Access to every Galleon operation, from downloading artifacts to administration, is governed by a single model: users are assigned roles, and roles bundle privileges.
Model
The model is built on three entities:
- Privilege — the right to perform specific actions on an object: a repository or an administrative area.
- Role — a named set of privileges. A role can include other roles; a user with the role gets their privileges as well.
- User — an account with assigned roles.
Built-in roles:
admin— full access to all operations;anonymous— the privileges of this role apply to unauthenticated requests (see Anonymous access).
Privileges
A privilege allows a set of actions on one object: a repository or an administrative area — users, roles, settings, tasks.
Privileges are created automatically: the administrative ones at the first start, the ones for every action on a repository when that repository is created. There are wildcard privileges as well, such as read access in every repository.
The privilege types, their fields, how the names are built, and how to assemble the typical roles are in Privileges of the administration guide.
Actions
Repository privileges operate on five independent actions:
| Action | What it allows |
|---|---|
browse | Seeing the repository and its content in the web interface |
read | Downloading artifacts |
add | Publishing new artifacts |
edit | Modifying already published content |
delete | Deleting artifacts |
Actions are independent: read does not imply browse, and edit does not imply add. There is no “administration implies write implies read” hierarchy — the required set of actions is granted explicitly.
Publishing container images is the exception:
the client asks the registry for read and write access at once,
so docker push needs both actions — read and add.
In the web interface and its API a repository without the browse or read
right looks nonexistent: the server answers with 404.
Anonymous access
Anonymous access (reading without authentication) is a combination of two settings:
- The global anonymous access switch — disabled by default.
- The privileges assigned to the built-in
anonymousrole — they define what exactly is available without authentication.
The privileges of the anonymous role apply only to unauthenticated requests:
an authenticated user gets exactly the privileges of their roles,
even if anonymous access is configured to be broader.
Publishing artifacts always requires authentication, regardless of the anonymous access settings.
Credentials
Two kinds of credentials are used for authentication:
- Password — used to sign in to the web interface; also works for command-line clients.
- User token — a generated pair of values used as the username and password in command-line clients and CI without exposing the account password. Each user can have one active token; it can be revoked and re-issued in the profile.
In the web interface the session persists after signing in; command-line clients pass credentials with every request.
The first administrator account is created automatically on the first start from the server configuration (see Initial setup).