Roles

What a user can do in CTFreak depends on the Administrator flag and on the roles the user holds on each project, directly or through teams.

Administrator

An administrator user has access to all the features of CTFreak, in particular this role allows managing:

  • Projects
  • Nodes
  • Databases
  • Global calendars
  • Credentials
  • Users and Teams
  • Settings

Project roles

A non-administrator user needs to be assigned roles on projects to be able to perform actions on CTFreak.

Projects on which the user holds no role are not visible to that user, along with everything related to them (tasks, executions, notifiers, …). This allows for strict compartmentalization of projects.

Manager

A user with the role of manager on a given project can manage:

  • its tasks (except those of the local command or ansible playbook type) and related incoming webhooks
  • its executions
  • its notifiers
  • its project calendars
  • its constants

From the moment a user has the role of manager on at least one project, that user can also consult the list of nodes, databases (which he will need to create certain types of tasks), and project calendars.

NB: This role allows your devops users to run scripts on your servers without having to reveal credentials to connect to them.

Advanced executor

A user with the role of advanced executor on a given project can only launch tasks associated with that project or view their executions (including logs).

Executor

A user with the role of executor on a given project can only launch tasks associated with that project or view their executions (excluding logs).

NB: This role is ideal for empowering business users to launch specific tasks without granting them access to other CTFreak features.

Viewer

A user with the role of viewer on a given project can only view the executions of tasks associated with that project (excluding logs).

NB: This role is ideal for restricting business users’ access to reports generated by SQL Report tasks.

No role

A user who is neither an administrator nor holds any project role sees no project and can only manage their profile. This is the situation of every external user created on first login (without SCIM provisioning), until an administrator grants them access.

Assigning roles

Roles are assigned per project, in Projects → {Requested project} → Access:

  • Edit users: assign a role directly to a user
  • Edit teams: assign a role to a team, which all its members inherit

A user can be a member of several teams and hold several roles on the same project, directly and through teams: the user then gets the highest of these roles. Changes to team memberships are reflected immediately in users’ access rights.