CODEWITHSUNDEEP
mavennexus
vegemite4me
vegemite4me

Reputation: 6856

Can Sonatype Nexus be configured to restrict which artifacts a user can deploy?

I have installed Nexus 2.0.6 and the integration with my LDAP server is working (authentication only). Is there a way to configure Nexus so that only a set of developers are able to deploy a given artifact, or group?

I basically do not want a developer in Team A deploying an artifact that Team B is reponsible for.

Upvotes: 6

Views: 6557

Answers (2)

Eric Manley
Eric Manley

Reputation: 1109

Under Nexus 2.0.1, this is the solution that I've worked through and verified.

Caveats:
This allows one to restrict the "Artifact Upload" option to a directory hierarchy.
This is not quite the same as "deploy" or in conjunction with "release prepare".

Steps:

  1. Remove the single privilege of "Artifact Upload" from all that presently have it, that you do not want to have it.

  2. Create the "Repository-Target" that includes the directory mask of where you want to give access. Ex. .*/com/mycompany/target-dir/.*
    Double check the mask, it starts with period-asterisk AND ends with period-asterisk.

  3. Create the "Repository-Privilege" that maps to the Repository-Target you just created. Typically I include the repo-name in this repository-privilege-name, like "releases.com.mycompany.target-dir". This creates the CRUD entries (4) for said directory.

  4. Next, create the "Role" based on the Repository Privileges you just created (4), plus "Artifact Upload". Total of 5 entries for the role. Use the "Apply Filter" here to help you find these items. I name this role something like "Upload.Role.Releases.Target-Dir". Again, when finished there should be 5 entries for this role:
    Artifact Upload
    com.mycompany.target-dir(create)
    com.mycompany.target-dir(delete)
    com.mycompany.target-dir(read)
    com.mycompany.target-dir(update)

    This is what constrains the upload role to this repo.directory.

  5. Create the User if it does not already exist, assign password.

  6. Give the user the following Roles:
    Nexus Deployment
    Repo: All Maven Repositories(Read)
    UI: Base UI Privileges
    Upload.Role.Relases.Target-Dir

Hit save and you've got it. Later on, you can use this same approach to create a new Role for other repos (say Snapshot or 3rd Party), and keep the same directory mask.

Upvotes: 2

user944849
user944849

Reputation: 14951

You may partition a repository using repository targets, privileges, and roles as described in this Sonatype blog post. I tested this a few months back and it seemed to work well.

Upvotes: 6

Related Questions