From 1b2a1a9621ea307c67484f3b070e5ee7d267fbec Mon Sep 17 00:00:00 2001 From: Karl Persson Date: Fri, 8 Oct 2021 16:08:42 +0200 Subject: [PATCH] update permissions scopes and description for role scopes (#40206) --- .../enterprise/access-control/permissions.md | 60 +++++++++---------- 1 file changed, 30 insertions(+), 30 deletions(-) diff --git a/docs/sources/enterprise/access-control/permissions.md b/docs/sources/enterprise/access-control/permissions.md index 5683f3c117b..ec28407b873 100644 --- a/docs/sources/enterprise/access-control/permissions.md +++ b/docs/sources/enterprise/access-control/permissions.md @@ -26,38 +26,38 @@ The following list contains fine-grained access control actions. | Action | Applicable scope | Description | | -------------------------------- | ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `roles:list` | `roles:*` | List available roles without permissions. | -| `roles:read` | `roles:*` | Read a specific role with its permissions. | +| `roles:read` | `roles:*`
`roles:uid:*` | Read a specific role with its permissions. | | `roles:write` | `permissions:delegate` | Create or update a custom role. | | `roles:delete` | `permissions:delegate` | Delete a custom role. | | `roles.builtin:list` | `roles:*` | List built-in role assignments. | | `roles.builtin:add` | `permissions:delegate` | Create a built-in role assignment. | | `roles.builtin:remove` | `permissions:delegate` | Delete a built-in role assignment. | -| `reports.admin:create` | `reports:*` | Create reports. | -| `reports.admin:write` | `reports:*` | Update reports. | -| `reports:delete` | `reports:*` | Delete reports. | +| `reports.admin:create` | n/a | Create reports. | +| `reports.admin:write` | `reports:*`
`reports:id:*` | Update reports. | +| `reports:delete` | `reports:*`
`reports:id:*` | Delete reports. | | `reports:read` | `reports:*` | List all available reports or get a specific report. | | `reports:send` | `reports:*` | Send a report email. | | `reports.settings:write` | n/a | Update report settings. | | `reports.settings:read` | n/a | Read report settings. | | `provisioning:reload` | `provisioners:*` | Reload provisioning files. To find the exact scope for specific provisioner, see [Scope definitions]({{< relref "./permissions.md#scope-definitions" >}}). | | `users:read` | `global:users:*` | Read or search user profiles. | -| `users:write` | `global:users:*` | Update a user’s profile. | -| `users.teams:read` | `global:users:*` | Read a user’s teams. | -| `users.authtoken:list` | `global:users:*` | List authentication tokens that are assigned to a user. | -| `users.authtoken:update` | `global:users:*` | Update authentication tokens that are assigned to a user. | -| `users.password:update` | `global:users:*` | Update a user’s password. | -| `users:delete` | `global:users:*` | Delete a user. | +| `users:write` | `global:users:*`
`global:users:id` | Update a user’s profile. | +| `users.teams:read` | `global:users:*`
`global:users:id:*` | Read a user’s teams. | +| `users.authtoken:list` | `global:users:*`
`global:users:id:*` | List authentication tokens that are assigned to a user. | +| `users.authtoken:update` | `global:users:*`
`global:users:id:*` | Update authentication tokens that are assigned to a user. | +| `users.password:update` | `global:users:*`
`global:users:id:*` | Update a user’s password. | +| `users:delete` | `global:users:*`
`global:users:id:*` | Delete a user. | | `users:create` | n/a | Create a user. | -| `users:enable` | `global:users:*` | Enable a user. | -| `users:disable` | `global:users:*` | Disable a user. | -| `users.permissions:update` | `global:users:*` | Update a user’s organization-level permissions. | -| `users:logout` | `global:users:*` | Sign out a user. | -| `users.quotas:list` | `global:users:*` | List a user’s quotas. | -| `users.quotas:update` | `global:users:*` | Update a user’s quotas. | -| `org.users:read` | `users:*` | Get user profiles within an organization. | +| `users:enable` | `global:users:*`
`global:users:id:*` | Enable a user. | +| `users:disable` | `global:users:*`
`global:users:id:*` | Disable a user. | +| `users.permissions:update` | `global:users:*`
`global:users:id:*` | Update a user’s organization-level permissions. | +| `users:logout` | `global:users:*`
`global:users:id:*` | Sign out a user. | +| `users.quotas:list` | `global:users:*`
`global:users:id:*` | List a user’s quotas. | +| `users.quotas:update` | `global:users:*`
`global:users:id:*` | Update a user’s quotas. | +| `org.users:read` | `users:*`
`users:id:*` | Get user profiles within an organization. | | `org.users:add` | `users:*` | Add a user to an organization. | -| `org.users:remove` | `users:*` | Remove a user from an organization. | -| `org.users.role:update` | `users:*` | Update the organization role (`Viewer`, `Editor`, or `Admin`) of an organization. | +| `org.users:remove` | `users:*`
`users:id:*` | Remove a user from an organization. | +| `org.users.role:update` | `users:*`
`users:id:*` | Update the organization role (`Viewer`, `Editor`, or `Admin`) of an organization. | | `ldap.user:read` | n/a | Get a user via LDAP. | | `ldap.user:sync` | n/a | Sync a user via LDAP. | | `ldap.status:read` | n/a | Verify the availability of the LDAP server or servers. | @@ -85,14 +85,14 @@ The following list contains fine-grained access control actions. The following list contains fine-grained access control scopes. -| Scopes | Descriptions | -| ------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `roles:*` | Restrict an action to a set of roles. For example, `roles:*` matches any role, `roles:randomuid` matches only the role with UID `randomuid` and `roles:custom:reports:{editor,viewer}` matches both `custom:reports:editor` and `custom:reports:viewer` roles. | -| `permissions:delegate` | The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment. | -| `reports:*` | Restrict an action to a set of reports. For example, `reports:*` matches any report and `reports:id:1` matches the report with id `1`. | -| `services:accesscontrol` | Restrict an action to target only the fine-grained access control service. You can use this in conjunction with the `status:accesscontrol` actions. | -| `global:users:*` | Restrict an action to a set of global users. | -| `users:*` | Restrict an action to a set of users from an organization. | -| `settings:*` | Restrict an action to a subset of settings. For example, `settings:*` matches all settings, `settings:auth.saml:*` matches all SAML settings, and `settings:auth.saml:enabled` matches the enable property on the SAML settings. | -| `provisioners:*` | Restrict an action to a set of provisioners. For example, `provisioners:*` matches any provisioner, and `provisioners:accesscontrol` matches the fine-grained access control [provisioner]({{< relref "./provisioning.md" >}}). | -| `datasources:*`
`datasources:id:*`
`datasources:uid:*`
`datasources:name:*` | Restrict an action to a set of data sources. For example, `datasources:*` matches any data source, and `datasources:name:postgres` matches the data source named `postgres`. | +| Scopes | Descriptions | +| ------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `roles:*` | Restrict an action to a set of roles. For example, `roles:*` matches any role, `roles:uid:randomuid` matches only the role with UID `randomuid` | +| `permissions:delegate` | The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment. | +| `reports:*` | Restrict an action to a set of reports. For example, `reports:*` matches any report and `reports:id:1` matches the report with id `1`. | +| `services:accesscontrol` | Restrict an action to target only the fine-grained access control service. You can use this in conjunction with the `status:accesscontrol` actions. | +| `global:users:*` | Restrict an action to a set of global users. | +| `users:*` | Restrict an action to a set of users from an organization. | +| `settings:*` | Restrict an action to a subset of settings. For example, `settings:*` matches all settings, `settings:auth.saml:*` matches all SAML settings, and `settings:auth.saml:enabled` matches the enable property on the SAML settings. | +| `provisioners:*` | Restrict an action to a set of provisioners. For example, `provisioners:*` matches any provisioner, and `provisioners:accesscontrol` matches the fine-grained access control [provisioner]({{< relref "./provisioning.md" >}}). | +| `datasources:*`
`datasources:id:*`
`datasources:uid:*`
`datasources:name:*` | Restrict an action to a set of data sources. For example, `datasources:*` matches any data source, and `datasources:name:postgres` matches the data source named `postgres`. |