Can we do User Groups/Roles?

[jamlen]

I need to be able to have users belonging to groups and roles and grant them different levels of access to the Administration of Keystone.

Is this something that is currently possible? If so how?

[JedWatson]

It's not (yet) but something I've been thinking of how to best add for a while now. Probably about time we did :)

What do you have in mind as restrictions? e.g. per list or per item? granular create / view / update / delete, or just blanket access to lists?

[jamlen]

OK bit of a brain dump here:

I guess I'd be wanting to restrict access to per list, but at the granular create, view, update, delete level as I want certain content to be visible to certain groups and only editable by certain roles but also in that group or a higher level.

So a User belongs to User Groups and has a Role in that group. I guess we'd need an administration of what Roles are defined for a given group.

Background: 
Given Joe is an authenticated user belonging to:
  | Group         |
  | Small group 1 |
  | AV Team       |
  And Sam is a Content editor for:
  | Group   |
  | AV Team |

Given I have logged in as Joe
 When I access content for Small group 2
 Then I get access denied

Given I have logged in as Joe
 When I access content for AV Team
 Then I get the requested content

Given I have logged in as Joe
 When I access the Admin system
 Then I get access denied

Given I have logged in as Sam
 When I access the Admin system
 Then I can edit the content defined for the AV Team group

Any thoughts?

[jamlen]

I also need to be able to allow access to edit content but only of certain lists. Is this possible now?

[JedWatson]

Hi James,

Sorry for the delay here - I'm working on adding the ability to restrict lists or individual items to particular users, it'll make a fair bit of progress towards what you want to be able to do.

Once that's in place you could build your own subsystem for managing user groups, and we can add a generic system to for it as well as a separate feature (like the current session management functionality).

It's taking a bit of time to get right because once this API is released, people will start coding it into projects and I don't want to make breaking changes after that point (or at least not in the short term!)

[jonesrussell]

I'm in need of this functionality myself. Is there an ETA or anything I can do to assist?

[morenoh149]

@jonesrussell review keystonejs/keystone#2111

[morenoh149]

closing as dupe of keystonejs/keystone#803 my recommendation is to evaluate the rbac module