In %13.7 we'll be adding an export button to the admin area to enable self-managed customers to export a list of all users and their respective group, subgroup, and project memberships. This fulfills an important audit reporting need for compliance-minded customers, but this functionality does not yet exist at the group level to support SaaS customers.
@aregnery not at all, this looks like a useful addition to the members list tables. Can this be done across all membership tables? eg: Groups / Projects ?
@aregnery@mattgonzales I'd like to point out that I think the simplification project will be much farther away, and if adding a simple export button can offer value for compliance, then please feel free to add it. 👍 We had no specific plans in ~"group::access" for exporting data sets in these screen iirc.
Agreed. I would treat this as a backend job. Whoever implements it can get input from frontend if neccessary, but I don't think it requires a frontend DRI.
Ok, as it stands right now this sits somewhere between 3️⃣ and 5️⃣ for weight, and due to unknowns probably toward the top of that spectrum.
The existing instance-level functionality is quite simple in terms of the database query. We simply get every active user, shove it in a CSV and allow the user to download it.
My main concern is once we join the members table and allow, potentially, many tens of thousands of users to be downloaded at once without the pagnation in the web UI, this could present database challenges.
I suspect with some clever uses of indexes, this is avoidable, but it's a definite unknown right now.
@stkerr One other question, because unlike the instance-level table, the group-level table includes a filter, do we want the downloaded CSV to match the currently active filters, or not? This would add additional complexity.
@mwoolf I'd like to have a bit of a sense of how much additional complexity that is, relative to the 3️⃣ / 5️⃣. As a user, I'd expect that if I applied filters that the export button would respect them. If its hard though, we could consider changing the button to something like Export Full List as CSV to correctly set expectations, but I'd say thats a worse user experience.
As a user, I'd expect that if I applied filters that the export button would respect them.
Entirely agree. After further consideration, I think we can aim for this with a weight of 3️⃣ on the condition that if the database considerations become more difficult than expected during development then we fall back to a "Export full list" solution initially and iterate to a more complete solution in a future iteration.
Ok, I'm going to remove the frontend and UX labels. I think the backend team can handle this, largely, alone. I've added an implementation plan and a weight.
Why interested: Regular audits (every quarter) dictate that they are required to export a list of users, and their memberships, together with their permission levels and last accessed information
Current solution for this problem: Using APIs
Impact to the customer of not having this: A lot of time spent manually creating reports by hand
Questions: When do we think this might be worked on?
Why interested: Compliance and auditing team require the ability to audit their users, all the groups, all the sub-groups, and all the projects they're members of, and the roles assigned to them in each group, sub-group, and project.
Current solution: Seat usage but not practical when there's 100's or 1000's of users, and potentially via API but thats just another external script they need to maintain.
Impact to customer: Large amount of manual effort and a lot of time spent.
@aregnery When you get time (it's not super urgent), could you help me devise some copy for the emails that is sent out with the CSV attachment please? 🙇
Worst case we'll have to push the release post to %14.3. I'll do my best to avoid that but it all comes down to how quickly the production incident is resolved I'm afraid 😞
@mwoolf@stkerr question about this CSV export option - With this feature, is it be possible for a Self-Managed customer to export the list of users within each different tab, for example "Users With No Projects Assigned"? How would the tabs display on the CSV; different sheet, maybe?