User Access concepts

User Access uses the following categories to determine the level of user access that an Organization Administrator can grant to the supported Red Hat Hybrid Cloud Console services.

Note
The access provided to any authorized user depends on the group that the user belongs to and the roles assigned to that group.
  • Group: A collection of users belonging to an account which provides the mapping of roles to users. An Organization Administrator can use groups to assign one or more roles to a group and to include one or more users in a group. A user can be a member of one or many groups. You can create a group with no roles and no users. Any user added to a group must be an authenticated user for the organization account on the Red Hat Hybrid Cloud Console.
  • Roles: A set of permissions that provide access to a given service, such as Red Hat Lightspeed. The permissions to perform certain operations are assigned to specific roles. Roles are assigned to groups. For example, you might have a read role and a write role for a service. Adding both roles to a group grants all members of that group read and write permissions to that service. A role can be added to one or many groups.
  • Permissions: A discrete action that can be requested of a service. One or more permissions can be assigned to a role.

You can also use workspaces to configure access control to resources. Workspaces provide a way to easily organize systems in your inventory, apply access management rules to those systems, and restrict system access only to users who require it.

You can create and manage workspaces by navigating to RHEL > Inventory > Workspaces, or Identity & Access Management > Workspaces.

Note
Using workspaces to configure access management is a preview feature in the Hybrid Cloud Console.

Who can manage User Access
Copy link

To initially view and manage User Access on the Red Hat Hybrid Cloud Console, you must be an Organization Administrator. User Access requires user management capabilities that are designated from the Red Hat Customer Portal. Those capabilities belong solely to the Organization Administrator.

The User Access administrator role is a special role that the Organization Administrator can assign. This role allows users who are not Organization Administrator users to manage User Access on the Red Hat Hybrid Cloud Console.

The User Access administrator role is delegated by the Organization Administrator and used for user and group management tasks that apply to managing human users and service accounts. This role is not allowed to do the following:

  • Assign the Organization Administrator role.
  • Add members, either users or service accounts, to any group assigned the User Access administrator role.
  • Create new groups and assign the User Access administrator role to the group.

These restrictions are intentionally enforced to uphold the core cybersecurity Principle of Least Privilege and secure the administrative tier from allowing a higher level of permissions than are needed to perform the User Access administrator tasks.

Additive access
Copy link

User access on the Red Hat Hybrid Cloud Console uses an additive model, which means that there are no deny roles. In other words, actions are only permitted.

To control access, assign the appropriate roles with the desired permissions to groups, then add users to those groups. The access permitted to any individual user is a sum of all roles assigned to all groups to which that user belongs.