Permissions

Permissions

• Understanding permission structure
• Existing permissions
• Configure permissions

Kimai 2 provides a flexible permissions system, which is based on user roles and can be adapted through your local.yaml config file.

Understanding permission structure

Before you learn to configure the permission system, you have to understand the three involved config types:

1. Permission sets define a re-usable name for a list of “permission names”
2. Permission maps will apply a list of “permission sets” to a “user role”
3. Permissions apply a list of “permission names” to a “user role”

An example and its explanation:

    permissions:
        sets:
            ACTIVITY: [view_activity,create_activity]
            TIMESHEET: [view_own_timesheet,start_own_timesheet]
        maps:
            ROLE_USER: [TIMESHEET]
            ROLE_ADMIN: [TIMESHEET,ACTIVITY]
        roles:
            ROLE_USER: [my_profile]
            ROLE_ADMIN: [my_profile,start_other_timesheet]

In sets we define the two permissions sets names “ACTIVITY” and “TIMESHEET”. In maps we apply the permissions set
called “TIMESHEET” to the user-role “ROLE_USER” and the two permissions set called “TIMESHEET” and “ACTIVITY” to the user-role “ROLE_ADMIN”.

At this step the roles have the following permissions:

• ROLE_USER - view_own_timesheet, start_own_timesheet
• ROLE_ADMIN - view_own_timesheet, start_own_timesheet, view_activity, create_activity

As last step, the list of permission names will be added to the list of calculated permissions. So we add the permission “my_profile” to the user-role “ROLE_USER” and the two permissions “my_profile” and “start_other_timesheet” to the user-role “ROLE_ADMIN”.

At the end the system calculated the final list of permissions:

• ROLE_USER - view_own_timesheet, start_own_timesheet, my_profile
• ROLE_ADMIN - view_own_timesheet, start_own_timesheet, view_activity, create_activity, my_profile, start_other_timesheet

Existing permissions

The permission-names were chosen to be self-explanatory. In the hope that it worked, here is the full list of existing permissions:

Configure permissions

Knowing that many companies need a different combination of allowed permissions than the default ones, you might also want to change the pre-configured permission.

You can do that in your local.yaml. Define the permissions like we did in the above mentioned example, you might start by copying the default permissions from kimai.yaml.

Be aware: if you configure your own permission definition, you have to overwrite the complete node (sets, maps orroles) that you edited and define all SETS and/or ROLES.