1.35.5 : Allowing non-admin users to create collections #7087
Replies: 5 comments 11 replies
-
|
Only adding a custom role to allow that also means heavy RBAC checks needs to be done all over the place. In that case you can probably also add the rest of all the RBAC checks. The reason is that currently we only have checks for specific roles, |
Beta Was this translation helpful? Give feedback.
-
|
Hi there. We’re facing the same situation. Currently, managers are not able to create collections, nor can they assign new permissions within collections where they already have the “manage collection” role. What would be considered best practice in this case? Should we rely entirely on admins for these tasks? Or is using the “manage all collections” flag the recommended approach? The latter doesn’t seem ideal to us, for the same reason mentioned by XavierRM-S — it would allow users to be granted access to collections they shouldn’t have visibility into. |
Beta Was this translation helpful? Give feedback.
-
|
This has become a frustration for us. This scenario is way too similar to companies with several sites that may need management delegation. It is also the case for families. It makes a lot of sense for them to deploy across their members, giving some leeway to some to handle their own sub-structure. All in all, I am puzzled by this update. |
Beta Was this translation helpful? Give feedback.
-
|
We are also facing the same issue. |
Beta Was this translation helpful? Give feedback.
-
|
Any news on this topic @BlackDex |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi!
I'm having a non-technical issue with a breaking change introduced in 1.35.5 by #6890 , and I wanted to check out if I'm missing any obvious workaround. This change is the fact that collection managers with the "Custom" role were able to create collections before the update, and now cannot.
I set up Vaultwarden in my company to have a centralized credential storage for different teams, and up until now I let team leaders manage their own spaces, including creating/removing collections. I'm considering whether or not I should apply 1.35.5 as that would mean team leaders would have to ask an admin to create collections on their behalf. One option would be to set the "Manage all collections" flag for these leaders, but that would mean giving them access to every single item, which is not something I can do.
This issue would be fixed by an existing feature request (
Add Custom Role support for granular control of user permissions), but it does not seem trivial and I'll take a guess it is not releasing in the coming months 😄. Would there be a simpler feature we could implement to improve this, until an actual access control configuration can be set up? For example, setting what the "Custom" role can and cannot do in the admin interface - would that be a PR you guys would consider integrating?I'm open to hearing any existing feature that would solve this, or any (simple) change that we could implement as a workaround
Beta Was this translation helpful? Give feedback.
All reactions