promotion job permission

[sushant-pradhan]

Hello,
I am using artifactory promotion REST plugin 1 to move maven snapshot binaries from one repo to another. The plugin works fine if executed using a admin user. But as part of my pipeline integration, I dont want to run it using a admin user. I have created a different group/user and given the group complete write permission on source repo (maven-snapshot) and target repo (maven-release). Still the rest call [2] is failing with:

Maven Promote Curl execution result : {
  "errors" : [ {
    "status" : 403,
    "message" : "You are not permitted to execute the promotion 'snapshotToRelease'."
  } ]
}

Can you help me with the above plugin. Is it possible to run it with non admin user and if so, what permissions should we be having for the non admin user?

[2] curl -X POST -u****:**** https://artifactory.xxx.devops.com/artifactory/api/plugins/build/promote/snapshotToRelease/FOO :: bar-spring-ui/6?params=snapExp=SNAPSHOT%7CtargetRepository=maven-release

[elioengcomp]

Hi @an-sush,

As part of the promotion definition, you can specify which users and groups you would like to allow to run it. It will look like this:

promotions {
    snapshotToRelease(users: [<LIST_USERS_HERE>].toSet(), groups: [LIST_GROUPS_HERE].toSet(), <ADDITIONAL_PARAMETERS>) {
        // Promotion logic
    }
}

For more information check the User Plugins Wiki Page: https://www.jfrog.com/confluence/display/RTF/User+Plugins#UserPlugins-Promotions

[sushant-pradhan]

Thankyou @elioengcomp. This really helps.

What I am looking for is a pattern for users/group names so want to see/understand the existing code and if it supports customization.
I will need multiple groups like ABC-PromotionEngineers, XYZ-PromotionEngineers to promote artifact. The list for my needs is big and gradually growing. So instead of changing it every time there is a addition, if the tools supports *-PromotionEngineers, it would be good

[elioengcomp]

Unfortunately, patterns are not supported by the User Plugins engine when defining users and groups permissions for the plugins at this moment.

I've created a Jira RTFACT-17046 requesting for this feature. You can access the Jira and vote for that request to help it get prioritized.

[fluxxBot]

We appreciate your feedback and respect every comment left by users. However, I see that the JIRA ticket opened for this improvement is already closed, so we are closing this request because it has been opened for a while and there has been no activity on it. If you have any updates or queries, please submit a new request with the most recent information.