Restrict admins to repos in projects, not all repos

[juliab]

Hello, 

I am wondering if there is a way to create admin groups that only have admin access within all repos in a specific project. 

Example: Let's say I have Project A and Project B.

Project A has Group A, which is granted the admin repo access by default when new repos are created. 

As it is now, this allows Group A admin privileges on new repos in Project B too, not just Project A. 

Is there a way to restrict a group to a single Project? Making the repo private does not assist in this. 

Thanks in advance,
Julia

[Theodora Boudale · Accepted solution]

Hi Julia,

I'm afraid that it is not possible to manage permissions on a project level at the moment. We have a feature request about this in our issue tracker: https://jira.atlassian.com/browse/BCLOUD-13202 and updates will get posted there regarding the status.

In the meantime, I can suggest the following as a workaround:

• Create the two admin groups, Group A and Group B
• Change the default access of these groups from Admin to None. You can do so by opening the User Group in Bitbucket UI > select Edit from the top right corner and then change Default repository access to None
• Then, you can manually add the appropriate group to each of the repos with Admin access, from each repo's Repository settings > User and group access

I understand that this creates a bit more work, since the groups will need to be manually added to the repos, but it's the only way to prevent the groups from gaining automatically admin access to all repos.

Please note the following:

If these groups also have permissions to Administer workspace (you can find this setting in the same dialog as Default repository access), even though they won't be able to view any repos they haven't been added to, they can still gain access to the repo if they know its url, by navigating to https://bitbucket.org/<workspace-id>/<repo-slug>/admin/access and restoring their own access.

This is because they are workspace admins.

However, if they don't have permissions to Administer the workspace, this is not an issue.

Finally, I would suggest that you add yourself as a watcher in the public feature request I gave you (by selecting the Start watching this issue link in that ticket), if you'd like to get notified via email on updates regarding project permissions.

If you have any questions, please feel free to let me know.

Kind regards,
Theodora

[juliab]

Thank you Theodora, for your very thorough reply.