Skip to content

Commit 30aed6f

Browse files
lecoursendylan-smithisaacmbrowngithub-actionsmattpollard
authored
Custom organization roles (github#38963)
Co-authored-by: Dylan Smith <dylan-smith@github.com> Co-authored-by: isaacmbrown <isaacmbrown@github.com> Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: Isaac Brown <101839405+isaacmbrown@users.noreply.github.com> Co-authored-by: Matt Pollard <mattpollard@users.noreply.github.com> Co-authored-by: Rachael Rose Renk <91027132+rachaelrenk@users.noreply.github.com> Co-authored-by: Hirsch Singhal <1666363+hpsin@users.noreply.github.com> Co-authored-by: Craig Steinberger <cjs@github.com> Co-authored-by: Siara <108543037+SiaraMist@users.noreply.github.com>
1 parent 1ccbc02 commit 30aed6f

File tree

13 files changed

+162
-3
lines changed

13 files changed

+162
-3
lines changed
Loading

content/organizations/managing-organization-settings/managing-rulesets-for-repositories-in-your-organization.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Managing rulesets for repositories in your organization
33
intro: 'You can edit, monitor, and delete existing rulesets to alter how people can interact with repositories in your organization.'
44
versions:
55
feature: repo-rules-enterprise
6-
permissions: 'Organization owners can manage rulesets at the organization level.'
6+
permissions: 'Organization owners and users with the "Manage organization ref update rules and rulesets" permission can manage rulesets at the organization level.'
77
topics:
88
- Organizations
99
shortTitle: Manage rulesets
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
title: About custom organization roles
3+
intro: "You can control access to your organization's settings with custom organization roles."
4+
versions:
5+
feature: 'custom-org-roles'
6+
topics:
7+
- Organizations
8+
shortTitle: Custom organization roles
9+
---
10+
11+
{% data reusables.organizations.custom-org-roles-ghec-only %}
12+
13+
## About custom organization roles
14+
15+
{% data reusables.organizations.custom-org-roles-intro %}
16+
17+
You can create and assign custom organization roles in your organization's settings. You can also manage custom roles using the REST API. For more information, see "[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-organization-roles)."
18+
19+
Organization permissions do not grant read, write, or administrator access to any repositories. Some permissions may implicitly grant visibility of repository metadata, as marked in the table below.
20+
21+
To granularly control access to your organization's repositories, you can create a custom repository role. For more information, see "[AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/about-custom-repository-roles)."
22+
23+
## Permissions for custom roles
24+
25+
When you include a permission in a custom organization role, any users with that role will have access to the corresponding settings via both the web browser and API. In the organization's settings in the browser, users will see only the pages for settings they can access.
26+
27+
{% rowheaders %}
28+
29+
Permission | Description | More information
30+
------------ | -------------|--------------------
31+
Manage custom organization roles | Access to create, view, update, and delete custom organization roles within the organization. This permission does not allow a user to assign custom roles. | "[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-organization-roles)"
32+
View organization roles | Access to view the organization's custom organization roles. | "[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-organization-roles)"
33+
Manage custom repository roles | Access to create, view, update, and delete the organization's custom repository roles. |"[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization)"
34+
View custom repository roles | Access to view the organization's custom repository roles. | "[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization)"
35+
Manage organization webhooks | Access to register and manage webhooks for the organization. Users with this permission will be able to view webhook payloads, which may contain metadata for repositories in the organization. | "[AUTOTITLE](/rest/orgs/webhooks#about-organization-webhooks)" in the REST API documentation
36+
{%- ifversion ghec %}
37+
Manage organization OAuth application policies | Access to the "OAuth application policy" settings for the organization. | "[AUTOTITLE](/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions)"
38+
{%- endif %}
39+
{%- ifversion repository-properties %}
40+
Edit custom properties values at the organization level | Access to set custom property values on all repositories in the organization. | "[AUTOTITLE](/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization)"
41+
Manage the organization's custom properties definitions | Access to create and edit custom property definitions for the organization. | "[AUTOTITLE](/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization)"
42+
{%- endif %}
43+
{%- ifversion repo-rules-enterprise %}
44+
Manage organization ref update rules and rulesets | Access to manage rulesets and view ruleset insights at the organization level. | "[AUTOTITLE](/organizations/managing-organization-settings/managing-rulesets-for-repositories-in-your-organization)"
45+
{%- endif %}
46+
View organization audit log | Access to the audit log for the organization. The audit log may contain metadata for repositories in the organization. | "[AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization)"
47+
48+
{% endrowheaders %}

content/organizations/managing-peoples-access-to-your-organization-with-roles/index.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,12 @@ topics:
1515
- Teams
1616
children:
1717
- /roles-in-an-organization
18+
- /about-custom-organization-roles
19+
- /managing-custom-organization-roles
1820
- /maintaining-ownership-continuity-for-your-organization
1921
- /adding-a-billing-manager-to-your-organization
2022
- /removing-a-billing-manager-from-your-organization
2123
- /managing-security-managers-in-your-organization
2224
- /managing-moderators-in-your-organization
23-
shortTitle: Manage organization with roles
25+
shortTitle: Manage organization roles
2426
---
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
title: Managing custom organization roles
3+
intro: "You can create, edit, and assign custom organization roles in an organization's settings."
4+
versions:
5+
feature: 'custom-org-roles'
6+
topics:
7+
- Organizations
8+
shortTitle: Manage custom roles
9+
---
10+
11+
12+
{% data reusables.organizations.custom-org-roles-ghec-only %}
13+
14+
## About custom organization roles
15+
16+
{% data reusables.organizations.custom-org-roles-intro %} For more information, see "[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles)."
17+
18+
If you are an organization owner or have a custom role with the "View organization roles" or "Manage custom organization roles" permissions, you can view custom roles for the organization. To find the "Custom roles" page, you can follow the first steps in "[Creating a custom role](#creating-a-custom-role)." The exact steps will vary depending on which other settings pages you have access to.
19+
20+
## Creating a custom role
21+
22+
Organization owners and users with the "Manage custom organization roles" permission can create a custom organization role. You can create up to 10 custom roles in an organization.
23+
24+
{% data reusables.profile.access_org %}
25+
{% data reusables.profile.org_settings %}
26+
{% data reusables.organizations.custom-org-roles-settings-step %}
27+
1. Click **Create a role**.
28+
1. Type a name and description for the custom role.
29+
1. Under "Add permissions", click the text field, then select the permissions you want to add to the custom role. For more information about the available permissions, see "[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles#additional-permissions-for-custom-roles)."
30+
1. Click **Create role**.
31+
32+
## Assigning an organization role
33+
34+
Organization owners can assign a custom organization role to a user or team. The "Manage custom organization roles" permission does not allow a user to assign a custom role.
35+
36+
A user or team can have multiple custom roles. However, you can only assign one role at a time. To assign multiple roles to the same user or team, repeat the following instructions for each role you want to assign.
37+
38+
{% data reusables.profile.access_org %}
39+
{% data reusables.profile.org_settings %}
40+
1. In the "Access" section of the sidebar, click **{% octicon "organization" aria-hidden="true" %} Organization roles**, then click **Role assignments**.
41+
1. Click **New role assignment**.
42+
1. Search for users or teams that you want to assign a role to, then select the role you want to give to these users and teams.
43+
1. Click **Add new assignment**.
44+
45+
## Viewing organization role assignments
46+
47+
Organization owners can see which roles are assigned to users and teams.
48+
49+
{% data reusables.profile.access_org %}
50+
{% data reusables.profile.org_settings %}
51+
1. In the "Access" section of the sidebar, click **{% octicon "organization" aria-hidden="true" %} Organization roles**, then click **Role assignments**.
52+
{% data reusables.organizations.custom-org-roles-filter %}
53+
1. To view role assignments, to the right of the user or team, click **NUMBER roles**.
54+
55+
## Deleting organization role assignments
56+
57+
Organization owners can delete a role assignment for a user or team.
58+
59+
{% data reusables.profile.access_org %}
60+
{% data reusables.profile.org_settings %}
61+
1. In the "Access" section of the sidebar, click **{% octicon "organization" aria-hidden="true" %} Organization roles**, then click **Role assignments**.
62+
{% data reusables.organizations.custom-org-roles-filter %}
63+
1. To delete a role, to the right of the role, click **Remove**.
64+
65+
## Editing a custom role
66+
67+
Organization owners and users with the "Manage custom organization roles" permission can edit a custom organization role.
68+
69+
{% data reusables.profile.access_org %}
70+
{% data reusables.profile.org_settings %}
71+
{% data reusables.organizations.custom-org-roles-settings-step %}
72+
1. Next to the role you want to edit, select {% octicon "kebab-horizontal" aria-label="Show custom role actions" %}, then click **Edit role**.
73+
74+
![Screenshot of the "Organization roles" settings. Next to a custom role, an ellipsis icon is highlighted with an orange outline.](/assets/images/help/organizations/edit-custom-org-role.png)
75+
76+
1. Change the role as required, then click **Update role**.
77+
78+
## Deleting a custom role
79+
80+
Organization owners and users with the "Manage custom organization roles" permission can delete a custom organization role.
81+
82+
{% data reusables.profile.access_org %}
83+
{% data reusables.profile.org_settings %}
84+
{% data reusables.organizations.custom-org-roles-settings-step %}
85+
1. Next to the role you want to edit, select {% octicon "kebab-horizontal" aria-label="Show custom role actions" %}, then click **Delete role**.
86+
87+
![Screenshot of the "Organization roles" settings. Next to a custom role, an ellipsis icon is highlighted with an orange outline.](/assets/images/help/organizations/edit-custom-org-role.png)
88+
89+
1. Read the details in the dialog to confirm you want to delete the role, then click **Delete role**.

content/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ Organization-level roles are sets of permissions that can be assigned to individ
3131

3232
You can assign people to a variety of organization-level roles to control your members' access to your organization and its resources. For more details about the individual permissions included in each role, see "[Permissions for organization roles](#permissions-for-organization-roles)."
3333

34+
{% ifversion custom-org-roles %}
35+
For more granular control of access to your organization's settings, you can create a custom organization role. For more information, see "[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles)."
36+
{% endif %}
37+
3438
{% ifversion enterprise-owner-join-org %}
3539
If your organization is owned by an enterprise account, enterprise owners can choose to join your organization with any role. For more information, see "[AUTOTITLE](/admin/user-management/managing-organizations-in-your-enterprise/managing-your-role-in-an-organization-owned-by-your-enterprise)."
3640
{% endif %}

content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/about-custom-repository-roles.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ You can also use the REST API to list the custom repository roles available in y
3333

3434
{% endif %}
3535

36+
{% ifversion custom-org-roles %}
37+
Custom repository roles manage access to repositories in your organization. To granularly control access to your organization's administration settings, you can use custom organization roles. For more information, see "[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles)."
38+
{% endif %}
39+
3640
## About the inherited role
3741

3842
When you create a custom repository role, you start by choosing an inherited role from a set of pre-defined options. The inherited role determines the initial set of permissions included in the custom role. Then, you can further customize the role by choosing additional permissions to give the role. For the full list of available permissions, see "[Additional permissions for custom roles](#additional-permissions-for-custom-roles)."

content/rest/orgs/webhooks.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ Organization webhooks allow your server to receive HTTP `POST` payloads whenever
1919

2020
### Scopes and restrictions
2121

22-
You must be an organization owner to use these endpoints. OAuth tokens require the `admin:org_hook` scope to use these endpoints.
22+
You must be an organization owner{% ifversion custom-org-roles %} or have the "Manage organization webhooks" permission{% endif %} to use these endpoints. OAuth tokens require the `admin:org_hook` scope to use these endpoints.
2323

2424
In order to protect sensitive data which may be present in webhook configurations, we also enforce the following access control rules:
2525

data/features/custom-org-roles.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
versions:
2+
ghec: '*'
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1. Optionally, to filter by role assignments for users, click the **Users** tab. To filter by role assignments for teams, click the **Teams** tab.

0 commit comments

Comments
 (0)