Roles and permissions

Usage of the Management System is restricted by role-based access control (RBAC), meaning that users in the Management System are assigned roles. These roles are assigned a set of UI permissions and API permissions. Two user roles — Admin and User are available by default. Multiple roles can be assigned to one user. A user that is assigned multiple roles is granted the combined permissions of each role. Select Roles in the navigation on the left to reach a list of all available roles:

A user that has the User role assigned is not allowed to perform changes to the system such as adding or removing nodes, creating workloads or establishing remote connections among others. Users with the User role can work with the node tree and deploy workloads to nodes.

UI permissions

UI permissions reflect the permissions of the frontend. They are relevant for users interaction with the Management System. Below is the list of available UI permissions with descriptions.
As some actions depend on other actions, the system automatically selects and deselects permissions, including API permissions that are required for these actions.

The tables below are separated by the part of the Management System the permissions affect.

Workload deployment

Labels

LDAP

Navigation menu

Nodes

Node tree

System notifications

Remote connections

Roles

Server log

Usage reports

User menu

Management System update

Workload management

API permissions

API permissions reflect the permissions of the server backend and on the onboarded nodes. Primarily relevant for automating the Management System through API calls, API permissions can also be granted to regular users.
When creating a role in the Management System for a program, they can be selected without selecting UI permissions beforehand.
When creating a new role for a regular user that will operate the Management System, use the UI permissions as a starting point and change the Backend API permissions as mandatory. Note that API permissions should only be handled by persons with expert knowledge.

Server Backend API permissions

Backend API permissions are primarily relevant for automating the Management System through API calls.

Nodes access API permissions

These API permissions reflect the access privileges to the Local UI of all Nerve nodes onboarded to the Management System. Nerve Nodes API permissions directly correspond to the Role-Based Access Control (RBAC) permissions defined in Node Permissions and Users.

Additionally these API permissions are available to handle the node local user database

Adding a new role

When adding a new role, it depends whether the role is going to be created for regular users or programs. When creating a new role for a regular user that will operate the Management System, use the UI permissions as a starting point and change API permissions only if necessary. When creating a role for a program, API permissions can be selected without selecting UI permissions beforehand. Note that API permissions should only be handled by persons with expert knowledge.

Selecting one permission might automatically select other permissions, which are needed to perform the task indicated by the selected permission. An example: if a user is permitted to deploy a workload, then the same user is also permitted to view the list of workloads. Associated API permissions will also be selected. Note that deselecting a permission might also deselect linked permissions.

1. Select Roles in the navigation on the left.

2. Click the plus symbol (Add new role) in the upper-right corner.

   

3. Enter a Name and a Description at the top.

4. Select the UI PERMISSIONS tab.

5. Tick the checkboxes next to the desired permissions.

   

6. Select the API PERMISSIONS tab.

7. Tick or untick the permissions that need to be changed.

   

   Note

   Make sure to review the selected permissions for completeness before saving the role. The system automatically selects and deselects permissions that are linked and might have added or removed desired permissions when permissions where selected or deselected.

8. Select Save.

Editing a role

Note that editing the permissions of a role changes the permissions for users who are already assigned this role. Also, note that editing of roles coming from LDAP synchronization is limited. The name and description of a role cannot be edited. Permissions, however, can be edited.

1. Select Roles in the navigation on the left.

2. Select a role from the list.

   

3. Edit Name and Description at the top.

4. Select the UI PERMISSIONS tab.

5. Tick or untick the permissions that need to be changed.

   

6. Select the API PERMISSIONS tab.

7. Tick or untick the permissions that need to be changed.

   

   Note

   Make sure to review the selected permissions for completeness before saving the role. The system automatically selects and deselects permissions that are linked and might have added or removed desired permissions when permissions where selected or deselected.

8. Select Save.

Deleting a role

Note that a role cannot be deleted if it is assigned to a user. Also, note that roles coming from LDAP synchronization cannot be deleted.

1. Select Roles in the navigation on the left.
2. Choose a role from the list.

3. Select the Delete icon in the Action column.

   

4. Select Yes to delete the role.

Assigning a role to a user

Assigning a role is done in the users menu. Users can be assigned multiple roles. A user that is assigned multiple roles is granted the combined permissions of each role.

1. Select Users in the navigation on the left.

2. Select a user from the list.

   

3. Select the field under Role to open a drop-down menu.

4. Tick one or more roles that will be assigned to this user. Note that at least one role must be selected.

   

5. Select Update in the lower-right.

   Note

   For the changes to take effect, sign out of the Management System and sign back in again.