{"action":"created","issue":{"url":"https://api.github.com/repos/chef/chef-server/issues/475","labels_url":"https://api.github.com/repos/chef/chef-server/issues/475/labels{/name}","comments_url":"https://api.github.com/repos/chef/chef-server/issues/475/comments","events_url":"https://api.github.com/repos/chef/chef-server/issues/475/events","html_url":"https://github.com/chef/chef-server/pull/475","id":101121605,"number":475,"title":"Implemented Version 1 of Server Admins","user":{"login":"tylercloke","id":1899715,"avatar_url":"https://avatars.githubusercontent.com/u/1899715?v=3","gravatar_id":"","url":"https://api.github.com/users/tylercloke","html_url":"https://github.com/tylercloke","followers_url":"https://api.github.com/users/tylercloke/followers","following_url":"https://api.github.com/users/tylercloke/following{/other_user}","gists_url":"https://api.github.com/users/tylercloke/gists{/gist_id}","starred_url":"https://api.github.com/users/tylercloke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tylercloke/subscriptions","organizations_url":"https://api.github.com/users/tylercloke/orgs","repos_url":"https://api.github.com/users/tylercloke/repos","events_url":"https://api.github.com/users/tylercloke/events{/privacy}","received_events_url":"https://api.github.com/users/tylercloke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chef/chef-server/labels/in%20progress","name":"in progress","color":"ededed"},{"url":"https://api.github.com/repos/chef/chef-server/labels/Signed%20CLA","name":"Signed CLA","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":14,"created_at":"2015-08-14T23:30:00Z","updated_at":"2015-09-18T03:09:49Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/chef/chef-server/pulls/475","html_url":"https://github.com/chef/chef-server/pull/475","diff_url":"https://github.com/chef/chef-server/pull/475.diff","patch_url":"https://github.com/chef/chef-server/pull/475.patch"},"body":"Implemented Version 1 of [Server Admins](https://gist.github.com/tylercloke/a8d4bc1b915b958ac160).\r\n\r\n### Description\r\n\r\nVersion 1 of Server Admins. Implements flexible user create and read perms.\r\n\r\nFor full details on what Server Admins do and what the long-term plan is for them,\r\nread https://gist.github.com/tylercloke/a8d4bc1b915b958ac160.\r\n\r\nNow, a global group, called server-admins, will be set up on bootstrap and migration\r\nof existing chef-servers. This global group will have create and read permissions on\r\nthe users container, meaning any user placed in the server-admins global group will\r\nhave permissions to create and read users system-wide, granting much needed flexability\r\naround our user management for larger orgs. As a side-effect, `knife user` is now\r\nrelevant again.\r\n\r\nA second migration updates existing users read permissions to grant server-admins access,\r\nas changing container permissions does not update existing objects.\r\n\r\nA new set of chef-server-clt tools were added to manage server-admins under Server Admins Commands:\r\n+ grant-server-admin-permissions\r\nAdd an existing user to the server-admins global group.\r\n+ list-server-admins\r\nShow all users in the server-admins global group. Should contain pivotal.\r\n+ remove-server-admin-permissions\r\nRemoves an existing user from the server-admins global group, removing all special permissions they have.\r\n\r\n### Details\r\n\r\nPing @chef/lob \r\n\r\n[Current build](http://wilson.ci.chef.co/job/chef-server-12-trigger-ad_hoc/719/downstreambuildview/)\r\n\r\nQuestions (please help reviewers):\r\n- [ ]  Members of this global group will have READ and CREATE permissions on users. We are not granting UPDATE and DELETE because then a lowly server-admin could mess with pivotal. On the other hand, results in CRUDG behavior where admins could only DELETE / EDIT users they personally created with their own user (vs `chef-server-ctl`) and not migrated users / users they didn't personally create. What do y'all think? I think there are valid arguments for both sides. Its something we could always add in the future with a migration very similar to `mover_server_admins_existing_users_read_permissions_callback.erl`.\r\n- [ ] Should we prevent `pivotal` from being removed from the `server-admins` global group via the new `chef-server-ctl` commands?\r\n\r\nTODO\r\n- [x] Need one more migration to update the READ permission on existing users, since updating the container does not update the permission for existing objects.\r\n- [ ] Documentation.\r\n- [ ] Write basic `chef-server-acceptance` tests and run though upgrade battery."},"comment":{"url":"https://api.github.com/repos/chef/chef-server/issues/comments/141331908","html_url":"https://github.com/chef/chef-server/pull/475#issuecomment-141331908","issue_url":"https://api.github.com/repos/chef/chef-server/issues/475","id":141331908,"user":{"login":"danielsdeleo","id":37162,"avatar_url":"https://avatars.githubusercontent.com/u/37162?v=3","gravatar_id":"","url":"https://api.github.com/users/danielsdeleo","html_url":"https://github.com/danielsdeleo","followers_url":"https://api.github.com/users/danielsdeleo/followers","following_url":"https://api.github.com/users/danielsdeleo/following{/other_user}","gists_url":"https://api.github.com/users/danielsdeleo/gists{/gist_id}","starred_url":"https://api.github.com/users/danielsdeleo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielsdeleo/subscriptions","organizations_url":"https://api.github.com/users/danielsdeleo/orgs","repos_url":"https://api.github.com/users/danielsdeleo/repos","events_url":"https://api.github.com/users/danielsdeleo/events{/privacy}","received_events_url":"https://api.github.com/users/danielsdeleo/received_events","type":"User","site_admin":false},"created_at":"2015-09-18T03:09:49Z","updated_at":"2015-09-18T03:09:49Z","body":"Ok, just wanted to make sure I was understanding everything in your proposal correctly. \n\nAlso, I think I used the acl dsl in the migration that adds the policy containers. \n\n\n\n> On Sep 17, 2015, at 7:29 PM, Marc A. Paradise <notifications@github.com> wrote:\n> \n> Final thought: There's a DSL-like thing in place for setting permissions instead of having to do each step explicitly. It's currently geared for use with org setup, but could it be used [with some mods] instead of the explicit setup we have here?\n> \n> https://github.com/chef/chef-server/blob/master/src/oc_erchef/apps/oc_chef_authz/src/oc_chef_authz_org_creator.erl#L68\n> I thought we had a group migration that used this in mover, but I can't seem to find it...\n> —\n> Reply to this email directly or view it on GitHub.\n> \n"}}