Policy of Policies

Help
1

This will probably be a feature request (and would likely cause things to get even more convoluted :wink: ) but… are there any plans to make Policies group-able, as in: a policy can contain multiple other policies? Basically the same as how roles can contain multiple policies.

Background for my question and use case: we are currently applying policies based on AD groups that a user receives during the SSO login. In a project with very granular permissions and many policies, this would result in a long list of AD groups to be created and managed. Unfortunately we can’t just use roles since a user can only have a single role. So in this case it would be ideal to create policy groups under a new policy name…

Like Beth I am also a bit unclear on the requirements. A role in Directus is a group of policies. Still a single role per user and the role is the supported SSO AD group mapping feature(AUTH_<PROVIDER>_ROLE_MAPPING) so the roles just need to include the appropriate policies. Would be great if you provide the details and workflow that you are attempting to achieve in a feature request as Beth noted :)

 –

1 Answer

1
2

Hey @flipswitchingmonkey, have you looked into whether mapping aggregate/granular groups to a single role in the AD would be a solution here? Multiple policies can belong to a single role or user, is this something you’re using currently? Could you tell us a bit more more about your set up and how you use the AD currently and what method you’d ideally like to have for this use case?

Lastly, if you do want to add this as a feature request at any point, that would now be done via the Directus roadmap submit request function. Thanks!

Hi Beth, sorry I missed your reply. Currently this isn't a workaround for us, users are receiving single permissions through AD group membership, which are mapped 1:1 to policies of the same name within Directus. I suppose the only workaround would be to somehow map to Roles as well... but it would be cool to be able to summarize policies in other policies to. Will create a feature request!

 –