Permissions

The tenant file allows you to define permissions for your members inside your tenant. Permissions are used to restrict access to certain features of your tenant on the different services.

A permission is represented by a string. You can find them in the Permissions Reference.

How to add permissions

As you saw in the previous section, the tenant file contains a groups property. This property is an array of groups. Each group contains a permissions property which is an array of permissions.

tenant.yaml

# ...
groups:
  - slug: group-A
    permissions:
      - INTRA_REPO_CLONE
    members: [xavier.login]

You can simply add a permission to a group by adding it to the permissions array. You can also create a new group and add permissions to it.

Permissions Reference

Intranet

Permission name	Description
INTRA_TRACE_READ	Allows the user to read traces on Operator.
INTRA_TRACE_RETRY	Allows the user to retry traces on Operator.
INTRA_TRACE_PUBLISH	Allows the user to publish traces on Operator (i.e. make traces visible for students).
INTRA_IMPERSONATE	Allows the user to impersonate other users on the Forge Intranet.
INTRA_REPO_CLONE	Allows the user to clone student repositories on the Forge Intranet.
INTRA_NODE_READ	Allows the user to access all nodes where they are registered without having to validate previous nodes.
INTRA_MANAGE_ACHIEVEMENT	Allows the user to create, update, disable and delete achievements on the tenant.
INTRA_GIVE_ACHIEVEMENT	Allows the user to give and revoke achievements to or from students.

To impersonate a user, you need to add ?login=<login> in the URL. (e.g., ?login=xavier.login)

INTRA_IMPERSONATE

Impersonation does not work on the home page of the intranet because no tenant is selected yet on this page.

INTRA_NODE_READ

This permission does not allow the user to make a submission on a node.

Achievement permissions

Being a manager of an activity does not grant any right over its achievements: the two permissions above are always checked on the tenant. For an ACTIVITY-scoped badge, the tenant checked is the one owning the activity. See Achievements for details.