GitLab Manage Stage, 4 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Manage:Access - Group Sync and Group Sharing

Description

First Video - https://www.youtube.com/watch?v=Iqvo2tJfXjg&feature=youtu.be

Group Sharing docs - https://docs.gitlab.com/ee/user/group/#sharing-a-project-with-a-group

Show role for shared groups -- https://gitlab.com/gitlab-org/gitlab/-/issues/280822

A

Hi y'all, it's melissa, ushaka from the access team, and I wanted to record a follow-up video from the video I recorded earlier, where I showed you uh saml group sync, to show you uh how you can use saml group, sync plus group, sharing combined to allow you to give access at the project level using group sync.

A

So I'm going to go ahead and share my screen and I'm going to use the same example that I used earlier and there's a couple of things that I'm going to point out as I go.

A

So you see here. This is my owner view of the melissa sso group. So you see here there's three subgroups and then within them.

A

I have multiple groups right so within projects I have um different projects well, apps and then projects within them right, um and um this is what what would be like your structure where you have your code and then I created an account management project just so something that isn't code and then again over here I have um the groups that I'm using for group links for group sync, and you see I have security product and engineering same as the example. I showed earlier and again I have one user called.

A

Ushakov test, that is part of the product and security groups. So one thing that's important to point out in this config that I have is that I've actually made the default membership minimal access.

A

So what that means is that this user over here can only see the groups that they're a member of, even though over here again there are all these other groups. They can only see users, product and security, because that's the only groups they've explicitly been added to, and they were added via group sync.

A

So now, if I want basically this member, so this person's a member of the security team- and I want the security team to have uh specific access to like say, app1 as owner and like app2 as a guest right. What I have to do is I go over here to app one and I'll actually show you two examples. One at the group level, one of the project level, and I invite group and I'm going to invite groove melissa, sso ultimate extras.

A

uh Users, security and they're going to be a maintainer. So now anybody who's in the security group will be a maintainer on any projects under this app.

A

This is taking a little while uh so again, here I'm logged in with that test user, and now you see under projects, I see app one and I have access to project line product two one area of opportunity here that there's actually an open issue for is just showing the pill here.

A

That has the access level. So that's something that we're working on I'll put an issue in the video description. That shows that so that's at the group level.

A

Now, if I don't want it to have access to everything, but let's say here for uh app2: what did I add? Yes, I added up one if I want them to only have access to project four, I go here, members invite group and I'm gonna say: melissa, sso, slash, users, security and I'm going to make them a guest here right and I invite them so now, if I go over here and I refresh you'll see that they have access to project four and project, one purge two.

A

So, basically, you can get as detailed as you need to using one single group, which is the security group and inviting that one group into the different groups and projects that you need um them to have disability into, and the advantage here is that um you won't normally have just one person that security group it'll, be you know all the people, all the members of the security team that you can easily at mass, give them access to whatever they need to um without having to do it on a project by project basis, and the other advantage too, is that you can do things like at mention the security team within gitlab, so that they can get notifications about issues that are important to them.

A

Right to any group of people.

A

So thanks for watching, hopefully that's clear on how you can use saml group sync and group sharing combined, so that you don't need to rework your entire project hierarchy to take advantage of group sync and if you have any other questions, please free to comment on the issue. Thanks.