Configure consolidated User Access roles

The Red Hat Hybrid Cloud Console provides three consolidated User Access roles with ease of use in mind. These roles help simplify how the Organization Administrator creates groups and permissions for various levels of access to the Red Hat Lightspeed services.

The consolidated roles are as follows:

RHEL viewer: The RHEL viewer role provides users visibility without the ability to make changes. It allows read-only access to Red Hat Lightspeed. You can view system configurations, compliance reports, inventory data, patch information, vulnerabilities, and overall resource states and activities. The only action permitted with this role is to generate activation keys.

RHEL operator: The RHEL operator role allows active management of your Red Hat Lightspeed environment. With this role you can edit system configurations, inventory details, policies, and notification/integration settings. The RHEL operator role allows many of the RHEL administrator role functions, but it is restricted from editing compliance policies, content source templates or policies, or tasks. In addition, the RHEL operator role cannot execute remediation plans.

RHEL administrator: The RHEL administrator role provides comprehensive administrative privileges across your RHEL systems and Red Hat Lightspeed. With this role you can manage system configurations, inventory, compliance policies, notifications, patch management, remediations, malware detection, and advisor recommendations. The RHEL administrator role can also view and modify all vulnerability settings.

Prepare the Default access group for consolidated role permissions
Copy link

Before creating a group for a consolidated role, you must modify the Default access group and remove several roles associated with Red Hat Lightspeed-specific permissions.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
Note
When you make changes to the Default access group its name changes to Custom default access group and is no longer updated with Red Hat defined default roles.

Procedure
Copy link

  1. Open the Settings menu.
  2. Click User Access to open the Identity and Access Management page.
  3. Under User Access, click Groups. Before you implement the new RHEL roles, modify the Default access group.
  4. Click the Default access group. Remove the following twelve RHEL related default roles from Default access group, which removes those permissions for all users in your organization.
    • Compliance viewer
    • Content Template viewer
    • Directory and Domain Services viewer
    • Inventory Hosts administrator
    • Patch viewer
    • Remediations viewer
    • Repositories viewer
    • Resource optimization user
    • Repositories viewer
    • RHC user
    • RHEL Advisor administrator
    • Vulnerability viewer
  5. After you select the roles to remove, click on the more options menu icon img more options, which is located in the filter action area near the top of the role list, and click Remove.
  6. Confirm the removal. The selected roles and their permissions are deleted from the Default access group and a success message appears. The Default access group is automatically renamed Custom default access group. You can scroll through the Roles list and verify the roles are removed from the Custom default access group.

What to do next
Copy link

After removing these roles, you can replace these permissions by adding the RHEL viewer role to the group.

Create a new group for RHEL viewers
Copy link

After modifying the Default access group, which is automatically renamed to Custom default access group, create a new group that provides permissions for RHEL viewers. You can also create additional groups that provide permissions for RHEL operators or RHEL administrators.

Before you begin
Copy link

  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.

Procedure
Copy link

  1. Click Create a group.
  2. Provide a group name and description. For example: 
    Group name: RHEL Viewers
Group description: Users who can view all RHEL services and pages, but cannot execute or edit data
  3. Follow the wizard to locate and add the RHEL viewer role to the group.
  4. Add members of your organization to this group who you want to have RHEL viewer permissions.
  5. Review the group details and submit. A success message appears.

What to do next
Copy link

Verify your group:

Look at the Groups list and confirm that the RHEL Viewer group is now available. You can enter "RHEL" in the Filter by name search to locate a specific group.