MM-69100 - Add team membership ABAC documentation and update channel ABAC pages for team support - #9105
MM-69100 - Add team membership ABAC documentation and update channel ABAC pages for team support#9105pvev wants to merge 4 commits into
Conversation
…ABAC pages for team support
|
Newest code from mattermost has been published to preview environment for Git SHA 75b10e9 |
|
@coderabbitai full review |
✅ Action performedFull review finished. |
|
Newest code from mattermost has been published to preview environment for Git SHA 20fe15f |
📝 WalkthroughWalkthroughThe administration guide documents team membership ABAC, separates it from channel membership policies, and updates system-wide policy assignment, enforcement, administration workflows, synchronization, troubleshooting, and policy deletion guidance. ChangesABAC administration guidance
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@source/administration-guide/manage/admin/abac-system-wide-policies.rst`:
- Around line 118-125: Update the team-assignment procedure around the
Membership Policy section to state that administrators must first enable “Manage
membership with attribute based membership policies” for the team, and that
group-synced teams cannot use this control. Describe the required setting
sequence before instructing them to link an existing policy, or link directly to
the complete procedure in the team membership access policies documentation.
In `@source/administration-guide/manage/admin/abac-team-membership.rst`:
- Around line 124-129: Update the “Join gate (private teams)” and “Browse Teams
filter” cells in the ABAC-disabled row to describe standard private-team
behavior: joining remains invite-only, and visibility remains restricted to
members. Do not imply that disabling ABAC makes private teams open or visible to
everyone.
- Around line 25-27: The documentation’s universal claims about the Access tab
omit the exception for LDAP/AD group-synced teams. Update the important notice
and the related statements around the Public Team and Private Team cards to
limit them to non-group-synced teams or explicitly state that group-synced teams
display the static message described near the group-sync guidance.
- Line 434: Update the synchronization timing references in the admin guide,
including the team and channel membership scheduler descriptions, to use
AccessControlSettings.SyncJobIntervalSeconds and state a maximum wait of 60
minutes. Replace the outdated 30-minute references while preserving the
documented 3600-second default and shared scheduling behavior.
In `@source/administration-guide/manage/admin/attribute-based-access-control.rst`:
- Line 19: Update the authorization claim in the paragraph to accurately reflect
strict enforcement: replace the statement that only authorized users can access
Mattermost channels and teams with wording that strict policies can manage
access, or explicitly scope the claim to private channels and teams. Preserve
the surrounding explanation about security, compliance, and manual role
adjustments.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 44109363-c136-4816-9d51-52f4af12ccc4
📒 Files selected for processing (4)
source/administration-guide/manage/admin/abac-system-wide-policies.rstsource/administration-guide/manage/admin/abac-team-channel-policies.rstsource/administration-guide/manage/admin/abac-team-membership.rstsource/administration-guide/manage/admin/attribute-based-access-control.rst
|
Newest code from mattermost has been published to preview environment for Git SHA 9b20a4e |
Thank you! |
|
Thanks for the thorough updates, @pvev! One small consistency point: the Channel Membership page says scheduled sync runs every 30 minutes, while the Team Membership page says the default is 60 minutes. Could we align those values? Otherwise, this looks good to approve to me from an Editor perspective. Is there a dev you can tag for the dev review on this as well? |
amyblais
added
1: Dev Review
|
Newest code from mattermost has been published to preview environment for Git SHA b64cbaa |
Good catch, thanks @Combs7th . Both schedulers are built from the same interval, so they've never actually differed. It used to be a hardcoded hour and is now configurable via AccessControlSettings.SyncJobIntervalSeconds (default 3600s). The "30 minutes" figure didn't match the old behaviour either, so I updated abac-channel-access-rules.rst and abac-team-channel-policies.rst to say 60 minutes and name the setting. All four ABAC pages are consistent now. |
davidkrauser
left a comment
davidkrauser
left a comment
There was a problem hiding this comment.
Looks good to me - thanks for keeping these up to date.
| - **Permission policies** (managed by System Admins): Attribute-based restrictions on user actions such as file upload and file download. See :ref:`Permission policies <administration-guide/manage/admin/abac-system-wide-policies:permission policies>`. | ||
| - **Team-scoped membership policies** (managed by Team Admins): Channel membership policies that Team Admins can create, edit, and delete directly from Team Settings for channels in their team. See :ref:`Manage team-scoped membership policies in Team Settings <administration-guide/manage/admin/abac-channel-access-rules:manage team-scoped membership policies in team settings>`. | ||
| - **Team membership policies** (managed by System Admins and Team Admins): Attribute-based rules that control who can join a team. On private teams, rules gate directory visibility, join evaluation, and removal at sync (strict mode). On public teams, rules drive a "Recommended" tag and optional auto-add without restricting access (advisory mode). See :doc:`Team membership access policies </administration-guide/manage/admin/abac-team-membership>`. | ||
| - **Team-scoped channel membership policies** (managed by Team Admins): Channel membership policies that Team Admins can create, edit, and delete directly from the Channel Membership tab in Team Settings for channels in their team. See :doc:`Team-level channel membership policies </administration-guide/manage/admin/abac-team-channel-policies>`. |
There was a problem hiding this comment.
Team-scoped channel membership policies - lol, that's a mouthful.
amyblais
added
3: Reviews Complete
|
Newest code from mattermost has been published to preview environment for Git SHA b64cbaa |
4 participants
…
Summary
Documents the Team Membership ABAC feature (PR #37054 / MM-69100) and updates the existing ABAC docs to reflect that policies can now be assigned to teams, not just channels.
What's included
New page —
abac-team-membership.rst:allow_open_inviteEnableAttributeBasedAccessControl/TeamMembershipAccessControlare off)footer, Membership sync jobs Teams tab
test matching users, save confirmation, self-exclusion block, sync footer
admin flow, Team Members modal, removal/auto-add DMs
exclusivity
Access tab UI change (all deployments): Prominently documents that the "Allow any
user to join" checkbox is permanently replaced by Public/Private selection cards on
every team, regardless of ABAC or license. The cards control the single
allow_open_invitefield (same field the checkbox did);typeis intentionally leftuntouched.
Updated pages:
attribute-based-access-control.rst— toctree entry, team policy type, deduped roleslists
abac-system-wide-policies.rst— "Assign policies to teams" section; delete nowrequires 0 channels and 0 teams
abac-team-channel-policies.rst— "Membership Policies" tab renamed to "ChannelMembership"; disambiguation note vs. the new Team Membership tab
Ticket Link
https://mattermost.atlassian.net/browse/MM-69100