Redmine

I'll second that.
In addition to the examples provided by Holger, I would like to see a "user manager" role that would allow a user (IT staff) to create new users and assign them to groups. The rationale is that offloading some "grunt work" without giving my IT staff access to all projects, since some of them contain confidential information.

I agree that it would be a real improvement.

For the "create project" example, we could distinguish "create project" and "create subproject" permissions.
The first one would let the user create a root project, the second permission would only allow creation of subprojects inside his projects.

+1 see also #6670

+1 see also #6800 (same feature, different solution proposal)

+1 a special role for user management would be great

+1 as a new user it was the first "flaw" I noticed. I had to create a fake project so that I could give permission to create projects without giving Admin powers (which shouldn't be treated lightly). I'm sure there are other powers that could be useful to hand to a non admin user.

+1. I also think that some "global" permissions (such as "create project") have to be assigned (by admin) per user, not per projects.

Also the way "create projects" is currently granted (as a per project permission) has a security problem: any who has permission to specify members in any of the projects, can grant "create project" to himself or to anybody else.

+1

I think it is necessary to have system level roles for creating and editing custom queries shared between projects.

Currently, only admin can create / edit this, and the actual project manager can not complete the work.

As a result, the following problem arises.

1. Admin privilege will be added only for creating / editing shared queries,
It is an obstacle to managing accounts with "least privilege principle".

2. Increase in the load of admin, decrease in business operation speed.

I suggest adding the following role to set at the system level.

1. Permission to create shared custom queries that are valid for the entire system (assuming role-based permission management)
add_system_shared_rolebased_queries

2. Authorization to edit system-level custom queries you created (role-based permission management)
edit_system_shared_created_rolebased_queries

I think that admin is the only authority to create and edit custom queries available for all users and all projects.

I summarized previous proposal so far.

Please fill in any additional suggestions.

create projects as a non-admin user # description,note-6
This is allowed, if a user has that right in at least one project (checked by performing a global permission check).
If she has that permission she can create projects anywhere in the project tree (at least if I understood the feature correctly).

creation of trackers and issue states and its management (workflows et al.), or the creation of custom field # description

"user manager" role that would allow a user (IT staff) to create new users and assign them to groups. #note-1,note-5

I agree that it would be a real improvement. #note-2 Jean-Philippe Lang

creating and editing custom queries shared between projects. #note-8