of an organization’s resources and defining resource limits.
manageWorkspaces	Allows creating and managing all the organization’s workspaces.
setPermissions	Allows adding and removing users as well as updating their permissions.

System Permissions

System permissions control aspects that affect the whole Codenvy installation.

The following permissions are applicable to organizations:

Permission	Description
manageSystem	Allows control of the system, workspaces and organizations.
setPermissions	Allows updating of permissions for users on the system.
manageUsers	Allows creating and managing users.

Super Priviliged Mode

The permission “manageSystem” can be extended to provide a super privileged mode that allows advanced actions to be performed on any resources managed by the system. A user with “manageSystem” permission is able read and stop any workspaces. To perform other actions on workspaces and organizations, the user will need to assign himself the permissions needed.

By default, this mode is disabled.

It is possible to activate this option by configuring the CODENVY_SYSTEM_SUPER_PRIVILEGED_MODE in the codenvy.env file.

Stack Permissions

A stack is a runtime configuration for a workspace, see stack definition.

The following permissions are applicable to a stack:

Permission	Description
search	Allows searching of the stacks.
read	Allows reading of the stack’s configuration.
update	Allows updating of the stack’s configuration.
delete	Allows deleting of the stack.
setPermissions	Allows managing permissions for the stack.

Recipe Permissions

A recipe defines part of the runtime of a workspace, see recipe definition.

The following permissions are applicable to a recipe:

Permission	Description
search	Allows searching of the recipes.
read	Allows reading of the recipe’s configuration.
update	Allows updating of the recipe’s configuration.
delete	Allows deleting of the recipe.
setPermissions	Allows managing permissions for the recipe.

Permissions API

All permissions can be managed by using the provided REST API. The APIs are documented using Swagger, as explained here.

The permissions API list can be accessed by: {host}/swagger/#!/permissions.

List Permissions

List the permissions which can be applied to a specific resources: GET /permissions : {host}/swagger/#!/permissions/getSupportedDomains

Applicable domain values are the following:

Domain
system
organization
workspace
stack
recipe

Note: domain is optional, in this case the API will return all possible permissions for all domains.

List Permissions for Specific User

List the permissions which are applied to a specific user: GET /permissions/{domain} : {host}/swagger/#!/permissions/getCurrentUsersPermissions

Applicable domain values are the following:

Domain
system
organization
workspace
stack
recipe

instance parameter corresponds to the ID of the resource you want to get the applied permissions.

List Permissions for All Users

List the permissions which are applied to a specific user (you must have sufficient permissions to allow you to see this information): GET /permissions/{domain}/all : {host}/swagger/#!/permissions/getUsersPermissions

Applicable domain values are the following:

Domain
system
organization
workspace
stack
recipe

instance parameter corresponds to the ID of the resource you want to get the applied permissions for all users.

Assign Permissions

Assign permissions to a resource: POST /permissions : {host}/swagger/#!/permissions/storePermissions

Applicable domain values are the following:

Domain
system
organization
workspace
stack
recipe

instance parameter corresponds to the ID of the resource you want to get the applied permissions for all users.

userId parameter corresponds to the ID of the user who want to grant certain permissions.

Sample body to grant user userID permissions to a workspace workspaceID:

{
  "actions": [
    "read",
    "use",
    "run",
    "configure",
    "setPermissions"
  ],
  "userId": "userID",
  "domainId": "workspace",
  "instanceId": "workspaceID"
}