Dashboard

[Aakhyan]

Hi Team & @snipe,

I have some feature requests:

1. Currently, there is no option to provide Dashboard access to anyone else except the Admin or SuperAdmin.

Is it possible to add the option of Dashboard under the Groups Permissions section, so that they can have a access of the dashboard for overall view, but without Admin rights.

The need is that I want to provide custom rights to our Assets Manager, instead of the Admin, so they can't delete anything or have the Admin/Super-Admin privileges.

This should be a must have option, as I know many people will want it.

2. Option for multiple SAML i.e. An organization could have different sub-entities with different domains for it. So providing option of configuring multiple SAML could allow the organizations to secure the logins with SAML SSO.

3. Multiple Google Workspace Login Settings similar to above request.

4. Options for some prominent Email Services such as M365, Zoho, etc. for configuring the Login similar to currently provided "Google Workspace Login Settings".

5. Option for assigning Multiple Manager to users. Purpose: In a scenario if one Asset-Manager is on leave for long duration, then the other Asset-Manager can do a audit/operations).
   (P.S Is it possible to assign a Manager over another Manager, so that they can manage the other manager's users as well?)

Looking forward to hearing from your end.

[prboyer]

Focusing on just one of your feature requests-

Currently, there is no option to provide Dashboard access to anyone else except the Admin or SuperAdmin.

Is it possible to add the option of Dashboard under the Groups Permissions section, so that they can have a access of the dashboard for overall view, but without Admin rights.

The need is that I want to provide custom rights to our Assets Manager, instead of the Admin, so they can't delete anything or have the Admin/Super-Admin privileges.

I agree that this would be a welcomed innovation for a modern release of Snipe-IT. I shared my thoughts in #12190 in March of this year-

Adding another +1 for this feature request.

We are using Snipe at a university to manage our assets and where they are deployed. It would be great to allow our student hourlies to see a dashboard when the log in (like an admin/super admin would), but not have full administrative access to the instance. There are many settings in Snipe we don't want students changing!

Looking at the issue backlogs, I see this feature has been mentioned and requested several times:

1. Feature request: Ability to grants rights for USERS (operators) to access the dashboard without giving them ADMIN rights #2419
2. Show dashboard for non-admins #4484
3. [Feature Request]: Client Access to Dashboard without Admin/Super User Permissions #12190

It also appears that @snipe and the team have been working on implementing this as of 05/01/2024 (#14669 ), and more recently it has been emphasized in CloCkWeRX#14.

I also see @snipe added a Feature tag to #12190 last week, so reading between the lines maybe this is indicative of good things to come.

Cheers 🍻

[snipe]

I would hesitate to bring in CloCkWeRx into this convo since he made the choice to do a hard fork (take his toys and go home) and he now maintains his own fork.

I think it would help if I understood a little more about the use-cases in play.

We do have to worry about scoping and making sure data leakage doesn’t accidentally happen, obviously.

Why would it be useful to have the student hourlies see that dashboard? What is the problem we’re actually trying to solve? What is their role? And perhaps more importantly, should that be an entirely different dashboard based on the reasons why it would be useful?

A lot of this is presentation layer. We don’t want to give you a dashboard with links that will give you a sad panda. Lots of folks ask for this feature but few explain how it helps the workflow.

Which begs the question: what would that dashboard give them that they wouldn’t already have if they have the appropriate permissions?

(This is not a sarcastic question btw)

[prboyer]

Appreciate you taking the opportunity to keep the dialogue open with this request!

I would hesitate to bring in CloCkWeRx into this convo since he made the choice to do a hard fork (take his toys and go home) and he now maintains his own fork.

I was not aware this was the situation, so yes I agree that for the purposes of this discussion it is out of scope.

Why would it be useful to have the student hourlies see that dashboard? What is the problem we’re actually trying to solve? What is their role? And perhaps more importantly, should that be an entirely different dashboard based on the reasons why it would be useful?

Our blocker is that we'd like to restrict what permissions students are allowed within our instance. Currently, students need to be administrators in the instance (at minimum) to be able to see the dashboard, but this ends up yielding them far too many permissions within the application and then inevitably undesirable outcomes arise.

Screenshot credit to @JonWVBFL #12190 (comment) )

For example, we have LDAP imports setup to automatically create users in a specific way. We've run into several instances of user objects being created manually and incorrectly (along with other undesirable settings changes). Now, a throw away answer here would just be that we need better training and processes, and yes while that may be true I am a believer in the principle that administrators should be able to configure the software to prevent undesirable outcomes from happening in the first place.

If there were a Dashboard delegation (similar to other permissions that can be scoped to groups), we could still allow the students to view the dashboard without being full admins in the instance and further be able to restrict which permissions they are granted on a granular level.

Otherwise, when you log into the instance, if you are not an administrator (or super admin), you aren't presented with a welcome page or dashboard.

Screenshot credit to @JonWVBFL #12190 (comment)

Hopefully this helps provide some context for you on this request and how it could help solve our specific situation. Others may have more datapoints to share on how implementing this could work for them.

[snipe]

Thank you - I really appreciate this feedback.

I think I might still be unclear though why a student worker would need access to a dashboard at all. When they login, they obviously see their own stuff, but the left nav gives them other options to view/manage/however you decide their permissions work, so in your own context, how does a dashboard help a person in that role, especially if it's largely read-only.

[prboyer]

how does a dashboard help a person in that role, especially if it's largely read-only

I may not have made it clear enough in my last comment. We aren't looking to make the instance read-only for our students. We just want to implement more RBAC over what they are allowed to do in the instance. We want them to be able to create new assets, check them in/out to users, and perform other duties as assigned. But we want to make sure they aren't given too much freedom to make changes (either intentionally or accidentally) that aversely affect the rest of the department.

why a student worker would need access to a dashboard at all

I think there is value in the students being able to see the dashboard, specifically the action log, to that they can observe what changes have been made recently. In addition, we have students who work asynchronous shifts, so it would be beneficial for Student B to see that Student A already checked in Asset 0100 during their shift earlier in the day, for example.

Again, I appreciate the discussion @snipe! I'm glad to hear the feedback is useful for you!

[snipe]

Okay, so I think we're all aligned on on the RBAC and least privilege.

I think there is value in the students being able to see the dashboard, specifically the action log, to that they can observe what changes have been made recently

That's actually really interesting and something I hadn't really thought about.

In the way you imagine this working, is there is a significant difference between (other that scope) what your students would see on their dashboard?

[prboyer]

In the way you imagine this working, is there is a significant difference between (other that scope) what your students would see on their dashboard?

We don't leverage the Full Company Support feature in our instance, so we wouldn't need to be any scoping done at that level as it relates to what students could / couldn't see on the dashboard.

I would imagine it working such that if we denied the View delegation for an object class like Accessories then they wouldn't see anything related to Accessories that on the dashboard. However, I'm not sure if that's the best way to implement the permission, or if it needs to be something more like the CSV Import delegation.

Does that answer your question? Happy to provide more thoughts if not.