{"action":"created","comment":{"url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/comments/75043904","id":75043904,"diff_hunk":"@@ -9,6 +9,68 @@ Work, and it gives us time to finish testing the payments system.\n \n ## Sandstorm for Work in depth\n \n+### Defining an organization, and its impact on permissions\n+\n+Many features of Sandstorm for Work depend on a server administrator specifying the group of users that will\n+be working together using Sandstorm. We call this **organization management.** You can enable and disable\n+organization-related features via the `/admin/organization` settings area.\n+\n+To apply settings to all users within an organization, you must configure at least one login provider so\n+that it knows which people are part of the organization. Users within the organization will automatically\n+be able to log in, install apps, and create grains. \n+\n+To enable this feature:\n+\n+- Log in to your server as an administrator.\n+\n+- Click your name at the top right, then **Admin panel**; this should take you to `/admin`.\n+\n+- Under the \"Configuration\" header, click \"Organization settings\"\n+\n+- Enable and configure your organization membership on a per-login-provider basis.\n+\n+Login providers have different settings that are used to define your organization. A user is\n+considered a member of your organization if the settings for **at least one** login provider\n+declare the user to be a member. You can enable/disable this on a per-login-provider basis.\n+\n+- **Google authentication.** All users who use a particular Google Apps domain of your choosing can\n+  receive user status in Sandstorm. When you enable the use of Google Apps to define the boundary\n+  of your organization, you must specify which Google Apps domain represents your organization.\n+\n+- **LDAP authentication.** All users who log in via LDAP can automatically receive user status in\n+  Sandstorm. When you use LDAP to define the boundary of your organization, all users who log in via\n+  LDAP are considered members of the organization.\n+\n+- **SAML authentication.** All users who log in via LDAP can automatically receive user status in\n+  Sandstorm. When you use SAML to define the boundary of your organization, all users who log in via\n+  SAML are considered members of the organization.\n+\n+- **Passwordless email login.** All users who use a particular email address domain name\n+  (e.g. @example.com) can receive user status in Sandstorm. To enable this, you must specify which\n+  Internet domain name represents your organization.\n+\n+This feature is important because, by default, when a user signs into a Sandstorm server for the\n+first time, Sandstorm creates a _Visitor_ account for them. Visitors can use grains that have been\n+shared with them but cannot create grains of their own.\n+\n+### Additional organization settings\n+\n+Once you have defined your organization, you can optionally configure system-wide rules based on\n+organization membership. This can be done from `/admin/organization` within your Sandstorm server.\n+\n+You can **disallow collaboration with users outside the organization.** If you enable this option,\n+grains can only be seen by users logged-in as a member of your organization. This means:\n+\n+- Unauthenticated (aka anonymous) users cannot view grains, even if they have a sharing link.\n+\n+- Visitors (logged-in users who have no special permissions on your server) cannot view grains, even","path":"docs/administering/for-work.md","position":58,"original_position":58,"commit_id":"66c1fc0f432afb123a1adbce9e67289210e7d152","original_commit_id":"a4a6303c4a5d0e329efa6425821d3c50cd139f73","user":{"login":"zarvox","id":307325,"avatar_url":"https://avatars.githubusercontent.com/u/307325?v=3","gravatar_id":"","url":"https://api.github.com/users/zarvox","html_url":"https://github.com/zarvox","followers_url":"https://api.github.com/users/zarvox/followers","following_url":"https://api.github.com/users/zarvox/following{/other_user}","gists_url":"https://api.github.com/users/zarvox/gists{/gist_id}","starred_url":"https://api.github.com/users/zarvox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zarvox/subscriptions","organizations_url":"https://api.github.com/users/zarvox/orgs","repos_url":"https://api.github.com/users/zarvox/repos","events_url":"https://api.github.com/users/zarvox/events{/privacy}","received_events_url":"https://api.github.com/users/zarvox/received_events","type":"User","site_admin":false},"body":":+1:\r\n\r\nConsider filing an issue which, when closed, would make that Security note obsolete.  I'd really rather have the feature just do the thing the user needs rather than have weird caveats that we document.","created_at":"2016-08-17T00:11:13Z","updated_at":"2016-08-17T00:11:13Z","html_url":"https://github.com/sandstorm-io/sandstorm/pull/2395#discussion_r75043904","pull_request_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2395","_links":{"self":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/comments/75043904"},"html":{"href":"https://github.com/sandstorm-io/sandstorm/pull/2395#discussion_r75043904"},"pull_request":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2395"}}},"pull_request":{"url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2395","id":81560098,"html_url":"https://github.com/sandstorm-io/sandstorm/pull/2395","diff_url":"https://github.com/sandstorm-io/sandstorm/pull/2395.diff","patch_url":"https://github.com/sandstorm-io/sandstorm/pull/2395.patch","issue_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/2395","number":2395,"state":"open","locked":false,"title":"docs: Clarify org management features","user":{"login":"paulproteus","id":25457,"avatar_url":"https://avatars.githubusercontent.com/u/25457?v=3","gravatar_id":"","url":"https://api.github.com/users/paulproteus","html_url":"https://github.com/paulproteus","followers_url":"https://api.github.com/users/paulproteus/followers","following_url":"https://api.github.com/users/paulproteus/following{/other_user}","gists_url":"https://api.github.com/users/paulproteus/gists{/gist_id}","starred_url":"https://api.github.com/users/paulproteus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulproteus/subscriptions","organizations_url":"https://api.github.com/users/paulproteus/orgs","repos_url":"https://api.github.com/users/paulproteus/repos","events_url":"https://api.github.com/users/paulproteus/events{/privacy}","received_events_url":"https://api.github.com/users/paulproteus/received_events","type":"User","site_admin":false},"body":"@zarvox I humbly request your +1/-1 on this, since the details are subtle.\r\n\r\nI do think this is a vast improvement over the earlier text, but I want someone to make sure I'm not saying anything misleading or false.","created_at":"2016-08-16T23:08:20Z","updated_at":"2016-08-17T00:11:13Z","closed_at":null,"merged_at":null,"merge_commit_sha":"3a653e1660657f45fe9e57c1d2a62a79cc9e799a","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2395/commits","review_comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2395/comments","review_comment_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/comments{/number}","comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/2395/comments","statuses_url":"https://api.github.com/repos/sandstorm-io/sandstorm/statuses/66c1fc0f432afb123a1adbce9e67289210e7d152","head":{"label":"sandstorm-io:docs-for-work","ref":"docs-for-work","sha":"66c1fc0f432afb123a1adbce9e67289210e7d152","user":{"login":"sandstorm-io","id":7479094,"avatar_url":"https://avatars.githubusercontent.com/u/7479094?v=3","gravatar_id":"","url":"https://api.github.com/users/sandstorm-io","html_url":"https://github.com/sandstorm-io","followers_url":"https://api.github.com/users/sandstorm-io/followers","following_url":"https://api.github.com/users/sandstorm-io/following{/other_user}","gists_url":"https://api.github.com/users/sandstorm-io/gists{/gist_id}","starred_url":"https://api.github.com/users/sandstorm-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sandstorm-io/subscriptions","organizations_url":"https://api.github.com/users/sandstorm-io/orgs","repos_url":"https://api.github.com/users/sandstorm-io/repos","events_url":"https://api.github.com/users/sandstorm-io/events{/privacy}","received_events_url":"https://api.github.com/users/sandstorm-io/received_events","type":"Organization","site_admin":false},"repo":{"id":15728293,"name":"sandstorm","full_name":"sandstorm-io/sandstorm","owner":{"login":"sandstorm-io","id":7479094,"avatar_url":"https://avatars.githubusercontent.com/u/7479094?v=3","gravatar_id":"","url":"https://api.github.com/users/sandstorm-io","html_url":"https://github.com/sandstorm-io","followers_url":"https://api.github.com/users/sandstorm-io/followers","following_url":"https://api.github.com/users/sandstorm-io/following{/other_user}","gists_url":"https://api.github.com/users/sandstorm-io/gists{/gist_id}","starred_url":"https://api.github.com/users/sandstorm-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sandstorm-io/subscriptions","organizations_url":"https://api.github.com/users/sandstorm-io/orgs","repos_url":"https://api.github.com/users/sandstorm-io/repos","events_url":"https://api.github.com/users/sandstorm-io/events{/privacy}","received_events_url":"https://api.github.com/users/sandstorm-io/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/sandstorm-io/sandstorm","description":"Personal Cloud Sandbox","fork":false,"url":"https://api.github.com/repos/sandstorm-io/sandstorm","forks_url":"https://api.github.com/repos/sandstorm-io/sandstorm/forks","keys_url":"https://api.github.com/repos/sandstorm-io/sandstorm/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sandstorm-io/sandstorm/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sandstorm-io/sandstorm/teams","hooks_url":"https://api.github.com/repos/sandstorm-io/sandstorm/hooks","issue_events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/events{/number}","events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/events","assignees_url":"https://api.github.com/repos/sandstorm-io/sandstorm/assignees{/user}","branches_url":"https://api.github.com/repos/sandstorm-io/sandstorm/branches{/branch}","tags_url":"https://api.github.com/repos/sandstorm-io/sandstorm/tags","blobs_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/refs{/sha}","trees_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sandstorm-io/sandstorm/statuses/{sha}","languages_url":"https://api.github.com/repos/sandstorm-io/sandstorm/languages","stargazers_url":"https://api.github.com/repos/sandstorm-io/sandstorm/stargazers","contributors_url":"https://api.github.com/repos/sandstorm-io/sandstorm/contributors","subscribers_url":"https://api.github.com/repos/sandstorm-io/sandstorm/subscribers","subscription_url":"https://api.github.com/repos/sandstorm-io/sandstorm/subscription","commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/commits{/sha}","git_commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/commits{/sha}","comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/comments{/number}","issue_comment_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/comments{/number}","contents_url":"https://api.github.com/repos/sandstorm-io/sandstorm/contents/{+path}","compare_url":"https://api.github.com/repos/sandstorm-io/sandstorm/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sandstorm-io/sandstorm/merges","archive_url":"https://api.github.com/repos/sandstorm-io/sandstorm/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sandstorm-io/sandstorm/downloads","issues_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues{/number}","pulls_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls{/number}","milestones_url":"https://api.github.com/repos/sandstorm-io/sandstorm/milestones{/number}","notifications_url":"https://api.github.com/repos/sandstorm-io/sandstorm/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sandstorm-io/sandstorm/labels{/name}","releases_url":"https://api.github.com/repos/sandstorm-io/sandstorm/releases{/id}","deployments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/deployments","created_at":"2014-01-08T07:10:33Z","updated_at":"2016-08-16T19:05:55Z","pushed_at":"2016-08-16T23:51:47Z","git_url":"git://github.com/sandstorm-io/sandstorm.git","ssh_url":"git@github.com:sandstorm-io/sandstorm.git","clone_url":"https://github.com/sandstorm-io/sandstorm.git","svn_url":"https://github.com/sandstorm-io/sandstorm","homepage":"https://sandstorm.io","size":38989,"stargazers_count":3766,"watchers_count":3766,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":338,"mirror_url":null,"open_issues_count":446,"forks":338,"open_issues":446,"watchers":3766,"default_branch":"master"}},"base":{"label":"sandstorm-io:master","ref":"master","sha":"c140d705f9e1ceec86653a7159bbd3476f9acfdd","user":{"login":"sandstorm-io","id":7479094,"avatar_url":"https://avatars.githubusercontent.com/u/7479094?v=3","gravatar_id":"","url":"https://api.github.com/users/sandstorm-io","html_url":"https://github.com/sandstorm-io","followers_url":"https://api.github.com/users/sandstorm-io/followers","following_url":"https://api.github.com/users/sandstorm-io/following{/other_user}","gists_url":"https://api.github.com/users/sandstorm-io/gists{/gist_id}","starred_url":"https://api.github.com/users/sandstorm-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sandstorm-io/subscriptions","organizations_url":"https://api.github.com/users/sandstorm-io/orgs","repos_url":"https://api.github.com/users/sandstorm-io/repos","events_url":"https://api.github.com/users/sandstorm-io/events{/privacy}","received_events_url":"https://api.github.com/users/sandstorm-io/received_events","type":"Organization","site_admin":false},"repo":{"id":15728293,"name":"sandstorm","full_name":"sandstorm-io/sandstorm","owner":{"login":"sandstorm-io","id":7479094,"avatar_url":"https://avatars.githubusercontent.com/u/7479094?v=3","gravatar_id":"","url":"https://api.github.com/users/sandstorm-io","html_url":"https://github.com/sandstorm-io","followers_url":"https://api.github.com/users/sandstorm-io/followers","following_url":"https://api.github.com/users/sandstorm-io/following{/other_user}","gists_url":"https://api.github.com/users/sandstorm-io/gists{/gist_id}","starred_url":"https://api.github.com/users/sandstorm-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sandstorm-io/subscriptions","organizations_url":"https://api.github.com/users/sandstorm-io/orgs","repos_url":"https://api.github.com/users/sandstorm-io/repos","events_url":"https://api.github.com/users/sandstorm-io/events{/privacy}","received_events_url":"https://api.github.com/users/sandstorm-io/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/sandstorm-io/sandstorm","description":"Personal Cloud Sandbox","fork":false,"url":"https://api.github.com/repos/sandstorm-io/sandstorm","forks_url":"https://api.github.com/repos/sandstorm-io/sandstorm/forks","keys_url":"https://api.github.com/repos/sandstorm-io/sandstorm/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sandstorm-io/sandstorm/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sandstorm-io/sandstorm/teams","hooks_url":"https://api.github.com/repos/sandstorm-io/sandstorm/hooks","issue_events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/events{/number}","events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/events","assignees_url":"https://api.github.com/repos/sandstorm-io/sandstorm/assignees{/user}","branches_url":"https://api.github.com/repos/sandstorm-io/sandstorm/branches{/branch}","tags_url":"https://api.github.com/repos/sandstorm-io/sandstorm/tags","blobs_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/refs{/sha}","trees_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sandstorm-io/sandstorm/statuses/{sha}","languages_url":"https://api.github.com/repos/sandstorm-io/sandstorm/languages","stargazers_url":"https://api.github.com/repos/sandstorm-io/sandstorm/stargazers","contributors_url":"https://api.github.com/repos/sandstorm-io/sandstorm/contributors","subscribers_url":"https://api.github.com/repos/sandstorm-io/sandstorm/subscribers","subscription_url":"https://api.github.com/repos/sandstorm-io/sandstorm/subscription","commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/commits{/sha}","git_commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/commits{/sha}","comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/comments{/number}","issue_comment_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/comments{/number}","contents_url":"https://api.github.com/repos/sandstorm-io/sandstorm/contents/{+path}","compare_url":"https://api.github.com/repos/sandstorm-io/sandstorm/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sandstorm-io/sandstorm/merges","archive_url":"https://api.github.com/repos/sandstorm-io/sandstorm/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sandstorm-io/sandstorm/downloads","issues_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues{/number}","pulls_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls{/number}","milestones_url":"https://api.github.com/repos/sandstorm-io/sandstorm/milestones{/number}","notifications_url":"https://api.github.com/repos/sandstorm-io/sandstorm/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sandstorm-io/sandstorm/labels{/name}","releases_url":"https://api.github.com/repos/sandstorm-io/sandstorm/releases{/id}","deployments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/deployments","created_at":"2014-01-08T07:10:33Z","updated_at":"2016-08-16T19:05:55Z","pushed_at":"2016-08-16T23:51:47Z","git_url":"git://github.com/sandstorm-io/sandstorm.git","ssh_url":"git@github.com:sandstorm-io/sandstorm.git","clone_url":"https://github.com/sandstorm-io/sandstorm.git","svn_url":"https://github.com/sandstorm-io/sandstorm","homepage":"https://sandstorm.io","size":38989,"stargazers_count":3766,"watchers_count":3766,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":338,"mirror_url":null,"open_issues_count":446,"forks":338,"open_issues":446,"watchers":3766,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2395"},"html":{"href":"https://github.com/sandstorm-io/sandstorm/pull/2395"},"issue":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/2395"},"comments":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/2395/comments"},"review_comments":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2395/comments"},"review_comment":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2395/commits"},"statuses":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/statuses/66c1fc0f432afb123a1adbce9e67289210e7d152"}}}}
{"actor":{"display_login":"zarvox"}}