DependencyTrack / DependencyTrack/dependency-track
Role separation for component level auditing and and project level auditing.
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
The enhancement may already be reported! Please search for the enhancement before creating one.
### Current Behavior:
Steps to reproduce -
log in as Admin
Create a team 'teamA'
Assign the following permissions to the team 'teamA'.
- VULNERABILITY_ANALYSIS
- VIEW_PORTFOLIO
- SCAN_UPLOAD
- PROJECT_CREATION_UPLOAD
- BOM_UPLOAD
Create a user 'abc'
Assign a created team 'teamA' to user 'abc'
Assign following permissions to user 'abc'
- VULNERABILITY_ANALYSIS
- VIEW_PORTFOLIO
- SCAN_UPLOAD
- PROJECT_CREATION_UPLOAD
- BOM_UPLOAD
Log in as user abc.
Observed Behavior:
The created user couldn't able to upload BOM and create Project even though the above permissions are assigned.
### Proposed Behavior:
Restrict component level auditing to all teams and allow component level auditing to one respective team. In this case, we can give PORTFOLIO_MANAGEMENT access to all teams instead we have to give that access to the respective team.
All other teams could able to audit project-level analysis, create new versions on top of the existing project and upload BOM on the created new version.
Contributor guide
Assessment
This issue has not been assessed yet.