Feature request: granular permissions for users

[Instagit]

As far as I know, right now it's not possible to have a user that is only allowed to create and delete other users, right?

Use case:

I want to create and delete temporary user accounts through an API call. If the user credentials in that API call are somehow intercepted, all other user data should still be secure. Optimally, the group admin would only be allowed to create and delete users, not list users or change their passwords.

Is there a way to do this that I am not aware of? And if not, what would be the best workaround? Thanks for your time. :)

[nextcloud-bot]

GitMate.io thinks possibly related issues are #9182 (Just a question // Feature request // Pretty Share URL), #1575 ([Feature Request] Add configuration for "Sharing URL"), #8066 (Feature Request: User can accept or refuse sharing request), #3985 (feature request: multi tennancy (or is it already possible)), and #10544 (Feature Request: allow image Preview to apply to folders).

[violoncelloCH]

It's already possible to set a user as admin for a specific group. This way he can just manage the users in this group(s), but he doesn't have access to any other admin settings. Is this what you are looking for?

[Instagit]

@violoncelloCH The problem I see is this: If for any reason the group admin credentials leak, they can be used to

1. list all users
2. change their passwords
3. access their files

I'm looking for a way to create and delete users where this is not possible.

Example: Someone misconfigures SSL and the API requests are sent out unencrypted. All previously created accounts and their data should still be safe.

[violoncelloCH]

hmm, I don't think this is possible atm
So you would like to have a group admin user which can only create and delete users but not change anything?

[Instagit]

Yes, exactly. I think it makes sense to have this in an environment where data safety is important.

The Nextcloud API already has a very refined set of actions. It only lacks a way to configure the permissions more precisely.

[szaimen]

cc @nextcloud/server-triage is this feasible?

[ghost]

This issue has been automatically marked as stale because it has not had recent activity and seems to be missing some essential information. It will be closed if no further activity occurs. Thank you for your contributions.

[szaimen]

@Pytal please add applicable labels if you are scheduling this for 23 :)

[Pytal]

@Pytal please add applicable labels if you are scheduling this for 23 :)

Added, @CarlSchwan you may add more if you'd like :)

[szaimen]

Added

Thanks! :)