Security

FlexDeploy provides its own proprietary repository for managing security, including users, groups, and permissions. The implementation provides a fine-grained permission model so that groups can be configured to match the roles and responsibilities of any organization. FlexDeploy also supports LDAP and Active Directory integration for user authentication. Additionally, you can also enable Single Sign-On and Multi Factor Authentication using external service or corporate security solution.

Security administration is restricted to FlexDeploy Administrators only.

Security Administration

See authentication and authorization summary details below for quick reference.

Authentication

You can configure users in FlexDeploy internal realm or use external LDAP server.

  • See Users to maintain users in FlexDeploy internal realm. If you use this option then you are not relying on external directory servers.
  • You can use Active Directory or other LDAP server for authentication and authorization, see Realms for reference. FlexDeploy user record will still be created when user from external LDAP server logs in for first time. See new user process on Realms page.
  • You can also use both internal as well external realm for users. Users will be first authenticated against external realms and if not successful internal realm will be used.

Authorization

In order to control access to various parts of FlexDeploy, you will be configuring permissions for FlexDeploy groups. FlexDeploy supports coarse and finer grained permissions, see below for details.

Permissions are mainly controlled using FlexDeploy Groups even when using external realm. When using external realm, you can map external directory groups to FlexDeploy groups. Group mapping allows for less security maintenance when new users start using FlexDeploy.

  • Use global permissions control access to various objects in FlexDeploy. Global permissions do not control access at individual item level but rather at entire object level, i.e. if you grant Create / Update access for Workflow to group, members of that group can create or update any workflow. See global permissions for FlexDeploy group.
  • Use deployment permissions to restrict available environments on deployment request form. See deployment permissions for FlexDeploy group. For example, if you want to restrict specific group of users from deploying environments other than development and test, then configure deployment permissions accordingly. Alternatively, you can allow for deployment to all environments and setup approvals using FlexDeploy approvals or external change management system approvals.
  • Finer grained permissions
    1. Project - control access (read, create, configure, execute etc.) to specific projects for FlexDeploy groups. You can configure this for a project or folder. Configurations at folder level apply to all projects contained in it. See Project Security. This model allows for restricting configuration edits of projects to specific groups and still allow others to view and execute build / deploy on projects.
    2. Release - control access (read, configure, execute etc.) to specific release for FlexDeploy groups. You can configure this using global permissions and override at specific release as necessary. See Release Security.
    3. Pipeline - control access (abort, replay, skip etc.) on pipeline execution. Pipeline allows for abstraction in to roles that are mapped to FlexDeploy group and/or users. For example, developers, leaders, managers, operators etc. are some examples of pipeline roles. You can define permissions on each pipeline role. See Pipeline team security.

Permission Matrix

Object TypePermissionNotesGeneral Recommendation
Project1 ReadProject read is allowed, i.e. project can be opened by user.

All Users

Project1 View LogsProject execution and associated logs can be viewed. All Users
Project1 Create Folder/Application/ProjectProject, folder, application can be created.Technical Leads
Project1 Configure Folder/Application/ProjectProject, folder, application can be configured.Technical Leads
Project1 Configure FilesProject files can be populated, updated and evaluated.Developers, Technical Leads
Project1 Configure CommandsDeployment commands (EBS) can be updated. This should be restricted to admin users.FD Administrators
Project1 ExecuteProject build/deploy/test request can be submitted. Deployment environments are further controlled by Deployment Permissions.Developers, Technical Leads
Project Page ViewAllows access to Project menu.All Users
Approval Setup ReadApprovals (outside of pipeline) can be read.All Users
Approval Setup Create / UpdateApprovals (outside of pipeline) can be created or updated.Change Management/Operations
Window Setup ReadSchedule windows (outside of pipeline) can be read.All Users
Window Setup Create / UpdateSchedule windows (outside of pipeline) can be created or updated.Change Management/Operations
Notification Setup ReadConfigured notifications (email) can be read.All Users
Notification Setup Create / UpdateAdditional notifications (email) can be created or updated.All Users
Notification Setup DeleteAdditional notifications (email) can be deleted.All Users
Workflow ReadWorkflow (build,deploy, test etc.) can be read. This contains execution code for build and deployment.All Users
Workflow Create / UpdateWorkflow (build,deploy, test etc.) can be created or updated. This contains execution code for build and deployment.FD Administrators
Release2 ReadRelease (collection of projects for specific delivery) can be read.All Users
Release2 Create/UpdateRelease (collection of projects for specific delivery) can be created or updated.Change Management/Operations
Release2 Create SnapshotCreate snapshot is process of including build version in to release. Developer can be responsible for this as well.Developers, Technical Leads
Release2 Configure Project ListProjects and packages can be added or removed from release. Developers, Technical Leads
Release2 Configure PipelinePipeline can be configured on release with this permission. Access to Override members on Teams tab is also controlled by this permission.Change Management/Operations
Release2 Configure CMSChange management system details can be configured on release with this permission.Change Management/Operations
Release2 Manage LifecycleRelease start, pause, end actions are allowed with this permission.Change Management/Operations
Release2 Grant PermissionsRelease permission can be changed with this permission, otherwise Administrator users can configure permissions.FD Administrators
Pipeline ReadPipeline can be read. Pipeline defined promotion process through various environments.All Users
Pipeline UpdatePipeline can be created or updated.FD Administrators
Report ReadReports can be read.All Users
Environment Instance ReadTopology object read permission.All Users
Environment Instance Create / UpdateTopology object update permission. Allows update to properties like folder, user, password etc. FD Administrators
Environment ReadTopology object read permission.All Users
Environment Create / UpdateTopology environment can be created or updated.FD Administrators
Instance ReadTopology object read permission.All Users
Instance Create / UpdateDeployment target (logical) can be created or updated.FD Administrators
Endpoint ReadEndpoint (SSH configuration) to connect to target nodes can be read.All Users
Endpoint UpdateEndpoint (SSH configuration) to connect to target nodes can be created or updated.FD Administrators
Scheduled Task ReadScheduled task (deployment outside of pipeline waiting for schedule) can be read.All Users
Scheduled Task UpdateScheduled task (deployment outside of pipeline waiting for schedule) can be overriden, allows immediate run of deployment.Change Management/Operations
Plugin ReadPlugin details can be read.All Users
Plugin UploadPlugin can be uploaded and activated. Generally restricted to Administrators. FD Administrators
Property Set ReadConfigured property details (plugin or workflow based) can be read. Internal details.All Users
Template ReadTemplates can be read. Templates allow creation of projects using CSV input data.All Users
Template Create / UpdateTemplates can created or updated.FD Administrators
Defaults ReadDefaults can be read. Defaults allow some customizable defaults when new objects are created in FlexDeploy.All Users
Defaults UpdateDefaults configuration can be updated.FD Administrators
FlexField ReadFlexField configurations can be read. FlexFields are custom inputs to build and deploy workflow requests.All Users
FlexField UpdateFlexFields can be configured (enalbed)FD Administrators
Test Type ReadTest type names can be read. All Users
Test Type Create / UpdateTest type names can be created or updated.FD Administrators
Object Type ReadObject Type customization details can be read. Customization is restricted to Administrator users.All Users
Testing Tool ReadTesting tools configurations can be read. All Users
Testing Tool Create / UpdateCutom testing tools configurations can be created or updated.FD Administrators
Issue Tracking System ReadIssue tracking system configurations can be read.All Users
Issue Tracking System UpdateGlobal configurations for Issue Tracking Systems can be updated.FD Administrators
Change Management System ReadChange management system configurations can be read.All Users
Change Management System UpdateGlobal configurations for change management systems can be updated. FD Administrators
Cloud Account ReadCloud Account details can be read.All Users
Cloud Account Create / UpdateCloud Account can be created or updated.FD Administrators
Artifact Repository Account ReadArtifact Repository Account details can be read.All Users
Artifact Repository Account Create / UpdateArtifact Repository Account can be created or updated.FD Administrators
CI Server Account ReadCI Server Account details can be read.All Users
CI Server Account Create / UpdateCI Server Account can be created or updated.All Users
Analysis Tool Account ReadAnalysis Tool Account details can be read.All Users
Analysis Tool Account Create / UpdateAnalysis Tool Account can be created or updated.All Users
Other Tools Account ReadOther Tools Account details can be read.FD Administrators, DBA, Middleware Administrators
Other Tools Account Create / UpdateOther Tools Account can be created or updated.FD Administrators, DBA, Middleware Administrators
Account Provider ReadAccount providers for cloud accounts can be read.All Users
Account Provider Create / UpdateAccount providers (custom) for cloud accounts can be created or updated.All Users
UserReadUser information can be read. Users management is restricted to Administrator users.All Users
GroupReadGroup information can be read. Group management is restricted to Administrator users.All Users
RealmReadRealm information can be read. Realm configuration is restricted to Administrator users.All Users
CredentialReadCredential details can be read. Note that secret text like password can never be read in clear text, hence you can only see details necessary to request credential from store.All Users
CredentialCreate / UpdateCredential details including secret text like password can be be entered. FD Administrators, DBA, Middleware Administrators
CredentialDeleteCredential can be deleted if not used.FD Administrators, DBA, Middleware Administrators
Credential StoreReadCredential store details can be read. Management of stores is restricted for Administrators.All Users
Credential Store ProviderReadCredential store providers can be read. Management of store providers is restricted for Administrators. All Users
Webhook FunctionsReadWebhook functions can be read.All Users
Webhook FunctionsCreate / UpdateWebhook functions can be created or updated.Technical Leads, Developers
Webhook FunctionsDeleteWebhook functions can be deleted.Technical Leads
Webhook ProvidersReadWebhook providers can be viewed.All Users
Webhook ProvidersCreate / UpdateWebhook providers can be created or updated.Technical Leads, Developers
Webhook MessagesRead - View TrackingWebhook messages screen can be viewed.All Users
Webhook MessagesView LogsWebhook message logs can be viewed.Technical Leads, Developers
Webhook MessagesView ContentWebhook message payload, query params and headers can be viewed.Technical Leads, Developers
Webhook MessagesExecute - Resubmit MessageWebhook message can be resubmitted.Technical Leads, Developers
Deployment Permissions
Allows control which environments user is allowed to perform deployment. 

1 - Project level permissions can be setup at individual project, folder or application (folder or application level setup will apply to child folder and projects unless overridden).

2 - Release level permissions can be setup for individual release.