Introduction
Non-admin users are unable to view On-Demand Binary Scan results in the JFrog Platform UI. When navigating to the On-Demand Scanning section, affected users see a message indicating no scans are available, despite scans having been performed by other users on the platform.
Background
By default, only admin users can view all On-Demand Scanning reports. Non-admin users can only see reports generated by themselves; they cannot view scan results created by other users.
Resolution
Option 1: Assign "Read Policies" Permission
To give specific users or groups the ability to read their own On-Demand Binary Scan results, assign the Read Policies permission.
For individual users:
- Navigate to Administration > User Management > Users
- Select the target user
- Under Roles, enable Read Policies
- Save the changes
Similarly, for groups:
Navigate to Administration > User Management > Groups
Select the target group
Under Roles, enable Read Policies
Save the changes
Note:
With Read Policies, Manage Reports, and Manage Watches permissions enabled, non-admin users will still only be able to see scan results that they themselves initiated.
Option 2: Platform Auditor Role (Artifactory 7.125.3+)
Starting with Artifactory v7.125.3, the Platform Auditor role is available as a workaround. This role functions as a read-only administrator; it can access and view all resources (including all On-Demand Scan data generated by any user) but cannot create, update, or delete them.
How to enable:
Enable the accessPlatformAuditor parameter in the system.yaml file. Refer to the official documentation: How to enable the Platform Auditor Role in Artifactory.
Note:
The Platform Auditor role cannot be combined with any other roles. When assigning it to a user, all other roles become greyed out and unavailable, and vice versa.