Skip to content

Clarify role resolution for users in multiple LDAP groups #161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rgooding wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Clarify role resolution for users in multiple LDAP groups #161

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions docs/authentication/ldap.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,14 @@ For the above levels there are 4 role mappings which are required fields:
- **backupAdminRole** : The user that has administration privileges to create and manage backups. Has read-only access to the rest of the AxonOps server pages and components.
- **readOnlyRole** : A basic read-only role that cannot modify any configuration in AxonOps.

!!! info "Users in more than one group"

Group memberships add up — they never cancel each other out. When a user belongs to several of the mapped groups, AxonOps grants them the **highest** level of access that any of those groups provides.

- A user who is in both a read-only group and a superuser group is granted **superuser** access.
- Access granted at a broader scope still applies within narrower ones. A user with a `_global_` admin role plus a read-only role on a single cluster keeps **admin** access on that cluster.
- Permissions for different clusters are kept separate. A user who is an admin on one cluster and read-only on another keeps each level on its own cluster.

Distinguished Names that are used in the role mappings can comprise of the following parts which define hierarchical structure in a LDAP directory.

- **CN** = Common Name
Expand Down