Rôles

Associez les utilisateurs et les groupes à des rôles, et définissez ce que chaque rôle peut faire.

  1. L’attribut roles
  2. Le rôle default
  3. Objet Role
  4. Options de rôle

L’attribut roles

La liste roles de premier niveau de config.yaml :

Attribut Commentaires
roles
array

Roles
🔗 valid role object

The roles provide RBAC. Each role has a name and 1 or more groups (local, ldap or entraid). The admin and default roles are mandatory (public is the old name of default, and still works).
Since version 4.0.11 you can also add users (local, ldap or entraid).
Since version 5.0.8 options are introduced to add specific role-options.

  • showDesigner: The user can see the designer
  • allowFormDesign: The user can edit the forms config in the designer (categories, constants, forms: save, restore, pull and push the forms repositories). Without it the designer shows them read-only. Default true. (Added in 7.3.0)
  • designAllForms: The designer shows and edits every form. Without it, only the forms whose roles hold one of the user’s roles: the others are left out (never named, a name taken by one is only said to be taken, a form of theirs naming one as a subform shows nothing of it). The subforms no hidden form uses (new ones included) are theirs to edit, a subform a hidden form uses as well as one of theirs is shown read only, and a form saved (a subform aside) must keep one of their roles. A file holding several forms keeps the hidden ones as they are, restoring a backup needs this option, and the form files are left out of the designer’s other explorers (a repository’s whole tree, as the workflows show it). The forms list leaves out the warning of a form name defined twice unless both copies are theirs, and the settings pages’ Forms tabs and a credential’s Used by tab, reached with a part of the settings only (not showSettings), list only the forms their designer shows. Limits the forms only (playbooks and workflows have designAllPlaybooks and designAllWorkflows); inventories, vars files, categories and constants stay visible to every designer. Off, the user may not run a raw expression either (POST /api/v2/expression with an expression of its own, as the designer previews a form not saved yet): it could read the files hidden from them. The expressions of the saved forms still run, and showSettings still allows a raw one. A form saved may not gain an expression or a query the server runs that it does not have already (403). Default true, always true for admins. (Added in 7.5.0)
  • allowPlaybookDesign: The user can edit the playbooks in the designer (save, new, remove, push). Without it the designer shows them read-only. Default true. (Added in 7.0.0)
  • designAllPlaybooks: Show and edit every playbook in the designer; without it, only the playbooks used by the forms the user can see, and the ones no form uses yet. A form uses a playbook by its playbook (with playbookSubPath), its ansible steps and the job template nodes of the workflows it runs (on the app or an rte runner); the forms it can see follow designAllForms. A hidden playbook is never listed nor read: it answers as a missing file, or as a file there already, and a form of theirs naming one, or a workflow file whose nodes run one, is refused. Edit Playbooks still decides whether the shown ones can be changed. Off, the user may not run a raw expression either (POST /api/v2/expression with an expression of its own, as the designer previews a form not saved yet): it could read the files hidden from them. The expressions of the saved forms still run, and showSettings still allows a raw one. A form saved may not gain an expression or a query the server runs that it does not have already (403). Default true, always true for admins. (Added in 7.5.0)
  • allowWorkflowDesign: The user can edit the workflows in the designer (save, new, remove, push). Without it the designer shows them read-only. Default true. (Added in 7.1.0)
  • designAllWorkflows: Show and edit every workflow in the designer; without it, only the workflows used by the forms the user can see, and the ones no form uses yet. A form uses the workflow file it runs (workflow) and the nested workflows that one runs (every workflow a reference may mean, when several have its name); the forms it can see follow designAllForms. A hidden workflow file is never listed nor read (nor named in a credential’s Used by tab, without showSettings): it answers as a missing file, or as a file there already, and a form of theirs naming one, or a workflow file whose nodes run one, is refused. Edit Workflows still decides whether the shown ones can be changed. Off, the user may not run a raw expression either (POST /api/v2/expression with an expression of its own, as the designer previews a form not saved yet): it could read the files hidden from them. The expressions of the saved forms still run, and showSettings still allows a raw one. A form saved may not gain an expression or a query the server runs that it does not have already (403). Default true, always true for admins. (Added in 7.5.0)
  • allowInventoryDesign: The user can edit the inventories in the designer (save, new, remove, push). Without it the designer shows them read-only. Default true. (Added in 7.1.0)
  • allowVarsFileDesign: The user can edit the vars files in the designer (save, new, remove, push). Without it the designer shows them read-only. Default true. (Added in 7.1.0)
  • showSettings: The user can see the settings page
  • showDebugButtons: The user can see the debug buttons on a form
  • showExtravars: The user can see the extravars on a form
  • showLogs: The user can see the server log (Settings > Server log)
  • showAuditLog: The user can see the audit log (Settings > Audit log) without the other settings. Default: admins. (Added in 7.3.0)
  • showAppearanceSettings: The user can change Settings > Appearance (defaults, name, logo, icon, links, environment label, announcements) without the other settings. Default false. (Added in 7.3.0)
  • showConnectionsSettings: The user can manage Settings > Connections (repositories, credentials, secret stores, runners, SSH, notifications, chat assistant, MCP, syslog) without the other settings. Default false. (Added in 7.3.0)
  • showJobs: The user can see the jobs page. Default true.
  • showArtifacts: The user can see the artifacts an AWX job returns. Default true.
  • allowFileUploads: The user can upload files through a form’s file fields. Without it the field is read-only and the upload is refused. Default true. (Added in 7.3.0)
  • allowApiTokens: The user can make API tokens (Profile > API token), living up to API_TOKEN_MAX_DAYS. Default false (true for a role that only sets extendedTokenExpiration, as before this option). (Added in 7.3.0)
  • extendedTokenExpiration: With allowApiTokens, the user can also make API tokens that never expire. Default false.
  • showAllJobLogs: The user can see all job logs (not only his own) (Added in 5.0.9)
  • admin: The role’s users are admins, as the admin role’s own: every form, the designer, the settings and the users, whatever the role is called (platformAdmins, infra_admins). Only an admin turns it on for a role with members or adds members to such a role, and a save that would take admin away from the admin saving it is refused. Never on the default role. Default false ; always true for the admin role. (Added in 7.6.0)
  • allowLogin: The user can login.
  • allowBackupOps: The user can perform database operations, such as backup and restore.
  • allowVerboseMode: The user can enable verbose mode on ansible forms.
  • allowJobRelaunch: The user can relaunch jobs with pre-filled form data from previous submissions.
  • allowJobDeletion: The user can delete jobs (their own ; an admin every job). Without it the job history stays whole. Default true. (Added in 7.3.0)
  • manageAllJobs: The user can abort, delete and relaunch the jobs of every user, not only their own, without the admin role (delete and relaunch also need allowJobDeletion and allowJobRelaunch). Default: admins. (Added in 7.3.0)
  • allowScheduledJobs: The user can create and manage scheduled jobs (recurring cron or one-time). Default for admins only. Grant it only to roles you would trust as admins: every user with this option sees and can change all schedules, not only their own, and a schedule they create runs with admin rights, for any form. (Added in 6.1.5)
  • allowStoredJobs: The user can store and load job data for later use. (Added in 6.1.5)
  • allowStoredJobsShare: The user can share a stored job, so other users can load it from the form (they need allowStoredJobsViewAll). The stored job stays theirs: only they (and the admins) can change or delete it. Default: admins. (Added in 7.5.0)
  • allowStoredJobsViewAll: The user sees the stored jobs other users shared, in the Load list of a form they may open, and can load them. Default: admins. (Added in 7.5.0)
  • allowPlannedJobs: The user can plan a one-time run of a form they may run (“Run later”). The job runs as that user, not as admin, and they cannot see or change other schedules. (Added in 6.1.5)
  • allowChat: The user can use the chat assistant (when it is enabled). Default true. (Added in 6.5.0)
  • allowMcp: The user can use the MCP server from an AI agent (when it is enabled). Defaults to the role’s allowChat. (Added in 7.0.0)

When options are not set, the admin role will have all options.
When options are set on the default role, they are everyone’s defaults: they have the lowest precedence and only fill the options none of the user’s own roles set.
You can add options on role level, which override the default role’s options. Between a user’s own roles the most restrictive wins (an option false on one of them is false).
The default role is every signed-in user’s ; there is no anonymous access. public is its name before 7 and keeps working (forms listing public still match), but new configs say default.

The allowLogin option is different, that is for the backend. By default everyone can login.
You can set it to false on default and then enable on the roles you want to give access. Watch out you don’t lock yourself out.

Exemples :

1) Roles

roles:
- name: admin        # is mandatory
  groups:
  - local/admins
  - ldap/Domain Admins
  - entraid/Domain Admins
- name: operator
  groups:
  - local/operator
- name: architect
  groups:
  - local/architect
  options:
    showDesigner: true      # architects can see the designer
    showLogs: true          # architects can see the logs
    allowJobRelaunch: true  # architects can relaunch jobs with pre-filled data
- name: demo
  groups:
  - local/demo
- name: usersonly
  users:
  - local/myuser
- name: default        # is mandatory
  groups: []  
  options:
    showDebugButtons: true  # everyone can see the debug buttons
    showExtraVars: true     # everyone can see the extravars

Le rôle default

Chaque utilisateur connecté a le rôle default, si bien qu’un formulaire avec roles: [default] est ouvert à tous ceux qui peuvent se connecter. Il n’y a pas d’accès anonyme : personne ne reçoit ce rôle sans se connecter.

Le rôle ne contient ni groupes ni utilisateurs, puisqu’il s’applique déjà à tout le monde. Ses options sont les valeurs par défaut de tous, comme décrit dans Options de rôle plus bas. config.yaml doit avoir un rôle admin et un rôle default, et la page des rôles les affiche tous deux comme Requis.

default s’appelait public avant la 7.0.0, et l’ancien nom fonctionne toujours :

  • Dans un formulaire, roles: [public] correspond toujours à tous les utilisateurs, les formulaires de vos dépôts n’ont donc pas besoin d’être modifiés.
  • Dans config.yaml, un rôle appelé public est renommé default dans le fichier au chargement de la config. Seul le nom change, une sauvegarde de la config est faite d’abord, et une config conservée dans un dépôt a alors une modification à pousser.
  • Dans un modèle ytt, le modèle n’est pas réécrit : la config qu’il produit est renommée, et un avertissement dans le journal vous demande de renommer aussi le rôle dans le modèle. La version 8 y refuse un rôle public.

Une config qui a à la fois un rôle default et un rôle public est refusée, car il s’agit du même rôle.

Objet Role

Chaque entrée de la liste roles :

A role allows RBAC. Each role has 1 or more groups (local or ldap). Except the default role (public its old name), which has no groups.
The default and admin roles are mandatory.

Attribut Commentaires
name
string / required / unique

The name of the role
alphanumeric + dash + underscore + space

The name of a role has to be unique. The default and admin roles are mandatory.
groups
array / required

Groups
A group (local, ldap or entraid)

A list of groups. They must be in the format of local/groupname or ldap/groupname or entraid/groupname

A Microsoft Entra ID group can be named by its object id, entraid/<object id>: unique, where two groups can share a display name. Both work ; the object id is the one to prefer.

azuread/, the Microsoft Entra ID prefix of before 7.3, still works the same as entraid/ (deprecated, removed in 8.0) ; the roles editor writes entraid/.
users
array / required
added in version 4.0.10

User
A user (local, ldap or entraid)

A list of local or ldap users. They must be in the format of local/username or ldap/username or entraid/username (azuread/username before 7.3, still accepted)
credentials
array
added in version 7.0.0

The credentials this role may use
regular expressions, matching a whole credential name

Limits the credentials a user of this role may use: those a job passes to a playbook or a template (the form’s credentials, ansibleCredentials, vaultCredentials, a credential field), and those a form query or fnCredentials reads while the user fills in a form. Each entry is a regular expression that must match the whole name ; __self__ is AnsibleForms’ own database.

A user none of whose roles lists credentials may use every credential, as before. Once one of their roles lists them, they may use what any of the roles that list them allows. The admin role is never limited. A launch that needs a credential the roles do not allow is refused before the job is created.
secretStores
array
added in version 7.0.0

The secret stores this role may read inline
secret store names

Limits the secret stores a user of this role may read through an inline reference (vault:<path>, secret:<store>:<ref>) in a credential map, a query or fnCredentials. When a role limits the credentials and none limits the stores, an inline reference must match a credential pattern itself: it is no way around them. Combined across roles as credentials.
runners
array
added in version 7.0.0

The runners this role may run jobs on
runner names

Limits the runners a job of a user of this role may run on: the form’s runner, or the default runner when it names none. Combined across roles as credentials.
options
object
added in version 5.0.8

Role options
Key value pairs

Since version 5.0.8 you can add specific role options. The options are used to enable or disable certain features for a role.
The options are:

  • showDesigner: The user can see the designer
  • allowFormDesign: The user can edit the forms config in the designer (categories, constants, forms: save, restore, pull and push the forms repositories). Without it the designer shows them read-only. Default true. (Added in 7.3.0)
  • designAllForms: The designer shows and edits every form. Without it, only the forms whose roles hold one of the user’s roles: the others are left out (never named, a name taken by one is only said to be taken, a form of theirs naming one as a subform shows nothing of it). The subforms no hidden form uses (new ones included) are theirs to edit, a subform a hidden form uses as well as one of theirs is shown read only, and a form saved (a subform aside) must keep one of their roles. A file holding several forms keeps the hidden ones as they are, restoring a backup needs this option, and the form files are left out of the designer’s other explorers (a repository’s whole tree, as the workflows show it). The forms list leaves out the warning of a form name defined twice unless both copies are theirs, and the settings pages’ Forms tabs and a credential’s Used by tab, reached with a part of the settings only (not showSettings), list only the forms their designer shows. Limits the forms only (playbooks and workflows have designAllPlaybooks and designAllWorkflows); inventories, vars files, categories and constants stay visible to every designer. Off, the user may not run a raw expression either (POST /api/v2/expression with an expression of its own, as the designer previews a form not saved yet): it could read the files hidden from them. The expressions of the saved forms still run, and showSettings still allows a raw one. A form saved may not gain an expression or a query the server runs that it does not have already (403). Default true, always true for admins. (Added in 7.5.0)
  • allowPlaybookDesign: The user can edit the playbooks in the designer (save, new, remove, push). Without it the designer shows them read-only. Default true. (Added in 7.0.0)
  • designAllPlaybooks: Show and edit every playbook in the designer; without it, only the playbooks used by the forms the user can see, and the ones no form uses yet. A form uses a playbook by its playbook (with playbookSubPath), its ansible steps and the job template nodes of the workflows it runs (on the app or an rte runner); the forms it can see follow designAllForms. A hidden playbook is never listed nor read: it answers as a missing file, or as a file there already, and a form of theirs naming one, or a workflow file whose nodes run one, is refused. Edit Playbooks still decides whether the shown ones can be changed. Off, the user may not run a raw expression either (POST /api/v2/expression with an expression of its own, as the designer previews a form not saved yet): it could read the files hidden from them. The expressions of the saved forms still run, and showSettings still allows a raw one. A form saved may not gain an expression or a query the server runs that it does not have already (403). Default true, always true for admins. (Added in 7.5.0)
  • allowWorkflowDesign: The user can edit the workflows in the designer (save, new, remove, push). Without it the designer shows them read-only. Default true. (Added in 7.1.0)
  • designAllWorkflows: Show and edit every workflow in the designer; without it, only the workflows used by the forms the user can see, and the ones no form uses yet. A form uses the workflow file it runs (workflow) and the nested workflows that one runs (every workflow a reference may mean, when several have its name); the forms it can see follow designAllForms. A hidden workflow file is never listed nor read (nor named in a credential’s Used by tab, without showSettings): it answers as a missing file, or as a file there already, and a form of theirs naming one, or a workflow file whose nodes run one, is refused. Edit Workflows still decides whether the shown ones can be changed. Off, the user may not run a raw expression either (POST /api/v2/expression with an expression of its own, as the designer previews a form not saved yet): it could read the files hidden from them. The expressions of the saved forms still run, and showSettings still allows a raw one. A form saved may not gain an expression or a query the server runs that it does not have already (403). Default true, always true for admins. (Added in 7.5.0)
  • allowInventoryDesign: The user can edit the inventories in the designer (save, new, remove, push). Without it the designer shows them read-only. Default true. (Added in 7.1.0)
  • allowVarsFileDesign: The user can edit the vars files in the designer (save, new, remove, push). Without it the designer shows them read-only. Default true. (Added in 7.1.0)
  • showSettings: The user can see the settings page
  • showDebugButtons: The user can see the debug buttons on a form
  • showExtravars: The user can see the extravars on a form
  • showLogs: The user can see the server log (Settings > Server log)
  • showAuditLog: The user can see the audit log (Settings > Audit log) without the other settings. Default: admins. (Added in 7.3.0)
  • showAppearanceSettings: The user can change Settings > Appearance (defaults, name, logo, icon, links, environment label, announcements) without the other settings. Default false. (Added in 7.3.0)
  • showConnectionsSettings: The user can manage Settings > Connections (repositories, credentials, secret stores, runners, SSH, notifications, chat assistant, MCP, syslog) without the other settings. Default false. (Added in 7.3.0)
  • showJobs: The user can see the jobs page. Default true.
  • showArtifacts: The user can see the artifacts an AWX job returns. Default true.
  • allowFileUploads: The user can upload files through a form’s file fields. Without it the field is read-only and the upload is refused. Default true. (Added in 7.3.0)
  • allowApiTokens: The user can make API tokens (Profile > API token), living up to API_TOKEN_MAX_DAYS. Default false (true for a role that only sets extendedTokenExpiration, as before this option). (Added in 7.3.0)
  • extendedTokenExpiration: With allowApiTokens, the user can also make API tokens that never expire. Default false.
  • showAllJobLogs: The user can see all job logs (not only his own) (Added in 5.0.9)
  • admin: The role’s users are admins, as the admin role’s own: every form, the designer, the settings and the users, whatever the role is called (platformAdmins, infra_admins). Only an admin turns it on for a role with members or adds members to such a role, and a save that would take admin away from the admin saving it is refused. Never on the default role. Default false ; always true for the admin role. (Added in 7.6.0)
  • allowLogin: The user can login.
  • allowBackupOps: The user can perform database operations, such as backup and restore.
  • allowVerboseMode: The user can enable verbose mode on ansible forms.
  • allowJobRelaunch: The user can relaunch jobs with pre-filled form data from previous submissions.
  • allowJobDeletion: The user can delete jobs (their own ; an admin every job). Without it the job history stays whole. Default true. (Added in 7.3.0)
  • manageAllJobs: The user can abort, delete and relaunch the jobs of every user, not only their own, without the admin role (delete and relaunch also need allowJobDeletion and allowJobRelaunch). Default: admins. (Added in 7.3.0)
  • allowScheduledJobs: The user can create and manage scheduled jobs (recurring cron or one-time). Default for admins only. Grant it only to roles you would trust as admins: every user with this option sees and can change all schedules, not only their own, and a schedule they create runs with admin rights, for any form. (Added in 6.1.5)
  • allowStoredJobs: The user can store and load job data for later use. (Added in 6.1.5)
  • allowStoredJobsShare: The user can share a stored job, so other users can load it from the form (they need allowStoredJobsViewAll). The stored job stays theirs: only they (and the admins) can change or delete it. Default: admins. (Added in 7.5.0)
  • allowStoredJobsViewAll: The user sees the stored jobs other users shared, in the Load list of a form they may open, and can load them. Default: admins. (Added in 7.5.0)
  • allowPlannedJobs: The user can plan a one-time run of a form they may run (“Run later”). The job runs as that user, not as admin, and they cannot see or change other schedules. (Added in 6.1.5)
  • allowChat: The user can use the chat assistant (when it is enabled). Default true. (Added in 6.5.0)
  • allowMcp: The user can use the MCP server from an AI agent (when it is enabled). Defaults to the role’s allowChat. (Added in 7.0.0)

When options are not set, the admin role will have all options.
When options are set on the default role, they will have the lowest precedence and can be used as default options for all roles.
You can add options on role level, which will override the default role options.
Examples

1) Roles

roles:
- name: admin        # is mandatory
  groups:
  - local/admins
  - ldap/Domain Admins
- name: operator
  groups:
  - local/operator
  users:
  - entraid/mike
- name: architect
  groups:
  - local/architect
  options:
    showDesigner: true # architects can see the designer
    showLogs: true     # architects can see the logs
- name: demo
  groups:
  - local/demo
- name: default        # is mandatory
  groups: []  
  options:
    showDebugButtons: true  # everyone can see the debug buttons
    showExtraVars: true     # everyone can see the extravars

Options de rôle

Les options d’un rôle activent ou désactivent des fonctionnalités pour ses membres. Depuis la 7.3.0, la page du rôle les affiche en quatre groupes, chaque option avec un (i) qui explique ce qu’elle donne, le même texte que celui de la vue Autorisations du profil :

Option Permet à l’utilisateur de Défaut
Paramètres    
showSettings Voir et modifier toutes les pages de paramètres ; le journal du serveur et les sauvegardes ont leurs propres options Admins uniquement
showAppearanceSettings Modifier les paramètres d’apparence, sans les autres paramètres (depuis la 7.3.0) Désactivé
showConnectionsSettings Gérer les paramètres de connexions (identifiants, runners et plus), sans les autres paramètres (depuis la 7.3.0) Désactivé
showLogs Voir le journal du serveur Admins uniquement
showAuditLog Voir le journal d’audit, sans les autres paramètres (depuis la 7.3.0) Admins uniquement
allowBackupOps Sauvegarder et restaurer la base de données Admins uniquement
Concepteur    
showDesigner Voir et utiliser le concepteur Admins uniquement
allowFormDesign Modifier la config des formulaires dans le concepteur : catégories, constantes et formulaires. Sans elle, lecture seule (depuis la 7.3.0) Activé
designAllForms Voir et modifier tous les formulaires dans le concepteur. Sans elle, seulement les formulaires des rôles de l’utilisateur (depuis la 7.5.0) Activé
allowPlaybookDesign Modifier les playbooks dans le concepteur : les enregistrer, créer, retirer et pousser. Sans elle, lecture seule Activé
designAllPlaybooks Voir et modifier tous les playbooks dans le concepteur. Sans elle, seulement ceux qu’utilisent les formulaires de l’utilisateur ou qu’aucun formulaire n’utilise encore (depuis la 7.5.0) Activé
allowWorkflowDesign Modifier les workflows dans le concepteur : les enregistrer, créer, retirer et pousser. Sans elle, lecture seule Activé
designAllWorkflows Voir et modifier tous les workflows dans le concepteur. Sans elle, seulement ceux qu’utilisent les formulaires de l’utilisateur ou qu’aucun formulaire n’utilise encore (depuis la 7.5.0) Activé
allowInventoryDesign Modifier les inventaires dans le concepteur : les enregistrer, créer, retirer et pousser. Sans elle, lecture seule Activé
allowVarsFileDesign Modifier les fichiers de variables dans le concepteur : les enregistrer, créer, retirer et pousser. Sans elle, lecture seule Activé
Jobs    
showJobs Voir la page des jobs Activé
showAllJobLogs Voir les jobs de tous les utilisateurs, pas seulement les siens Admins uniquement
manageAllJobs Interrompre, supprimer et relancer les jobs de tous les utilisateurs ; supprimer et relancer nécessitent aussi les deux options ci-dessous (depuis la 7.3.0) Admins uniquement
showExtravars Voir les extravars d’un formulaire et d’un job Activé
showDebugButtons Voir les boutons de débogage d’un formulaire Activé
showArtifacts Voir les artefacts d’un job : ce que renvoie un job AWX, ou ce qu’un playbook a collecté avec set_stats Activé
allowVerboseMode Exécuter des jobs en mode verbeux Activé
allowJobRelaunch Relancer un job avec les données de formulaire d’une exécution précédente Admins uniquement
allowJobDeletion Supprimer des jobs : les siens, ou ceux de tous les utilisateurs avec manageAllJobs. Sans elle, l’historique des jobs reste complet (depuis la 7.3.0) Activé
allowScheduledJobs Créer et gérer des planifications récurrentes et ponctuelles, sur la page Planifications (voir l’avertissement ci-dessous) Admins uniquement
allowPlannedJobs Planifier un job pour qu’il s’exécute une fois à une heure donnée (Exécuter plus tard) Activé
allowStoredJobs Enregistrer les données d’un formulaire et les recharger plus tard Activé
Accès et intégrations    
allowLogin Se connecter à AnsibleForms Activé
allowChat Utiliser l’assistant de chat, quand il est activé Activé
allowMcp Utiliser le serveur MCP depuis un agent IA, quand il est activé Le allowChat du rôle
allowFileUploads Téléverser des fichiers via les champs fichier d’un formulaire (depuis la 7.3.0) Activé
allowApiTokens Créer des jetons d’API pour des scripts, jusqu’à la durée de vie maximale qu’autorise l’instance (depuis la 7.3.0) Désactivé
extendedTokenExpiration Créer aussi des jetons d’API qui n’expirent jamais ; nécessite allowApiTokens Désactivé

Certaines options en incluent d’autres, et la page du rôle affiche celles qui sont incluses activées et grisées :

  • showSettings donne aussi showAppearanceSettings, showConnectionsSettings et showAuditLog.
  • manageAllJobs donne aussi showAllJobLogs, car agir sur les jobs de tous les utilisateurs suppose de les voir.
  • Les options de conception ne comptent qu’avec showDesigner, et extendedTokenExpiration qu’avec allowApiTokens.

Jusqu’à la 7.2.0, showAllJobLogs permettait aussi à un utilisateur d’interrompre et de supprimer les jobs qu’elle affichait ; depuis la 7.3.0, il faut manageAllJobs. Un rôle d’avant la 7.3.0 avec extendedTokenExpiration et sans allowApiTokens reçoit allowApiTokens, et garde donc ses jetons.

designAllForms, designAllPlaybooks et designAllWorkflows sont toujours activées pour les admins, et ce que le concepteur montre à un utilisateur sans elles est décrit dans Concepteurs limités.

Admins uniquement signifie activé pour les utilisateurs qui ont le rôle admin, et désactivé pour tous les autres. Quand un utilisateur correspond à plusieurs rôles, les options se combinent comme suit :

  • Entre les rôles de l’utilisateur, une option n’est activée que si tous les rôles qui la définissent sont d’accord : un false explicite l’emporte.
  • Le rôle default complète les options qu’aucun des autres rôles de l’utilisateur ne définit, il peut donc contenir des valeurs par défaut pour tous.
  • Les options définies nulle part prennent la valeur par défaut du tableau.

showExtraVars, avec un V majuscule, est accepté comme autre orthographe de showExtravars ; quand l’une des deux orthographes vaut false, l’option est désactivée.

Traitez allowScheduledJobs comme une option de niveau admin. Les planifications n’appartiennent pas à l’utilisateur qui les a créées : chaque utilisateur ayant l’option voit et peut modifier toutes les planifications. Une planification s’exécute aussi avec des droits d’admin, pour n’importe quel formulaire, quels que soient les accès propres de son créateur. Ne l’accordez qu’aux rôles auxquels vous feriez confiance comme admins.

allowLogin: false sur le rôle default bloque tous les utilisateurs dont les autres rôles ne définissent pas allowLogin: true, y compris les admins. Réaccordez-la sur les rôles qui doivent se connecter avant d’enregistrer.