From 71c6d7285e8dffe68195c9259ef62b04c4346fb8 Mon Sep 17 00:00:00 2001 From: Ieva Date: Tue, 5 Oct 2021 17:35:01 +0100 Subject: [PATCH] AccessControl: document FGAC licensing permissions (#39192) * document licensing permissions and roles * Update docs/sources/enterprise/access-control/fine-grained-access-control-references.md Co-authored-by: Gabriel MABILLE * Update docs/sources/enterprise/access-control/permissions.md Co-authored-by: Gabriel MABILLE * update action name for "licensing.reports:read" * put licensing editor role back in, more table formatting Co-authored-by: Gabriel MABILLE --- .../fine-grained-access-control-references.md | 14 ++++---- .../enterprise/access-control/permissions.md | 4 +++ docs/sources/http_api/licensing.md | 33 +++++++++++++++++++ 3 files changed, 45 insertions(+), 6 deletions(-) diff --git a/docs/sources/enterprise/access-control/fine-grained-access-control-references.md b/docs/sources/enterprise/access-control/fine-grained-access-control-references.md index 80d2a56cab9..cfcefde765f 100644 --- a/docs/sources/enterprise/access-control/fine-grained-access-control-references.md +++ b/docs/sources/enterprise/access-control/fine-grained-access-control-references.md @@ -31,12 +31,14 @@ The reference information that follows complements conceptual information about | `fixed:datasources:admin` | `datasources:read`
`datasources:create`
`datasources:write`
`datasources:delete` | Allows to create, read, update, delete data sources. | | `fixed:datasources:id:viewer` | `datasources.id:read` | Allows to read data source IDs. | | `fixed:datasources:permissions:admin` | `datasources.permissions:create`
`datasources.permissions:read`
`datasources.permissions:delete`
`datasources.permissions:toggle` | Allows to create, read, delete, enable, or disable data source permissions | +| `fixed:licensing:viewer` | `licensing:read`
`licensing.reports:read` | Read licensing information and custom permission reports. | +| `fixed:licensing:editor` | All permissions from `fixed:licensing:viewer` and
`licensing:update`
`licensing:delete` | Read licensing information and custom permission reports, and update and delete the license token. | ## Default built-in role assignments -| Built-in role | Associated role | Description | -| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | -| Grafana Admin | `fixed:permissions:admin:edit`
`fixed:permissions:admin:read`
`fixed:provisioning:admin`
`fixed:reporting:admin:edit`
`fixed:reporting:admin:read`
`fixed:users:admin:edit`
`fixed:users:admin:read`
`fixed:users:org:edit`
`fixed:users:org:read`
`fixed:ldap:admin:edit`
`fixed:ldap:admin:read`
`fixed:server:admin:read`
`fixed:settings:admin:read`
`fixed:settings:admin:edit` | Default [Grafana server administrator]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) assignments. | -| Admin | `fixed:users:org:edit`
`fixed:users:org:read`
`fixed:reporting:admin:edit`
`fixed:reporting:admin:read`
`fixed:datasources:admin`
`fixed:datasources:permissions:admin` | Default [Grafana organization administrator]({{< relref "../../permissions/organization_roles.md" >}}) assignments. | -| Editor | `fixed:datasources:editor:read` | Default [Editor]({{< relref "../../permissions/organization_roles.md" >}}) assignments. | -| Viewer | `fixed:datasources:id:viewer` | Default [Viewer]({{< relref "../../permissions/organization_roles.md" >}}) assignments. | +| Built-in role | Associated role | Description | +| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | +| Grafana Admin | `fixed:permissions:admin:edit`
`fixed:permissions:admin:read`
`fixed:provisioning:admin`
`fixed:reporting:admin:edit`
`fixed:reporting:admin:read`
`fixed:users:admin:edit`
`fixed:users:admin:read`
`fixed:users:org:edit`
`fixed:users:org:read`
`fixed:ldap:admin:edit`
`fixed:ldap:admin:read`
`fixed:server:admin:read`
`fixed:settings:admin:read`
`fixed:settings:admin:edit`
`fixed:licensing:editor` | Default [Grafana server administrator]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) assignments. | +| Admin | `fixed:users:org:edit`
`fixed:users:org:read`
`fixed:reporting:admin:edit`
`fixed:reporting:admin:read`
`fixed:datasources:admin`
`fixed:datasources:permissions:admin` | Default [Grafana organization administrator]({{< relref "../../permissions/organization_roles.md" >}}) assignments. | +| Editor | `fixed:datasources:editor:read` | Default [Editor]({{< relref "../../permissions/organization_roles.md" >}}) assignments. | +| Viewer | `fixed:datasources:id:viewer` | Default [Viewer]({{< relref "../../permissions/organization_roles.md" >}}) assignments. | diff --git a/docs/sources/enterprise/access-control/permissions.md b/docs/sources/enterprise/access-control/permissions.md index 168181fd552..d2fcd6a6efa 100644 --- a/docs/sources/enterprise/access-control/permissions.md +++ b/docs/sources/enterprise/access-control/permissions.md @@ -76,6 +76,10 @@ The following list contains fine-grained access control actions. | `datasources.permissions:create` | `datasources:*`
`datasources:id:*` | Create data source permissions. | | `datasources.permissions:delete` | `datasources:*`
`datasources:id:*` | Delete data source permissions. | | `datasources.permissions:toggle` | `datasources:*`
`datasources:id:*` | Enable or disable data source permissions. | +| `licensing:read` | n/a | Read licensing information. | +| `licensing:update` | n/a | Update the license token. | +| `licensing:delete` | n/a | Delete the license token. | +| `licensing.reports:read` | n/a | Get custom permission reports. | ## Scope definitions diff --git a/docs/sources/http_api/licensing.md b/docs/sources/http_api/licensing.md index ecdd3f0d3ed..aa7bd6272e9 100644 --- a/docs/sources/http_api/licensing.md +++ b/docs/sources/http_api/licensing.md @@ -9,6 +9,9 @@ aliases = ["/docs/grafana/latest/http_api/licensing/"] Licensing is only available in Grafana Enterprise. Read more about [Grafana Enterprise]({{< relref "../enterprise" >}}). +If you are running Grafana Enterprise and have [Fine-grained access control]({{< relref "../enterprise/access-control/_index.md" >}}) enabled, for some endpoints you would need to have relevant permissions. +Refer to specific resources to understand what permissions are required. + ## Check license availability > **Note:** Available in Grafana Enterprise v7.4+. @@ -17,6 +20,16 @@ Licensing is only available in Grafana Enterprise. Read more about [Grafana Ente Checks if a valid license is available. +### Required permissions + +See note in the [introduction]({{< ref "#enterprise-license-api" >}}) for an explanation. + +| Action | Scope | +| -------------- | ----- | +| licensing:read | n/a | + +### Examples + **Example request:** ```http @@ -47,6 +60,16 @@ Status codes: Manually ask license issuer for a new token. +### Required permissions + +See note in the [introduction]({{< ref "#enterprise-license-api" >}}) for an explanation. + +| Action | Scope | +| ---------------- | ----- | +| licensing:update | n/a | + +### Examples + **Example request:** ```http @@ -97,6 +120,16 @@ Status Codes: Removes the license stored in the Grafana database. +### Required permissions + +See note in the [introduction]({{< ref "#enterprise-license-api" >}}) for an explanation. + +| Action | Scope | +| ---------------- | ----- | +| licensing:delete | n/a | + +### Examples + **Example request:** ```http