Manage Global Roles

Default global roles are predefined in the JFrog Platform. From Artifactory version 7.77, custom global roles can also be created by the Platform Admin.

For all global roles, Platform Admins can change the default environment and modify the actions set for each role. The project roles are inherited from the global roles and can be edited by the Project Admin at the Project level.

Configure Environments and Actions for Global Roles

To access global roles, select the Administration module on the taskbar, and then select User Management > Global Roles.

A list of Global roles is displayed, split into two tabs: DevSecOps and ML. enabling you to see which actions are enabled for each predefined role.

The Platform Admin has the option to enable or disable the actions and the environments associated with each of the predefined global roles. See Modify Global Roles.

Predefined Global Roles:

From Artifactory version 7.77, Platform admins can also define and edit environments and actions for customized global roles.

To access global roles, select the ​Administration​ module on the taskbar, and then select ​User Management > Global Roles​​.

A list of Global roles is displayed, enabling you to see which actions are enabled for each predefined role. Platform administrators can modify the actions assigned to each role by selecting the edit icon located on the far right of each table row, as shown below.

Custom Global Roles

Custom global roles are high-level roles that can be created at the global level and can be applied to all projects. Global roles allow project members assigned with the role to perform a set of actions on all of the projects. The Platform admin defines the scope of the role by enabling the actions supported for each role and sets the environments - DEV (Development) or PROD (Production) in which the global role will apply.

Create Custom Global Roles

Creation of custom global roles has the following limitations:

• Only available from Artifactory release 7.77.
• Platform Administrator permissions required.
• A maximum of 30 custom global roles may be created.

To create a custom global role:

1. From the Projects list, select All.

2. Select the Administration module and navigate to User Management > Global Roles.

3. Click Create Global Role and configure the role settings:

   1. Enter a unique global role name.

   2. Assign one or more environments to the role by selecting from the Global Environments list.

      

   3. Set the basic or advanced role actions to assign to the role:

      • The Basic tab simplifies administration by bundling granular actions and resource types into logical categories. It allows you to grant broad functional capabilities without managing dozens of individual permissions. Use this view for standard roles where speed and ease of setup are the priorities.

      • The Advanced unbundles the categories defined in the Basic tab, providing direct control over every resource type and action. This allows you to create highly specific roles - such as allowing a user to “read” artifacts but not builds. Use this view to implement a strict “Least Privilege” model for specialized technical roles.

      📘

      Note

      Any actions settings made in the Advanced tab are removed if you move back from Advanced to Basic mode.

      For both Basic and Advanced, the DevSecOps actions are shown first and you can scroll down to the ML actions.

      See Global Role Actions for a full list of available actions.

4. Click Create to save.

Example Global Role

This example displays a global role with advanced actions, including Read and Annotate on Repositories, Builds, and Release Bundles, and the Trigger action on Pipelines.

Modify Global Roles

Platform administrators can modify the actions assigned to each role by selecting the edit icon located on the far right of each table row, as shown below.

Global Role Actions

The tables below describe all the actions that can be assigned to both custom global roles and JFrog's predefined global roles.

Basic Actions

This section lists the basic action permissions available for devsecops and ML resources.

DevSecOps | ML

DevSecOps

ML*

The global roles contain a set of actions that can be performed on resources within the projects including CRUD actions and product-specific actions.

*To separate permissions for Create and Delete (managed jointly in Basic mode under “Manage” permission), switch to Advanced Mode.

Advanced Actions

To gain an additional level of granularity on the resource level, you can assign advanced settings to the repository and build resources.

DevSecOps | ML

DevSecOps

ML*

• See Role-based Access Control in JFrog ML for more details.

Update a Global or Project Role

The Platform Admin has the option to enable, disable, or update the actions and the environments associated with global roles. From Artifactory version 7.77, Platform Admins can also define and edit environments and actions for custom global roles. Project Admins can create, edit and delete project roles.

Select Administration in the taskbar, go to User Management and select the type of role to edit, Global Role or Role.

The following example demonstrates how you can update a global role.