Global System Admin / Super Admin

[Chris2Brooks]

Hi all,

I’m designing a SAAS build that will use a Directus project for each client. So all data etc is separate from different clients. Projects will be private and they’ll each have a url to log into.

My concern however is around Users. Each client should have an admin role that can add and remove their own sub-users as they please, but I also need roles added to each client for my staff. So they can log into each client project, help out with data without any of clients or their staff able to delete us.

Is there a role like this, will permissions be able to help me set roles like that?

If Directus had “back door users” that the clients couldn’t see, I could also add and remove staff as I please and they can manage any client project.

Any ideas, suggestion, clarity will be very much welcome.

[Chris2Brooks]

Okay, I read more about Roles in docs and from what I gather, the first user created in a project is the system user and cannot be deleted.

Administrators
Users within this role have full access to all data within the system and are the only ones with access to Project Settings. This system role is automatically included during installation and can not be removed.

For reference: https://docs.directus.io/guides/roles.html#administrators

That basically solves my worries, because I can create a global system user that can creates all projects and therefore can’t be deleted by other administrators.

Is my understanding of this correct?

[benhaynes]

Looks right to me! The API should block you from deleting the LAST admin... I don't think it matters if it's the first or not.

[Chris2Brooks]

Does that mean another Admin can delete me from the project, if they remain the last admin? I’m just concerned that clients will lock us out of projects. And permission alone will be difficult, because I need clients to manage their own users.

…

On Sun, 21 Jun 2020 at 21:32, Ben Haynes ***@***.***> wrote: Looks right to me! The API should block you from deleting the LAST admin... I don't think it matters if it's the first or not. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2759 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AARP4NNQ2TKVX5R5Y7HBKP3RXZN6BANCNFSM4ODBIVMA> .

[benhaynes]

That sounds about right. Admins (by definition) are full access to do anything... there's no difference between the first admin and subsequent ones. If you need to limit access in any way, that would need to be done with a new Role.