Which permissions are provided as a JazzPrjAdmin
Hello,
Accepted answer
JazzProjectAdmins Administrators who have the same access as JazzUsers plus permission to perform the following operations:
- Create and modify all process templates.
- Create project areas and team areas.
- Modify the access control settings for project areas.
- Save project areas regardless of the role permission settings in the project areas, which include the ability to generate team member invitations. This override ability does not extend to project areas to which the user does not have read-access.
Comments
Hello Ralph,
No, the abilities of a JazzProjectAdmin is not based on roles ... it is an override to the normal role-based permissions.
This is also reflected by the fact that aj JazzAdmin or JazzProjectAdmin or a member of the administratiors still required to assign yourself roles and permissions (which you can do due to the override) before you can do things like deleting work items etc.
RTC also indicates when the Admin Override kicks in.
Hi Ralph,
In the team advisor in Eclipse for example:
One other answer
As an answer so I have more space.
You are comparing two totally different concepts and there is an issue with understanding the various "Admins". It is important to understand the distinctions and I thought I had already provided that.
1. JazzProjectAdmin is a Repository Role. Such a role allows the user having it to do things on a repository level that other users are not allowed to. The JazzProjectAdmin role allows to create project areas and it allows to add themselves (and other users) to the list of project area administrators. As far as I can tell these activities are not permissions on a project area level. Even if no permissions are given to any role, the JazzProjectAdmin can do this. Users with only JazzUsers or JazzGuests can not do that. JazzProjectAdmin is more limited as JazzAmin.
2. Being in the list of Administrators of a project area provides these users an override for some actions. Even if no role was any permissions in the project area, these users can make themselves a member of the project area, give themselves roles and configure permissions for roles. It does only override a very specific set of operations. E.g. if you don't have a role that has permissions to create work items, you can be member of the Administrators and you still can't create a work item.
There are NO permissions or invisible roles or something like that involved being in the list of Administrators of a project area. If the member of the administrators does something they have no permission to do (from a role perspective) but are allowed as members of the Administrators, when saving the process (in Eclipse) the team advisor states that the user does NOT have the permission but an administrator override allows the operation nevertheless.
Comments
Hi Ralph,
I think I have written it 15 times already, but here goes (as far as I know), otherwise feel free to write a PMR against Documentation.
As a JazzPrjAdmin on that level you can
1. Add yourself to the Project Area Administrators
2. Add yourself to the members of the project area
3. Create New Roles
4. Change permissions on roles
5. Give yourself any role
6. Save the process
So you can basically give yourself all permissions you want and THEN you can wreak havoc in the PA.
I would support a section in the product documentation that says so.