From 36f4e1fb7c3071eb42c8c4ac32a426f94be08117 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Thu, 2 Aug 2018 13:20:47 -0700 Subject: [PATCH] initial draft that explains default global permissions --- .../v2.x/en/admin-settings/rbac/_index.md | 4 +-- .../rbac/global-permissions/_index.md | 26 +++++++++++++++++-- 2 files changed, 26 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/_index.md index 24bfa38de12..27c660aeb46 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/_index.md @@ -17,11 +17,11 @@ After you configure external authentication, the users that display on the **Use Once the user logs in to Rancher, their _authorization_, or their access rights within the system, is determined by _global permissions_, and _cluster and project roles_. -- **[Global Permissions]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/):** +- [Global Permissions]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/): Define user authorization outside the scope of any particular cluster. -- **[Cluster and Project Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/):** +- [Cluster and Project Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/): Define user authorization inside the specific cluster or project where they are assigned the role. diff --git a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md index 931993237c2..038c3baf5d1 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md @@ -3,13 +3,13 @@ title: Global Permissions weight: 1126 --- -Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are two default global permissions: `Administrator` and `Standard User`. +Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are two default global permissions: `Administrator` and `User`. - **Administrator:** These users have full control over the entire Rancher system and all clusters within it. -- **Standard User:** +- **User:** These users can create new clusters and use them. Standard users can also assign other users permissions to their clusters. @@ -52,3 +52,25 @@ The following table lists each custom global permission available and whether it | Login Access | ✓ | ✓ | > **Note:** Each permission listed above is comprised of multiple individual permissions not listed in the Rancher UI. For a full list of these permissions and the rules they are comprised of, access through the API at `/v3/globalroles`. + +### Default Global Permissions for New Users + +When a user from an [external authentication source]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/) signs into Rancher for the first time, they're automatically assigned a set of global permissions (hereafter, permissions). By default, new users are assigned the [user](#user) permissions. However, in some organizations, these permissions may extend too much access. In this use case, you can change the default permissions to something more restrictive, such as a set of individual permissions. + +You can assign one or more default permissions. For example, the `user` permission assigns new users a [set of individual global permissions](#global-permissions-reference). If you want to restrict the default permissions for new users, you can remove the `user` permission as default role and then assign multiple individual permissions as default instead. Conversely, you can also add administrative permissions on top of a set of other standard permissions. + +>**Note:** Default roles are only assigned to external users. For local users, you must explicitly assign global permissions. + +### Configuring Default Global Permissions + +You can change the default global permissions that are assigned to external users upon their first log in. + +1. From the **Global** view, select **Security > Roles** from the main menu. Make sure the **Global** tab is selected. + +1. Find the permissions set that you want to use as default. Then edit the permission by selecting **Ellipsis > Edit**. + +1. Select **Yes: Default role for new users** and then click **Save**. + +1. If you want to remove a default permission, edit the permission and select **No** from **New User Default**. + +**Result:** The default global permissions are configured based on your changes. Permissions assigned to new users display a check in the **New User Default** column. \ No newline at end of file