How to assign default workload types to custom role?

[mikeely]

Suppose I create a custom role "our_role" right? As it stands I have to go to each and every workload - backup job, copy, etc. and explicitly grant that role permissions to the job. What I can't figure out how to do is to edit the parameters of our_role so that it has access to every backup job, copy job, or other workload type I want it to access.

It's a really obvious feature so I'm sure it exists somewhere and I just can't find it.

[vnikiforov]

Hello Mike,

Custom role scopes only control what the role can protect, which repositories it can use and what it can restore from. If manage backups permission is given it will have full access to its own created jobs.
For an existing jobs access, you have to provide role access in a Permissions tab at per-job level setting (the job owner or an administrator adds your role to Effective Access on the job's Permissions tab).

If some backup jobs added to the inventory scope when creating the role it can only be used as backup copy sources.

If some backup jobs added to the inventory scope when creating the role it can only be used as backup copy sources.
For the existing jobs, to skip clicking through every job, you can script the grants via the ACL section of the REST API (changeEffectiveAccess).
RBAC improvements are already planned for future releases.

[mikeely]

Thanks for getting back to me. I have been assigning permissions to jobs, but would greatly prefer the ability to assign a custom role "all X-type workloads" permission so as not to have to iterate through them via the API or some other method.

[vnikiforov]

Hello, Mike,

I understand. As I said, please expect improvements in upcoming versions.

[mikeely]

Ouch, dammit. I just ran into this while trying to set up monitoring with Zabbix:
viewtopic.php?f=30&t=99942&start=0

What the heck happened with the QA on the API access controls? This is an utter mess!