Permission Management

[Nicolas PEYRUSSIE]

Hi,

 

Is there a way to have a user that :

- Can run PreDeployment step on Dev and Prod Environments with :

   - Environment parameters modification,

   - Servers assignment

- Can run Deployment on Dev environment only

- Cannot Approve on Production environments

 

Regards,

[Michael Gebhardt]

Hey,

 

are you doing the server assignment via a ROC action? if so, it depends on the version you're using, because prior 6.x it was required that the executed user is environmend admin.

 

other then that, I think this should be doable, I'm not sure though what permission is required to assign servers to an environment.

 

for the other stuff though, you need to set permissions on process level, so that you allow the one group to run your predeployment process on DEV and PROD, but the processes for the deployment steps are only allowed on the dev.

 

Same goes for the approvals, you can set these environment specific.

 

hope this helps,

Michael

[Nicolas PEYRUSSIE]

Hi Michael,

 

We are user 5.5.2 version of RA.

Thank you for your answer. Our problem is on server assignment. You are right, we must give the user "environment admin" rights so that he can do that.

But then he can approve everything...

 

So, if I understand well what you are saying on 6.X there is a solution, isn'it ?

 

regards.

[Michael Gebhardt]

Yes, I raised a case with CA on this issue, as we had this as well. It should be fixed by now.

 

can't verify it though, as we didn't adjust our deployment permissions, as it is not required anymore

[Nicolas PEYRUSSIE]

OK, so we will wait untill we upgrade to 6.x :-)

Thank you for your help.

 

Regards.

[Michael Gebhardt]

hey, appears you don't need to, seems like it was in a patch for 5.5.2: ROC - Assign Servers - environment admin needed? 

[Nicolas PEYRUSSIE]

Ok,we are using 5.5.2.488 so it should be there.

But if user does not have to be env-admin to assign servers what does he have to be ?

I do not find a clue on this and ASAP does not help.

[Michael Gebhardt]

Jacky_Mahadab do you have any input on this? thanks

[Jacky_Mahadab]

npeyrussie

Do you try using "ROC - Assign Servers" action or  "Application Environment - Assign Servers" ?

[Nicolas PEYRUSSIE]

Hi Jacky,

 

We use both, one after the other. I think we had to do that so that the servers were correctly assigned bu I do not really remember...

 

Regards.

[Jacky_Mahadab]

As I know the fix Michael mention related to  "ROC - Assign Servers" action , the "Application Environment - Assign Servers" action still need environment admin rights 

[Michael Gebhardt]

can you check again, if and why you require both actions? we only use ROC-Assign Servers.

 

The other one we only use, if the server type doesn't have any servers assigned at all, but we usually just put all the required servers for an environment into the server type and then check in the pre-deployment which ones we need for the run and which we don't and this we can do with the ROC-Assign Servers

[Nicolas PEYRUSSIE]

Hi Mickaël,

 

The reaseon is here : How to use action ROC - Assign Servers 

We cannot dynamically assign servers unless we use "Application Environment - assign servers" action so we do still need the environment admin rights and thus the user can approve when we do not want it...

 

 

Regards.

[Nicolas PEYRUSSIE]

Hi,

 

After opening a case, I have been noticed that action "Application Environment - assign servers" has two input properties to set an ASAP user/password thus permitting us not to had envrionment admin rights to the executing user.

 

Regards.