web-ui: Email Alerts Configuration - scope of Email IDs displayed needs to be restricted within organization.

[ss5829]

Following is the design of the current system, 2025.02

Organization -> Project (it is created within Organization) -> Username (the user is assigned 5 default groups from the Project)

company001 -> company001-project01 -> company001-support
company002 -> company002-project02 -> company002-support

Also ensure that both these users are a part of "service-admin-group".

1. Login using company002-support credentials.
2. Now navigate to "Settings" -> "Alerts" -> click on "Email Alerts" button

it can be noticed that Email IDs of users across all organizations are displayed.
This can be considered as a security concern. where company001's organization email ids are displayed to the user company002-support.

Please comment on the expected behavior.

[jgespino]

@ss5829 Service-Admin-Group provides full access to all projects on the orchestrator, so it shouldn’t be assigned to users within an individual org. Instead, users should only be granted access at the specific level. You can find more details about this in the Using Alerts API section of the Multitenancy documentation. I’ll follow up with the team to confirm the correct process for enabling or disabling user notifications per project/org and will get back to you with the guidance.

[jgespino]

@ss5829 At this time, only an Orchestrator‑level administrator can configure alert email notifications in a multi‑tenant environment. This requires access through the service‑admin‑group or the alrt‑rx‑rw realm role, and that administrator is responsible for the setup and ongoing management.

[ss5829]

@jgespino, please clarify if the below understanding is correct

the user with admin privileges("service-admin-group") has visibility of all the organizations.
hence it is safe to say that other organization user's email ids are visible.

note: the support users being admin need to be cautious about this provision.

[jgespino]

@ss5829 That is correct, service-admin-group has visibility to all the organizations.