Control team access using Role-based Access Control (RBAC)

You can manage access for your teams by creating a group and adding roles, users, and service accounts to the group. The roles and their permissions determine the type of access granted to all members of the group.

Create a group for RBAC
Copy link

Create a new group for role-based access control (RBAC).

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it. Note
    Only the Organization Administrator can assign the User Access administrator role to a group.

The Members tab shows all users that you can add to the group. When you add users to a group, they become members of that group. A group member inherits the roles of all other groups they belong to.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Groups to open the Groups page.
  2. Click Create group.
  3. Follow the guided actions provided by the wizard to add users and roles.
  4. To grant additional group access, edit the group and add additional roles.

Create a User Access administrator
Copy link

The User Access administrator role is assigned by the Organization Administrator and used for user and group management tasks that apply to managing human users and service accounts.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.

All users in the group with the User Access administration role permissions can add, modify, or delete groups and roles. The User Access administrator role cannot create or modify a User Access administrator group. Only the Organization Administrator can create, modify, or delete a group that is assigned the User Access administrator role.

Note
The User Access administrator role does not grant permission to view and approve customer Access Requests.
 Note
The User Access administrator role does not inherit the roles defined in the Default Admin Access group.

This role is not allowed to do the following:

  • Assign the Organization Administrator role.
  • Add members, either users or service accounts, to any group assigned the User Access administrator role.
  • Create new groups and assign the User Access administrator role to the group.

These restrictions are intentionally enforced to uphold the core cybersecurity Principle of Least Privilege and secure the administrative tier from allowing a higher level of permissions than are needed to perform the User Access administrator tasks.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Groups.
  2. Click Create group.
  3. Follow the guided actions provided by the wizard to create the group and add users and roles.
    1. Name the group with a recognizable name: User Access Admin.
    2. Provide a meaningful description: User Access Organization Administrator permissions
    3. Click the Next button to add roles.
    4. Search for the User Access administrator role and click the selection box to add this role to the group. Optionally, select additional roles.
    5. Click the Next button to add members to the group.
      Note
      Any member you add must be an active member of the organization account.
    6. After you select the members for the group, click the Next button to review the details.
    7. You can click the Back button to go back and make changes, or the Cancel button to cancel the action.
  4. Click the Submit button to complete the Create group wizard. The new group will appear in the Groups tab.

Edit or remove a User Access group
Copy link

You can make changes to an existing User Access group in the Red Hat Hybrid Cloud Console and you can delete groups that are no longer needed.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console and meet one of the following criteria:
    • You are a user with Organization Administrator permissions.
    • You are a member of a group that has the User Access administrator role assigned to it. Note
      You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, seeFind your Red Hat login.

Procedure
Copy link

  1. Navigate to Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Groups.
  2. Click the options icon (⋮) on the far right of the group name row, and then click Edit or Delete.
  3. Make and save changes or delete the group.

Add an Organization Administrator to a group
Copy link

You can include an Organization Administrator user in a group if you want an Organization Administrator to have the roles assigned to that group. An Organization Administrator does not inherit all available roles for all Red Hat Hybrid Cloud Console applications.

Before you begin
Copy link

Note
This procedure assumes that you want to modify an existing group and add an Organization Administrator to the group. Alternatively, you can add an Organization Administrator to a group when you create a new group.
 Note
Any roles not inherited by means of the Default access group or the Default admin access group must be assigned through group membership.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Groups. The Groups page displays.
  2. Click the group Name to display details about the group.
  3. On the group details page, click the Members tab to display a list of authorized users who are a member of the group.
  4. Click the Add member tab.
  5. On the Add members to the group page that appears, find the Organization Administrator user name and click the check box next to the name.

    For example, if the Organization Administrator user name is smith-jones, find that name and click the check box next to smith-jones. You can add additional names.

  6. Verify the name list is complete and click the Add to group action.
    Notification pop-ups appear when the action successfully completes.

Add a role to a group
Copy link

Add a role to an existing group to provide additional permissions to all members of that group. You can view user details to add roles to a group that the user belongs to.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
Note
You can add a role to a group from the Users page, or by editing a group from the Groups page. These steps show you how to edit the group from the user details page.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Users to open the Users list.
  2. Click the Username for a user to open the user details page.
  3. Click the count in the Groups column for a role. This shows the groups the user is a member of that have this role assigned.
    Note
    You can view the permissions a role provides by clicking the count in the Permissions column.
  4. Click Add role to this group next to the group name to add additional role(s) to the group. This opens the Add roles dialog.
  5. Select the checkbox for each role(s) you want to add to the group. (Only roles not yet associated with the group are listed.) Click Add to group.
  6. Reload the user details page to see the roles you added to the group.

    The group now has these additional permissions in the console.

Add a user to a group
Copy link

Add a user to an existing group to provide that user with the permissions granted by the roles assigned to that group.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.

This can be useful when a new team member joins your organization and you want to provide them with all necessary permissions for their work.

Note
You can add a user to a group from the Users page, or by editing a group from the Groups page. These steps show you how to add a user to a group from the user details page.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Users to open the Users list.
  2. Click the username for the user you want to edit.
  3. On the user details page, click Add user to a group. A dialog opens showing a list of groups the user is not a member of.
  4. Select the checkbox for one or more groups to add the user to and click Add to group.
  5. Reload the user details page to see the roles you added.

    The user now has the permissions granted by the group(s) they were added to.

Restrict service access to a single user
Copy link

You can create a new group that contains a single user and add a role to that group. The role you add provides the service access permissions you want that single user to have. If you add other users to the group, the added users will have the same group permissions.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.

The roles you add to the group can be from the predefined list of roles provided with User Access, from custom roles created by an Organization Administrator, or a combination of both.

For more information about predefined roles, see section Predefined User Access roles.

When you add a user to a new group, the user acquires the permissions of the new group and also inherits the permissions of all other groups they belong to. The permissions of the new group are added to their existing permissions.

Important
In this procedure you modify the Default access group. Once modified, the Default access group name changes to Custom default access. The Custom default access group is no longer updated with changes pushed out by Red Hat from the Red Hat Hybrid Cloud Console.
 Tip
You can restore the Default access group, which removes the Custom default access group and any changes you made. See Restore the Default access group.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Groups. The Groups page is displayed.
  2. Remove all roles from the Default access group.

    Because all users in your organization belong to the Default access group, you cannot add or remove single users in Default access to create access control. By removing all roles, users do not inherit role permissions from Default access.

    1. Select the checkbox above the roles list to select all roles in the group.
    2. Click the more options icon (⋮) > Remove.
    3. Click Remove roles to confirm.
  3. Save the changes to Default access group. The name changes to Custom default access.
  4. Create a new group that contains the users and roles for the allowed access permissions.

    For example, create a group Security Admin that contains the users who will have full access to vulnerability service.

    1. Create a group Security Admin.
    2. Add one or several users to the group from the Members list.
    3. Add the Vulnerability administrator role.

      Each user you add to this group has full access to the vulnerability service.

      Note
      If you want an Organization Administrator to have access, add the Organization Administrator user to the group.

Disable group access
Copy link

You can disable group access to services by removing roles from a group. Because the roles and their permissions determine the type of access granted to the group, removing roles disables group access for that role.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
Note
Groups can contain no roles and no members and still be a valid group.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Groups. The Groups page is displayed.
  2. Click the Group Name that you want to modify.
  3. Click the Roles tab.
  4. Click the check box next to roles Name that you want to remove.

    You can click the check box at the top of the Name column to select all roles.

  5. Click the more options menu icon img more options that is next to the Add role tab, and then click Remove from group.
  6. In the confirmation window that appears, click either Remove role or Cancel to complete the action.

Predefined User Access roles
Copy link

The following table lists the predefined roles provided with User Access. Some of the predefined roles are included in the Default access group, which includes all authenticated users in your organization.

Only the Organization Administrator users in your organization inherit the roles in the Default admin access group. Because this group is provided by Red Hat, it is updated automatically when Red Hat assigns roles to the Default admin access group.

Note
Predefined roles are updated and modified by Red Hat and cannot be modified. The table might not contain all currently available predefined roles.
Table 1. Predefined roles provided with User Access
Role name Description Default access group Default admin access group

Ansible Lightspeed administrator

Perform read operations for Organization Administrators on all Lightspeed charts.

X

Automation Analytics administrator

Perform any available operation on Automation Analytics resources.

Automation Analytics editor

Perform read and update operations on Automation Analytics resources.

X

Automation Analytics viewer

Perform read operations on Automation Analytics resources.

Cloud administrator

Perform any available operation on any source.

X

Compliance administrator

Perform any available operation on Compliance resources.

X

Compliance viewer

Perform read operations on Compliance resources.

X

Content Template administrator

Perform any available operation on any Content Template resource.

X

Content Template viewer

Perform read-only operations on Content Template resources.

X

Cost OpenShift viewer

Perform read operations on cost reports related to OpenShift sources.

Cost Price List administrator

Perform read and write operations on cost models.

Cost Price List viewer

Perform read operations on cost models.

Cost administrator

Perform any available operation on cost management resources.

X

Cost cloud viewer

Perform read operations on cost reports related to cloud sources.

Directory and Domain Services administrator

Create, read, update and delete Directory and Domains Services registrations.

X

Directory and Domain Services viewer

Read Directory and Domains Services registrations.

X

Hybrid Committed Spend viewer

Perform read operations on any Hybrid Committed Spend report.

Inventory Hosts administrator

Perform read and update operations on Inventory Hosts data.

X

X

Inventory Hosts viewer

Perform read operations on Inventory Hosts data.

Inventory administrator

Perform any available operation on any Inventory resource.

Malware detection administrator

Perform any available operation on any malware-detection resource.

X

Malware detection editor

Read any malware-detection resource as well as set malware acknowledgements.

Malware detection viewer

Perform read operations on any malware-detection resource.

Notifications administrator

Perform any available operation on notifications and integrations resources.

X

Notifications viewer

Perform read operations on notifications and integrations resources.

X

OCM IdP editor

Perform update operations on IdPs.

OCM Organization Administrator

Perform all available operations on the associated organization’s clusters.

OCM cluster autoscaler editor

Perform update operations on the cluster autoscaler.

OCM cluster editor

Perform update operations on clusters.

OCM cluster provisioner

Perform provision operations on clusters.

X

OCM cluster viewer

Perform read operations on clusters.

X

OCM machine pool editor

Perform update operations on machine pools.

OCP Advisor administrator

Perform any available operation on any OCP Advisor resource.

X

Organization staleness and deletion administrator

Perform read and update operations on organization staleness and deletion data.

X

Organization staleness and deletion viewer

Perform read operations on organization staleness and deletion data.

X

Patch administrator

Perform any available operation on any Patch resource.

X

Patch viewer

Perform read operations on any Patch resource.

X

Policies administrator

Perform any available operation on any Policies resource.

X

Policies viewer

Perform read operation on any Policies resource.

X

RHC administrator

Perform any available operation on RHC manager resources.

X

RHC user

Perform read operations on the current configurations on RHC manager and update actions to the activation keys.

X

RHEL Advisor administrator

Perform any available operation on any RHEL advisor resource.

X

RHEL Advisor viewer

Perform read operations on RHEL advisor data.

RHEL administrator

Grants full access to RHEL system configs, inventory, compliance, notifications, patch management, remediations, malware detection, and advisor. View/modify vulnerability settings.

RHEL operator

Grants edit access to system configs, inventory, policies, and notifications/integrations. View compliance reports, patch info, malware detections, and recommendations. Initiate remediations, manage staleness data and modify vulnerability settings.

RHEL viewer

Grants read-only access to Red Hat Lightspeed for RHEL. Users can view system configs, compliance reports, inventory data, patch info, vulnerabilities and more to observe the state of resources/activities, but can’t perform actions other than generating activation keys.

Remediations administrator

Perform any available operation on any Remediations resource.

Remediations user

Perform create, read, update, delete operations on any Remediations resource.

X

Repositories administrator

Perform any available operation on any repositories resource.

X

Repositories uploader

Perform content upload to repositories.

Repositories viewer

Perform read operations on repositories resources.

X

Resource Optimization administrator

Perform any available operation on any Resource Optimization resource.

X

Resource Optimization user

Perform read operations on any Resource Optimization resource.

X

Subscriptions administrator

Perform any available operation on any Subscriptions resource.

X

Subscriptions viewer

Perform read operations on any Subscriptions resource.

X

Tasks administrator

Perform any available operation on any Tasks resource.

X

User Access administrator

Perform most delegated access operations for users and service accounts. This includes managing standard groups and assigning/revoking non-admin roles. Cannot invite new users, assign the Org Admin role or manage any group that contains the User Access Administrator role (to prevent privilege escalation).

X

User Access principal viewer

Perform read operations as a non-Organization Administrator on principals within user access.

Vulnerability administrator

Perform any available operation on any Vulnerability resource.

X

Vulnerability viewer

Perform read operations on any Vulnerability resource.

X

Workspace administrator

Perform read and update operations on Workspace data.

X

Workspace viewer

Perform read operations on Workspace data.