Review default User Access groups

The User Access feature is based on managing roles rather than by individually assigning permissions to specific users.

In User Access, each role has a specific set of permissions. For example, a role might allow read permission for an application. Another role might allow write permission for an application.

You create groups that contain roles and, by extension, the permissions assigned to each role. You assign users (or service accounts) to groups. This means each user in a group is assigned the permissions of the roles in that group.

By creating different groups and adding or removing roles for that group, you control the permissions allowed for that group. When you add one or more users to a group, those users can perform all actions that are allowed for that group.

Red Hat provides two default access groups for User Access:

  • Default admin access group. The Default admin access group is limited to Organization Administrator users in your organization. You cannot change or modify the roles in the Default admin access group.
  • Default access group. The Default access group contains all authenticated users in your organization. These users automatically inherit a selection of predefined roles. Note
    You can make changes to the Default access group. However, when you do so, its name changes to Custom default access group.

Red Hat provides a set of predefined roles. Depending on the application, the predefined roles for each supported application might have different permissions that are tailored to the application.

The Default admin access group
Copy link

The Default admin access group is provided by Red Hat in the Red Hat Hybrid Cloud Console. It contains a set of roles that are assigned to all users who have an Organization Administrator role on your system. The roles in this group are predefined in the Hybrid Cloud Console.

The roles in the Default admin access group cannot be added to or modified. Because this group is provided by Red Hat, it is automatically updated when Red Hat assigns roles to the Default admin access group.

The benefit of the Default admin access group is that it allows roles to be assigned automatically to Organization Administrators.

The Default access group
Copy link

The Default access group is provided by Red Hat on the Hybrid Cloud Console. It contains a set of roles that are predefined in the Hybrid Cloud Console. The Default access group includes all authenticated users in your organization.

The Default access group contains a subset of all predefined roles. The Default access group is automatically updated when Default access group roles are added in the Hybrid Cloud Console.

As an Organization Administrator, you can add roles to and remove roles from the Default access group. When you do so, its name changes to Custom default access group. The changes you make to this group affect all authenticated users in your organization.

The Custom default access group
Copy link

When you manually modify the Default access group, its name changes to Custom default access, which indicates it was modified. Moreover, it is no longer automatically updated from the Red Hat Hybrid Cloud Console.

From that point forward, an Organization Administrator is responsible for all updates and changes to the Custom default access group. The group is no longer managed or updated by the Hybrid Cloud Console.

Important
You cannot delete the Default access group or Custom default access group.

You can restore the Default access group, which removes the Custom default access group and any changes you made.

Restore the Default access group
Copy link

You can restore the Default access group to its state as provided by Red Hat services. When you do so, the Custom default access group is removed along with any changes made to that group.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
  • The Custom default access group must exist.

There is no way to recover the Custom default access group when you restore the Default access group.

Reasons to restore the Default access group:

  • You made changes to the Default access group that were not intended.
  • You want to start over with the Default access group.
  • You want to remove the Custom default access group.
  • You want to pick up changes to the the Default access group pushed out by Red Hat services and abandon the Custom default access group.
Note
One of the default groups, either the Default access group or the Custom default access group, always exists on your system.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Groups. The Groups page is displayed.
  2. Click Custom default access on the Groups page.
  3. Click Restore to default and accept the caution message.

    The Default access group appears on the Groups page.