AccessControl: document FGAC licensing permissions (#39192)
* document licensing permissions and roles * Update docs/sources/enterprise/access-control/fine-grained-access-control-references.md Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update docs/sources/enterprise/access-control/permissions.md Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * update action name for "licensing.reports:read" * put licensing editor role back in, more table formatting Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
This commit is contained in:
Ieva
Gabriel MABILLE
@@ -31,12 +31,14 @@ The reference information that follows complements conceptual information about
|
||||
| `fixed:datasources:admin` | `datasources:read`<br>`datasources:create`<br>`datasources:write`<br>`datasources:delete` | Allows to create, read, update, delete data sources. |
|
||||
| `fixed:datasources:id:viewer` | `datasources.id:read` | Allows to read data source IDs. |
|
||||
| `fixed:datasources:permissions:admin` | `datasources.permissions:create`<br> `datasources.permissions:read`<br> `datasources.permissions:delete`<br>`datasources.permissions:toggle` | Allows to create, read, delete, enable, or disable data source permissions |
|
||||
| `fixed:licensing:viewer` | `licensing:read`<br>`licensing.reports:read` | Read licensing information and custom permission reports. |
|
||||
| `fixed:licensing:editor` | All permissions from `fixed:licensing:viewer` and <br>`licensing:update`<br>`licensing:delete` | Read licensing information and custom permission reports, and update and delete the license token. |
|
||||
|
||||
## Default built-in role assignments
|
||||
|
||||
| Built-in role | Associated role | Description |
|
||||
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Grafana Admin | `fixed:permissions:admin:edit`<br>`fixed:permissions:admin:read`<br>`fixed:provisioning:admin`<br>`fixed:reporting:admin:edit`<br>`fixed:reporting:admin:read`<br>`fixed:users:admin:edit`<br>`fixed:users:admin:read`<br>`fixed:users:org:edit`<br>`fixed:users:org:read`<br>`fixed:ldap:admin:edit`<br>`fixed:ldap:admin:read`<br>`fixed:server:admin:read`<br>`fixed:settings:admin:read`<br>`fixed:settings:admin:edit` | Default [Grafana server administrator]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) assignments. |
|
||||
| Admin | `fixed:users:org:edit`<br>`fixed:users:org:read`<br>`fixed:reporting:admin:edit`<br>`fixed:reporting:admin:read`<br>`fixed:datasources:admin`<br>`fixed:datasources:permissions:admin` | Default [Grafana organization administrator]({{< relref "../../permissions/organization_roles.md" >}}) assignments. |
|
||||
| Editor | `fixed:datasources:editor:read` | Default [Editor]({{< relref "../../permissions/organization_roles.md" >}}) assignments. |
|
||||
| Viewer | `fixed:datasources:id:viewer` | Default [Viewer]({{< relref "../../permissions/organization_roles.md" >}}) assignments. |
|
||||
| Built-in role | Associated role | Description |
|
||||
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Grafana Admin | `fixed:permissions:admin:edit`<br>`fixed:permissions:admin:read`<br>`fixed:provisioning:admin`<br>`fixed:reporting:admin:edit`<br>`fixed:reporting:admin:read`<br>`fixed:users:admin:edit`<br>`fixed:users:admin:read`<br>`fixed:users:org:edit`<br>`fixed:users:org:read`<br>`fixed:ldap:admin:edit`<br>`fixed:ldap:admin:read`<br>`fixed:server:admin:read`<br>`fixed:settings:admin:read`<br>`fixed:settings:admin:edit`<br>`fixed:licensing:editor` | Default [Grafana server administrator]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) assignments. |
|
||||
| Admin | `fixed:users:org:edit`<br>`fixed:users:org:read`<br>`fixed:reporting:admin:edit`<br>`fixed:reporting:admin:read`<br>`fixed:datasources:admin`<br>`fixed:datasources:permissions:admin` | Default [Grafana organization administrator]({{< relref "../../permissions/organization_roles.md" >}}) assignments. |
|
||||
| Editor | `fixed:datasources:editor:read` | Default [Editor]({{< relref "../../permissions/organization_roles.md" >}}) assignments. |
|
||||
| Viewer | `fixed:datasources:id:viewer` | Default [Viewer]({{< relref "../../permissions/organization_roles.md" >}}) assignments. |
|
||||
|
||||
@@ -76,6 +76,10 @@ The following list contains fine-grained access control actions.
|
||||
| `datasources.permissions:create` | `datasources:*`<br>`datasources:id:*` | Create data source permissions. |
|
||||
| `datasources.permissions:delete` | `datasources:*`<br>`datasources:id:*` | Delete data source permissions. |
|
||||
| `datasources.permissions:toggle` | `datasources:*`<br>`datasources:id:*` | Enable or disable data source permissions. |
|
||||
| `licensing:read` | n/a | Read licensing information. |
|
||||
| `licensing:update` | n/a | Update the license token. |
|
||||
| `licensing:delete` | n/a | Delete the license token. |
|
||||
| `licensing.reports:read` | n/a | Get custom permission reports. |
|
||||
|
||||
## Scope definitions
|
||||
|
||||
|
||||
@@ -9,6 +9,9 @@ aliases = ["/docs/grafana/latest/http_api/licensing/"]
|
||||
|
||||
Licensing is only available in Grafana Enterprise. Read more about [Grafana Enterprise]({{< relref "../enterprise" >}}).
|
||||
|
||||
If you are running Grafana Enterprise and have [Fine-grained access control]({{< relref "../enterprise/access-control/_index.md" >}}) enabled, for some endpoints you would need to have relevant permissions.
|
||||
Refer to specific resources to understand what permissions are required.
|
||||
|
||||
## Check license availability
|
||||
|
||||
> **Note:** Available in Grafana Enterprise v7.4+.
|
||||
@@ -17,6 +20,16 @@ Licensing is only available in Grafana Enterprise. Read more about [Grafana Ente
|
||||
|
||||
Checks if a valid license is available.
|
||||
|
||||
### Required permissions
|
||||
|
||||
See note in the [introduction]({{< ref "#enterprise-license-api" >}}) for an explanation.
|
||||
|
||||
| Action | Scope |
|
||||
| -------------- | ----- |
|
||||
| licensing:read | n/a |
|
||||
|
||||
### Examples
|
||||
|
||||
**Example request:**
|
||||
|
||||
```http
|
||||
@@ -47,6 +60,16 @@ Status codes:
|
||||
|
||||
Manually ask license issuer for a new token.
|
||||
|
||||
### Required permissions
|
||||
|
||||
See note in the [introduction]({{< ref "#enterprise-license-api" >}}) for an explanation.
|
||||
|
||||
| Action | Scope |
|
||||
| ---------------- | ----- |
|
||||
| licensing:update | n/a |
|
||||
|
||||
### Examples
|
||||
|
||||
**Example request:**
|
||||
|
||||
```http
|
||||
@@ -97,6 +120,16 @@ Status Codes:
|
||||
|
||||
Removes the license stored in the Grafana database.
|
||||
|
||||
### Required permissions
|
||||
|
||||
See note in the [introduction]({{< ref "#enterprise-license-api" >}}) for an explanation.
|
||||
|
||||
| Action | Scope |
|
||||
| ---------------- | ----- |
|
||||
| licensing:delete | n/a |
|
||||
|
||||
### Examples
|
||||
|
||||
**Example request:**
|
||||
|
||||
```http
|
||||
|
||||
Reference in New Issue
Block a user