16.4. Granular Permission Filtering

As mentioned in Section 16.3.2, “Adding Permissions to an Existing Role”, Red Hat Satellite provides an ability to limit the configured user permissions to selected instances of a resource type. These granular filters are queries to the Satellite database and are supported by the majority of resource types.

To create a granular filter, specify a query in the Search field on the Edit Filter page. Deselect the Unlimited check box for the field to be active. Queries have the following form:

field_name operator value

field_name operator value

Where:

For most resource types, the Search field provides a drop-down list suggesting the available parameters. This list appears after placing the cursor in the search field. For many resource types, it is also possible to combine the queries by using the and and or operators.

For example, the following query applies any permissions specified for the Host/managed resource type only to hosts in the group named host-editors.

hostgroup = host-editors

hostgroup = host-editors

You can also limit permissions to a selected environment. To do so, specify the environment name in the Search field, for example:

Dev

Dev

As an administrator, you can allow selected users to make changes in a certain part of the environment path. The above filter allows to work with content while it is in the development stage of the application life cycle, but the content becomes inaccessible once is pushed to production.

You can limit user permissions to a certain organization or location with use of the permission filter. However, resource types provide a GUI alternative in form of Locations and Organizations tabs. On these tabs, you can select from the list of available organizations and locations. See Example 16.1, “Creating an Organization-specific Manager Role”.