public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Access control: Update docs with new settings permission (#35413)

Browse Source 
* Update docs with new action and scopes for settings

Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>
This commit is contained in:
Karl Persson
2021-06-10 13:20:28 +02:00
committed by GitHub
co-authored by Ursula Kallio
parent bea8747405
commit 92adf2e4ff
2 changed files with 58 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/enterprise/access-control/permissions.md
+45 -43
View File
@@ -25,43 +25,44 @@ The following list contains fine-grained access control actions.
Actions | Applicable scopes | Descriptions
--- | --- | ---
roles:list | roles:* | List available roles without permissions.
roles:read | roles:* | Read a specific role with it's permissions.
roles:write | permissions:delegate | Create or update a custom role.
roles:delete | permissions:delegate | Delete a custom role.
roles.builtin:list | roles:* | List built-in role assignments.
roles.builtin:add | permissions:delegate | Create a built-in role assignment.
roles.builtin:remove | permissions:delegate | Delete a built-in role assignment.
reports.admin:create | reports:* | Create reports.
reports.admin:write | reports:* | Update reports.
reports:delete | reports:* | Delete reports.
reports:read | reports:* | List all available reports or get a specific report.
reports:send | reports:* | Send a report email.
reports.settings:write | n/a | Update report settings.
reports.settings:read | n/a | Read report settings.
provisioning:reload | service:access-control | Reload provisioning files.
users:read | global:users:* | Read or search user profiles.
users:write | global:users:* | Update a user’s profile.
users.teams:read | global:users:* | Read a user’s teams.
users.authtoken:list | global:users:* | List authentication tokens that are assigned to a user.
users.authtoken:update | global:users:* | Update authentication tokens that are assigned to a user.
users.password:update | global:users:* | Update a user’s password.
users:delete | global:users:* | Delete a user.
users:create | n/a | Create a user.
users:enable | global:users:* | Enable a user.
users:disable | global:users:* | Disable a user.
users.permissions:update | global:users:* | Update a user’s organization-level permissions.
users:logout | global:users:* | Log out a user.
users.quotas:list | global:users:* | List a user’s quotas.
users.quotas:update | global:users:* | Update a user’s quotas.
org.users.read | users:* | Get user profiles within an organization.
org.users.add | users:* | Add a user to an organization.
org.users.remove | users:* | Remove a user from an organization.
org.users.role:update | users:* | Update the organization role (`Viewer`, `Editor`, `Admin`) for an organization.
ldap.user:read | n/a | Get a user via LDAP.
ldap.user:sync | n/a | Sync a user via LDAP.
ldap.status:read | n/a | Verify the LDAP servers’ availability.
status:accesscontrol | service:access-control | Get access-control enabled status.
`roles:list` | `roles:*` | List available roles without permissions.
`roles:read` | `roles:*` | Read a specific role with it's permissions.
`roles:write` | `permissions:delegate` | Create or update a custom role.
`roles:delete` | `permissions:delegate` | Delete a custom role.
`roles.builtin:list` | `roles:*` | List built-in role assignments.
`roles.builtin:add` | `permissions:delegate` | Create a built-in role assignment.
`roles.builtin:remove` | `permissions:delegate` | Delete a built-in role assignment.
`reports.admin:create` | `reports:*` | Create reports.
`reports.admin:write` | `reports:*` | Update reports.
`reports:delete` | `reports:*` | Delete reports.
`reports:read` | `reports:*` | List all available reports or get a specific report.
`reports:send` | `reports:*` | Send a report email.
`reports.settings:write` | n/a | Update report settings.
`reports.settings:read` | n/a | Read report settings.
`provisioning:reload` | `service:accesscontrol` | Reload provisioning files.
`users:read` | `global:users:*` | Read or search user profiles.
`users:write` | `global:users:*` | Update a user’s profile.
`users.teams:read` | `global:users:*` | Read a user’s teams.
`users.authtoken:list` | `global:users:*` | List authentication tokens that are assigned to a user.
`users.authtoken:update` | `global:users:*` | Update authentication tokens that are assigned to a user.
`users.password:update` | `global:users:*` | Update a user’s password.
`users:delete` | `global:users:*` | Delete a user.
`users:create` | n/a | Create a user.
`users:enable` | `global:users:*` | Enable a user.
`users:disable` | `global:users:*` | Disable a user.
`users.permissions:update` | `global:users:*` | Update a user’s organization-level permissions.
`users:logout` | `global:users:*` | Log out a user.
`users.quotas:list` | `global:users:*` | List a user’s quotas.
`users.quotas:update` | `global:users:*` | Update a user’s quotas.
`org.users.read` | `users:*` | Get user profiles within an organization.
`org.users.add` | `users:*` | Add a user to an organization.
`org.users.remove` | `users:*` | Remove a user from an organization.
`org.users.role:update` | `users:*` | Update the organization role (`Viewer`, `Editor`, `Admin`) for an organization.
`ldap.user:read` | n/a | Get a user via LDAP.
`ldap.user:sync` | n/a | Sync a user via LDAP.
`ldap.status:read` | n/a | Verify the LDAP servers’ availability.
`status:accesscontrol` | `service:accesscontrol` | Get access-control enabled status.
`settings:write` | `settings:**`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Update settings
## Scope definitions
@@ -69,9 +70,10 @@ The following list contains fine-grained access control scopes.
Scopes | Descriptions
--- | ---
roles:* | Restrict an action to a set of roles. For example, `roles:*` matches any role, `roles:randomuid` matches only the role with UID `randomuid` and `roles:custom:reports:{editor,viewer}` matches both `custom:reports:editor` and `custom:reports:viewer` roles.
permissions:delegate | The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment.
reports:* | Restrict an action to a set of reports. For example, `reports:*` matches any report and `reports:1` matches the report with id `1`.
service:accesscontrol | Restrict an action to target only the fine-grained access control service. For example, you can use this in conjunction with the `provisioning:reload` or the `status:accesscontrol` actions.
global:users:* | Restrict an action to a set of global users.
users:* | Restrict an action to a set of users from an organization.
`roles:*` | Restrict an action to a set of roles. For example, `roles:*` matches any role, `roles:randomuid` matches only the role with UID `randomuid` and `roles:custom:reports:{editor,viewer}` matches both `custom:reports:editor` and `custom:reports:viewer` roles.
`permissions:delegate` | The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment.
`reports:*` | Restrict an action to a set of reports. For example, `reports:*` matches any report and `reports:1` matches the report with id `1`.
`service:accesscontrol` | Restrict an action to target only the fine-grained access control service. For example, you can use this in conjunction with the `provisioning:reload` or the `status:accesscontrol` actions.
`global:users:*` | Restrict an action to a set of global users.
`users:*` | Restrict an action to a set of users from an organization.
`settings:**` | Restrict an action to a subset of settings. For example, `settings:**` matches all settings, `settings:auth.saml:*` matches all SAML settings, and `settings:auth.saml:enabled` matches the enable property on the SAML settings.