Skip to content

Managing Organization and User Visibility#

For customers who want to enforce isolation between projects and teams, the BSR allows you to limit the visiblity of organization and users.

Enabling Organization and User Visibility#

These features are off by default. Pro and Enterprise users should contact their Buf representative or Support to enable it. On-prem deployments can enable user and organization visibility by setting the feature flags specified in the feature flag documentation.

Organization Visibility#

Just as it is sometimes useful to have a private module, customers who have their own BSR instance (Pro, Enterprise, and on-prem), might want to limit access to some organizations. Any plugins, modules, or policies in a private organization are only visible to users who are members of that organization. Attempts to access private organizations or the resources in them return a 404 Not Found.

Defaults can be set at two levels: instance-wide (by an instance administrator) and per-organization (by the organization’s Owner or Admin). At the instance level, a Strict toggle controls whether organization admins can override the default.

Default Organization Visibility#

Access required: instance administrator.

  1. Sign in to the BSR.
  2. Navigate to Admin > Settings > Resource visibility, or open https://your-bsr-instance.example.com/admin/resource-visibility.
  3. In the section labeled Organization visibility, specify the default visibility. Public makes organizations visible by default to all users on the instance; Private restricts organizations to members of the organization.
  4. Toggle Strict to control whether organization owners and admins can override this default. With Strict on, only instance admins can change an organization’s visibility. With Strict off, organization owners apply their visibility settings and the instance default is used by default when creating new organizations.
  5. Click Update.

Per-Organization Visibility#

If strict visibility has not been set at the instance level, you can specify visibility when creating or updating a new organization.

Creation#

Access required: organization Owner or Admin.

  1. Sign in to the BSR.
  2. Open your organizations page at https://your-bsr-instance.example.com/your-user-name/organizations.
  3. Click Create organization
  4. In the section labeled Visibility, you can choose whether to make the new organization public or private. The radio button defaults to the instance-wide setting.
  5. After providing an organization name and role, click *Create. Your new organization will be assigned the selected visibility.

Updating#

Access required: organization Owner or Admin.

  1. Sign in to the BSR.
  2. Open the organization’s settings page at https://your-bsr-instance.example.com/your-organization/settings/general.
  3. Scroll to Visibility.
  4. To toggle an organization from public to private or private to public, click the button in this section.

Notes#

  • IdP groups that are imported as organizations are automatically assigned the default visibility for the instance.
  • A public module or plugin in a private organization is effectively private.
  • Any attempt to access a private organization or a resource by a user who does not have permission to access the resource returns a “not found” error.
  • Changing the default visibility for organizations does not affect any existing organizations.
  • Instance administrators can specify the visibility for an organization whether or not the strict flag is set.

User Visibility#

By default, any BSR user can search for any other BSR user. Any BSR user can also access the list of public organizations associated with another BSR user. For greater privacy, you can limit user visibility to users who share an organization. When user visibility is limited, all users who do not share an organization with the current user are not accessible. Search results will not include them and the BSR returns a 404 Not Found if the current user attempts to view their list of public organizations.

Managing User Visibility#

Access required: instance administrator.

  1. Sign in to the BSR.
  2. Navigate to Admin > Settings > Resource visibility, or open https://your-bsr-instance.example.com/admin/resource-visibility.
  3. In the section labeled User visibility, specify user visibility. Enable the switch labeled Restrict user visibility to shared organizations to limit user visibility. Disable the switch to make all users public.
  4. Click Update.