Certificate available despite belonging to an inaccessible environment

Legacy Scale
1

Hi.
We’re looking into ways of using the newly released Certificate manager feature which was released with the version 3.11.0 of Octopus Deploy.

One thing we’ve been wondering about, is if it’s ideal to show all certificates that have been added to Octopus Deploy. In our opinion it is alright to display the certificates belonging to environments a user has access to but nothing else.

In my concrete example, the user has access to Test clients and Innsynsenvironment Utvikling environments, but not the .Net QA environment and therefore the user ends up with an error message if he wants to see more details about the certificate.

certificate_available_despite_belonging_to_an_inaccessible_environment.PNG
certificate_available_despite_belonging_to_an_inaccessible_environment.PNG984×736 51.6 KB

20170223_PermissionsForHHA046.zip (1 KB)

You_do_not_have_permission_to_perform_this_action.PNG
You_do_not_have_permission_to_perform_this_action.PNG960×575 21.5 KB

2

Hi Harald,

We agree! I have created an issue to restrict visibility of certificates to only environments for which the user has permissions.

We’ll implement this as soon as possible. You can follow the issue above.

Regards,
Michael

3

Harald,

This change was released today with Octopus 3.11.2.

4

Tested by changing environment on a certificate, the certificate disappears from the users view when the certificate is in an unavailable environment.