How to manage organization members / permissions?

[maordavidov]

After creating an organization, I want it to be available to all members as readonly by default and allow specific users managing it.

How can I do that? when I'm logging in through the organization owner things looks ok but when login from a different user I can't see anything.

[alfespa17]

You can check this.

https://docs.terrakube.io/user-guide/organizations/team-management

[alfespa17]

Even if you are inside the admin group your group will need to be inside an organization team.

The admin group can only create organization and handle team access

[alfespa17]

If you add a team and you don't grant any permissionz it will have only read access inside the organization

[maordavidov]

So a team is yet another group?

[alfespa17]

You could say team = group in dex

This is why we need to return the groups in Dex so we can know which groups we grant access inside the organization.

[maordavidov]

And there is no way to make a public read-only organization? We'd like to offer our terraform registry with seamless integration to our customers, and we can't ask them to add themselves to a group.

To be honest, it's also not secure enough because the SSO is not under our control so any customer can potentially get admin access if he knows the admin group name...

[alfespa17]

If you run terraform login terrakube.your-registry.com and you authenticate successfully you should be able to use modules there is no need to be in a particular group for that.

If you want to use the Terrakube UI to do module management (create, delete) you will need to be in a team inside an organization

[MARVELMafia]

Any update on this? I am seeing the same message on my new Terrakube Deployment. I have created an admin team but I have no idea how to become a member of that?

[MARVELMafia]

Hi @alfespa17, thanks so much for your response!
Definetly this helped me progress one step ahead. I added the team after decoding the jwt token. Next, when I try to add a VCS I get the following

and once I do grant access I get

have you seen this before?
here is what the terrakube-api logs tell me
2024-03-14 23:26:50.347 INFO 1 --- [nio-8080-exec-5] o.t.a.p.v.controller.CallbackController : Updating connection for vcs 0f672e50-e18e-11ee-9794-ef5b77dc12b1 2024-03-14 23:26:50.398 INFO 1 --- [nio-8080-exec-5] o.terrakube.api.plugin.vcs.TokenService : Searching VCS by Id 2024-03-14 23:26:50.422 ERROR 1 --- [nio-8080-exec-5] o.a.c.c.C.[.[.[/].[dispatcherServlet] : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is javax.persistence.EntityNotFoundException: Unable to find org.terrakube.api.rs.vcs.Vcs with id 0f672e50-e18e-11ee-9794-ef5b77dc12b1] with root cause javax.persistence.EntityNotFoundException: Unable to find org.terrakube.api.rs.vcs.Vcs with id 0f672e50-e18e-11ee-9794-ef5b77dc12b1 at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl$JpaEntityNotFoundDelegate.handleEntityNotFound(EntityManagerFactoryBuilderImpl.java:177) ~[hibernate-core-5.6.15.Final.jar:5.6.15.Final]

[alfespa17]

Hello @MARVELMafia, make sure to copy correctly the callback url when you are creating the VCS connection to put the correct information in the oauth application in bitbucket.

https://docs.terrakube.io/user-guide/vcs-providers/bitbucket.com

[MARVELMafia]

@alfespa17 is that the same URI that I use in my helm chart values in dex.config.connectors.redirectURI: https://terrakube-api.company.com/dex/callback ?

[alfespa17]

It is not that value, you will see the correct value in the UI when you are creating a new VCS connection in the middle part of the screen it says "callback url"

[MARVELMafia]

Worked! Thank you @alfespa17
I will definetly be around bothing you with more questions soon