Support to Departments

[lucassmacedo]

Describe the feature you'd like
It would be interesting if the books had support to departments, here in the company that I work I have several departments, like financial, sales, purchases, etc. And with LDAP synchronization it would be interesting to assign a book to the "department"

Describe the benefits this feature would bring to BookStack users
Have exclusive control of the content by department, being able to release the books only for the specific users of that department

[ssddanbrown]

Hi @lucassmacedo, Thanks for your suggestion.

If I'm honest I'm having troubling understanding exactly what you require. Can you explain exactly how you'd see this working in BookStack?

Within BookStack it is currently possible to set custom role permissions on specific Books.
In addition, It is possible to sync LDAP groups with BookStack roles.
Is sounds like those two systems may kind of cover your request?

[lucassmacedo]

Hi @ssddanbrown I'll explain more clearly
In the company we have several departments, where each department has a series of documents, manuals, tutorials etc., specific to each department.
Within each department there are managers, who would be the department's managers.
It would be interesting if the user to enter the system, had access only in the department that he belongs and the level of permission of it. You see?

[excelite]

Hi @ssddanbrown, for me it seems like @lucassmacedo is asking for a group based authentication to different books (feel free to correct me if I'm wrong here).

We are currently thinking about using this neat app for some general documentation stuff in our Formula Student team since it would suite our workflow perfectly, but our business team would like to restrict access to some sections (read: books).

A group access policy would make this nice and easy.

[ssddanbrown]

A group access policy would make this nice and easy.

@excelite I guess the thing I don't understand is how this differs from the current permission system? Since you can already limit the viewing/updating/deleting of a book (or page or chapter) to certain roles.

[lucassmacedo]

Exact @excelite, need to sync with departments, not papers .. Roles is to view / update and delete, but it's all books, my suggestion is books specific to departments (or groups)

[ssddanbrown]

Hi @lucassmacedo ,
I'm still having trouble with this.
Please see the below gif, Let me know if you are aware of these book-level permission in BookStack:

[lucassmacedo]

@ssddanbrown The permission manager is perfect. The only thing I need is that I can organize the books by "department" or "category" and associate the user with a category, so he could have all that level of permission that already exists, but only from "certain" books

[lucassmacedo]

@ssddanbrown
But if this is causing a confusion, I'm sorry. I'm trying to be as clear as I can in the English language.

[ssddanbrown]

@lucassmacedo No worries, Your English is perfectly clear, I just don't understand how the existing system in BookStack differs to what you are asking for, since you are already able to assign permissions for certain books to certain user roles (So you could set a 'Sales History' book to be only visible by a 'Sales Team' role).

[excelite]

@ssddanbrown sry for the late reply but I got to play on this just yesterday.

you were right, this actually does exactly what we (I) were trying to accomplish. What I wasn't able to figure out was that I have to create a Role that is exactly spelled like the LDAP group. then it automatically matches everything just fine! this would be great if you could add that to the LDAP section in the documentation.

actually having the bookshelves now makes it a lot easier for everybody to understand how they are allowed to access stuff and also makes it really easy to organise things in a department way. (each department gets it's own bookshelf and may put their "private" books in there.

I'm starting to really love this project!

From my side, the issue is solved.
@lucassmacedo have a look at 0.24.0, the bookshelves really help a lot to organize things and make it easy for everybody to understand.

[lucassmacedo]

Thanks @excelite !

[CorruptComputer]

Just to be sure before I open a new request, lets say I have multiple groups in AD which I am using to auth with Bookstack: "Docs - IT", "Docs - Finance", "Docs - Marketing", etc...

Can I use those to dynamically assign groups within Bookstack, so that anyone with the AD "Docs - IT" group would have my "IT" Bookstack permissions group?

[ssddanbrown]

Hi @CorruptComputer,
There is currently no dynamic matching for roles/groups, Only exact name matching.

You can however match multiple LDAP groups to a single BookStack role by listing the group CN names in the ‘External Authentication IDs’ input, comma separated.

[CorruptComputer]

Thanks for the heads up @ssddanbrown,

Does that mean it only matches groups with the same name? For example:

AD	Bookstack	Works?
"Docs - IT"	"Docs - IT"	Yes
"Docs - IT"	"IT Docs"	No

The documentation I found here doesn't say anything about multiple groups either. So I'm guessing I would have to do something like this instead? To allow them to logon, but no access to any documentation.

AD	Bookstack
"Docs Access"	"User"

Then add the other permission groups for the department manually for each user?