Roles and permissions

Usage of the Management System is restricted by role-based access control (RBAC), meaning that users in the Management System are assigned roles. These roles are assigned a set of UI permissions and API permissions. Three user roles — Admin, User and Data Services Admin — are available by default. Multiple roles can be assigned to one user. A user that is assigned multiple roles is granted the combined permissions of each role. Select Roles in the navigation on the left to reach a list of all available roles:

The Admin role has all permissions assigned and cannot be edited. The User role has limited permissions. A user that has the User role assigned is not allowed to perform changes to the system such as adding or removing nodes, creating workloads or establishing remote connections among others. Users with the User role can work with the node tree and deploy workloads to nodes.

UI permissions

UI permissions reflect the permissions of the frontend. They are relevant for a users interaction with the Management System. Below is the list of available UI permissions with descriptions.
As some actions depend on other actions, the system automatically selects and deselects permissions, including API permissions that are required for these actions.
When creating a new role for a regular user that will operate the Management System, use the UI permissions as a starting point and change API permissions only if necessary. However, note that changes to API permissions should only be done by users with expert knowledge.

The tables below are separated by the part of the Management System the permissions affect.

Workload deployment

Labels

LDAP

Navigation menu

Nodes

Node tree

System notifications

Remote connections

Roles

Server log

Usage reports

User menu

Management System update

Workload management

API permissions

API permissions reflect the permissions of the server backend. They are primarily relevant for automating the Management System through API calls. When creating a role in the Management System for a program, they can be selected without selecting UI permissions beforehand. When creating a new role for a regular user that will operate the Management System, use the UI permissions as a starting point and change API permissions only if necessary. Note that API permissions should only be handled by persons with expert knowledge.

Adding a new role

When adding a new role, it depends whether the role is going to be created for regular users or programs. When creating a new role for a regular user that will operate the Management System, use the UI permissions as a starting point and change API permissions only if necessary. When creating a role for a program, API permissions can be selected without selecting UI permissions beforehand. Note that API permissions should only be handled by persons with expert knowledge.

Selecting one permission might automatically select other permissions, which are needed to perform the task indicated by the selected permission. An example: if a user is permitted to deploy a workload, then the same user is also permitted to view the list of workloads. Associated API permissions will also be selected. Note that deselecting a permission might also deselect linked permissions.

1. Select Roles in the navigation on the left.

2. Click the plus symbol (Add new role) in the upper-right corner.

   

3. Enter a Name and a Description at the top.

4. Select the UI PERMISSIONS tab.

5. Tick the checkboxes next to the desired permissions.

   

6. Select the API PERMISSIONS tab.

7. Tick or untick the permissions that need to be changed.

   

   Note

   Make sure to review the selected permissions for completeness before saving the role. The system automatically selects and deselects permissions that are linked and might have added or removed desired permissions when permissions where selected or deselected.

8. Click Save.

Editing a role

Note that editing the permissions of a role changes the permissions for users who are already assigned this role. Also, note that editing of roles coming from LDAP synchronization is limited. The name and description of a role cannot be edited. Permissions, however, can be edited.

1. Select Roles in the navigation on the left.

2. Select a role from the list.

   

3. Edit Name and Description at the top.

4. Select the UI PERMISSIONS tab.

5. Tick or untick the permissions that need to be changed.

   

6. Select the API PERMISSIONS tab.

7. Tick or untick the permissions that need to be changed.

   

   Note

   Make sure to review the selected permissions for completeness before saving the role. The system automatically selects and deselects permissions that are linked and might have added or removed desired permissions when permissions where selected or deselected.

8. Click Save.

Deleting a role

Note that a role cannot be deleted if it is assigned to a user. Also, note that roles coming from LDAP synchronization cannot be deleted.

1. Select Roles in the navigation on the left.
2. Choose a role from the list.
3. Click the ellipsis menu next to the role.

4. Select DELETE in the overlay that appeared.

   

5. Select OK to delete the role.

Assigning a role to a user

Assigning a role is done in the users menu. Users can be assigned multiple roles. A user that is assigned multiple roles is granted the combined permissions of each role.

1. Select Users in the navigation on the left.

2. Select a user from the list.

   

3. Click the field under Role to open a drop-down menu.

4. Tick one or more roles that will be assigned to this user. Note that at least one role must be selected.

   

5. Select Update in the lower-right.