Creating a custom role is largely a process of trial and error. You need to make changes to the filter sets, run the desired command, and note any potential errors from stdout and the Foreman logs and try to piece together the missing permissions required.
Is there a simplified way to discover what permissions are required for a given operation? For example, I’m trying to create a role with the sole purpose of managing host registrations and content view environments. In order even see available environments (subman environments --list) the following permissions are required:
view_lifecycle_environmentsview_content_views
However, I cannot figure out what permissions are necessary to get this to the next step of being able to set the environment(s) to use, e.g. subman environments --set, and continuously get hit with:
Access denied (HTTP error code 403: Forbidden)
So far I’ve tried throwing paint at the wall with various permissions such as hosts, activation keys, facts, subscriptions, repositories, etc but have not uncovered the magic combination to achieve my goal. Even putting Foreman in debug mode provides no insight in the logs as the permission the operation fails on isn’t mentioned.
Foreman: 3.16.0
Katello: 4.18.1
Hopefully the logs provide some more detailed output this time around.