We facing with security issue on Octopus. We restricted roles CertificateView and AccountView to limited group of people. This was done, because We have some very important secrets, that must be only used by defined group (view role allow to assign this object in variable view). If developer go to Variable view of project, see error and also in Diagnostic view We see error about lack of privileges.
In our opinion there are should be possibility to see this accounts and certificates, but only defined group of people can assign It with project in variable view. For our research this cannot be made now. Could you help us with this issue ?
Thank you for your patience. I was able to reproduce this in my test environment.
Despite the warning message, it does appear that users in this scenario would be able to adjust the Variable name and Scoping so long as they have Variable Editing permissions. However, without CertificateView, they will not be able to change the assigned Certificate.
Is the goal to have the VariableEdit users be able to see the names of the Certificates without having CertificateView assigned to the Team’s Role? I apologize if I’m quite understanding. Please feel free to provide more details about your usage scenario.
Hello @donny.bell,
thanks for your support! I try to provide more details.
However, without CertificateView, they will not be able to change the assigned Certificate.
You have right, but then error is rising. Our teams have Variable Editing permission, without Certificate View and Account View, because this permission allow them to edit assigned certificate or account. Our main goal is reduce false positive errors, reported in Diagnostic view and for project view - where developers report, that something wrong occurred, when they visiting Variables page. In our opinion permission View shouldn’t be identified as Use permission.
If you have any questions, fell free to ask.
Hello @donny.bell,
I’m very glad to see this issue.
Please also take into consideration by engineering team to split current View roles for Certificates and Accounts. View permission shouldn’t be identifies as Use role also. More gradual permission allow to fulfills more restrict polices in companies. For example there are should be permission to list and see this objects and separated role - Use role - that allow to use them in context of Variable Set.
