Improved handling of users and role collections

[rui1610]

With the recent pull request 109 we have introduced an improved handling of users and role collections.

Now there is a clear separation from the actual use case specific information (services and role collections defined in the usecase.json file) to the actual users (usergroups defined in the parameters.json file).

Changes for the parameters.json file

Within the parameters.json file you can add now a new attribute called myusergroups. Each entry in that attribute has

• a name(to be used as a reference in the usecase.json file)
• a list of members with their email addresses

Here's an example (checkout the default parameters.json file:

...
  "myusergroups": [
    {
      "name": "admins",
      "members": [
        "[email protected]",
        "[email protected]"
      ]
    },
    {
      "name": "developers",
      "members": [
        "[email protected]"
      ]
    }
]
...

Changes for the usecase.json files

Assigning users to a role collection of a service

Within the usecase.json file you can now assign a required role collection of an app subscription to a usergroup you've defined in the parameter.json file (as described above). With that the parameters.json file stays clean and stable. If one of the usergroups listed under assignedUserGroupsFromParameterFile is not found in the parameters.json file, it will simply assign the user, that is running the script to the corresponding role collection.

Here's an example (checkout the default usecase.json file:

...
    {
      "category": "APPLICATION",
      "name": "SAPLaunchpad",
      "plan": "standard",
      "requiredrolecollections": [
        {
          "name": "Launchpad_Admin",
          "assignedUserGroupsFromParameterFile": [
            "developers"
          ]
        }
      ]
    }
...

Assigning users to a role collection

Within the usecase.json file you can now as well assign users to existing role collections or even define role collections, that the btp-setup-automator will create for you in the BTP in the newly introduced attribute assignrolecollections .

Here's an example (checkout the default usecase.json file:

...
  "assignrolecollections": [
    {
      "name": "Global Account Administrator",
      "type": "account",
      "level": "global account",
      "assignedUserGroupsFromParameterFile": [
        "admins"
      ]
    },
...

In that example the usergroup admins (defined in a parameters.json file is assigned to the role collection Global Account Administrator. The attribute type and level define where this role collection exists.

[dachtera]

Is there information documented anywhere on how to create a new role collection group, and assign it other roles? We would like to consolidate multiple groups for a team into one role collection to help streamline both the setup and maintenance process reguarding permissions and access;

Same group 123 created, but we want to add Launchpad Admin, Cloud Admin, etc to the '123' role, instead of having to specify each roll group to each user.

[lechnerc77]

@dachtera : The assignment of custom role collections is possible as described above. using existing role collections
The creation of custom role collections and assignment of roles and users via the btp-setup-automator is not possible as of today.

Please open a feature request.

[lechnerc77]

Feature request is open #268

[lechnerc77]

Functionality provided via PR #273