I’m working on getting one of our AWX instances in a full RBAC model, but some users are reporting odd behavior around the “copy” permission specifically for projects. During my testing, it seems like the “copy” permission is managed in some other way besides organization/team permissions. Is this option only available to super users or could it have something to do with the projects being created by a super user?
I would have expected that an organization admin would have the required permissions to copy projects owned by that organization, but that does not seem to be the case. This behavior is the same if I explicitly set project admin for that user.
Strangely enough, I have found that if I give my test user org admin from another specific organization, it ends up getting the copy capability for all the projects in the original org and the new org that was added. This leads me to believe there is something up with the new org, but I can at least state that the user is not a system admin all of a sudden (according to the is_superuser field)
AWX version: 14.1.0, 17.1.0
Example:
Project: test_project
Org: test_org
User: testuser
Org: test_org
Team: test_team
Permissions: test_org admin
testuser user_capabilities for project:
“user_capabilities”: {
“edit”: true,
“delete”: true,
“start”: true,
“schedule”: true,
“copy”: false
}
System Administrator user_capabilities for project:
“user_capabilities”: {
“edit”: true,
“delete”: true,
“start”: true,
“schedule”: true,
“copy”: true
}
Thanks,
Matt