[jira] Commented: (MRM-1170) Add a new role for "Delete artifact"

["Brett Porter (JIRA)" <ji...@codehaus.org>]

    [ http://jira.codehaus.org/browse/MRM-1170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=172375#action_172375 ] 

Brett Porter commented on MRM-1170:
-----------------------------------

I had expected the role editing would allow you to do this from the UI, but it is not currently possible.

However, you can workaround this by editing redback.xml inside archiva-security-1.2.jar and removing the delete-artifact permission from the repository manager.

I think this is a worthwhile enhancement: not a separate role, but rather a repository administrator that is more privileged than a repository deployer (formerly manager).

It would also be helpful both to be able to customise the permissions for given roles, and create your own roles.

> Add a new role for "Delete artifact"
> ------------------------------------
>
>                 Key: MRM-1170
>                 URL: http://jira.codehaus.org/browse/MRM-1170
>             Project: Archiva
>          Issue Type: Bug
>    Affects Versions: 1.2
>         Environment: Repository on Unix
>            Reporter: Sonia Lodovichetti
>
> It would definitely be a must to add a role for "delete artifact" and not  encapsulate in the Repository Manager role, maybe a Read-Write-Delete-Upload? permission style.
> Here is my use case:
> Here is the use case:
> With Archiva 2.1, there is now the "Delete Artifact" possibility in the UI, as long as you are a "Repository Manager", you have access to it.  In the past, we used the "guest" logon for everyone which was "Repository manager" for our snapshots and development repositories, hence no username/password in the settings.xml file.  And everyone could deploy to those repositories, and from the command-line (mvn deploy or mvn deploy:deploy-file) .
> Now we don't want everyone to go to the UI and have the possibility to delete artifacts from those repositories, so we can't give "guest" the "Repository manager" role for those repositories anymore, because if we do the "delete Artifact" functionality is enabled.
> We've then created a "deployment" user which has those roles, add it to the settings.xml file and make sure to find a way to "hide" the password!  

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira