|
| 1 | += Configure GBAC in the Control Plane |
| 2 | +:description: Configure GBAC to manage access to organization-level resources, like clusters, resource groups, and networks, using OIDC groups from your identity provider. |
| 3 | +:page-topic-type: how-to |
| 4 | +:learning-objective-1: Register an OIDC group in Redpanda Cloud |
| 5 | +:learning-objective-2: Assign a predefined or custom role to a group |
| 6 | +:learning-objective-3: Manage group-based access at the organization level |
| 7 | + |
| 8 | +NOTE: This feature is available for BYOC and Dedicated clusters. |
| 9 | + |
| 10 | +Use Redpanda Cloud group-based access control (GBAC) in the glossterm:control plane[] to manage access to organization resources based on OIDC groups from your identity provider (IdP). For example, you can grant one group access to development clusters while restricting production access to another group. You can also restrict access to geographically dispersed clusters to support data residency requirements. When a user's group membership changes in the IdP, their Redpanda access updates automatically. |
| 11 | + |
| 12 | +After reading this page, you will be able to: |
| 13 | + |
| 14 | +* [ ] {learning-objective-1} |
| 15 | +* [ ] {learning-objective-2} |
| 16 | +* [ ] {learning-objective-3} |
| 17 | +
|
| 18 | +== GBAC terminology |
| 19 | + |
| 20 | +**Group**: A group is a collection of users defined in your IdP. With GBAC, you can assign groups to roles or ACLs in Redpanda Cloud, so that users inherit permissions based on their group membership in your IdP. |
| 21 | + |
| 22 | +**Role**: A role is a list of permissions. Permissions are attached to roles. Users assigned multiple roles receive the union of all permissions defined in those roles. Redpanda Cloud has several predefined roles that you cannot modify or delete, including Reader, Writer, and Admin. You can also create custom roles. |
| 23 | + |
| 24 | +**Role binding**: Role binding assigns a role to an account. Administrators can add, edit, or remove role bindings for a user. When you change the permissions for a given role, all users and service accounts with that role automatically get the modified permissions. |
| 25 | + |
| 26 | +== Manage organization access |
| 27 | + |
| 28 | +In the Redpanda Cloud Console, the *Organization IAM* page lets you create groups. When you create a group, you define its permissions with role binding. When you edit a group, you can change its role bindings to update the group's permissions. When you change the permissions for a given role, all groups with that role automatically get the modified permissions. |
| 29 | + |
| 30 | +Various resources can be assigned as the scope of a role, including the following: |
| 31 | + |
| 32 | +- Organization |
| 33 | +- Resource group |
| 34 | +- Network |
| 35 | +- Network peering |
| 36 | +- Cluster (Serverless clusters have a different set of permissions from BYOC and Dedicated clusters.) |
| 37 | +- MCP server |
| 38 | + |
| 39 | +You can manage GBAC configurations with the https://cloud.redpanda.com[Redpanda Cloud Console^] or with the link:/api/doc/cloud-controlplane/[Control Plane API]. |
| 40 | + |
| 41 | +== Configure group claim extraction |
| 42 | + |
| 43 | +Different identity providers structure group information differently in their OIDC tokens. Before you register groups, configure your SSO connection to tell Redpanda Cloud where to find group claims in the token. |
| 44 | + |
| 45 | +include::ROOT:manage:partial$gbac-token-claim-extraction.adoc[] |
| 46 | + |
| 47 | +== Register groups |
| 48 | + |
| 49 | +To assign an IdP group to a role or ACL, you must first register the group in Redpanda Cloud: |
| 50 | + |
| 51 | +[tabs] |
| 52 | +==== |
| 53 | +Cloud UI:: |
| 54 | ++ |
| 55 | +-- |
| 56 | +. Navigate to *Organization IAM > Groups*. |
| 57 | +. Click *Create group*. |
| 58 | +. Enter a *Name* that matches the group in your IdP exactly (for example, `engineering`). |
| 59 | +. Optionally, enter a *Description*, and configure a *Role binding* to assign the group to a role with a specific scope and resource. |
| 60 | +. Click *Create*. |
| 61 | +-- |
| 62 | +
|
| 63 | +Control Plane API:: |
| 64 | ++ |
| 65 | +-- |
| 66 | +Make a link:/api/doc/cloud-controlplane/operation/operation-groupservice_creategroup[`POST /v1/groups`] request to the xref:redpanda-cloud:manage:api/cloud-byoc-controlplane-api.adoc[Control Plane API]: |
| 67 | +
|
| 68 | +[,bash] |
| 69 | +---- |
| 70 | +curl -X POST 'https://api.redpanda.com/v1/groups' \ |
| 71 | + -H 'Content-Type: application/json' \ |
| 72 | + -H 'Authorization: Bearer <token>' \ |
| 73 | + -d '{ |
| 74 | + "group": { |
| 75 | + "name": "<group-name>", |
| 76 | + "description": "<group-description>" |
| 77 | + } |
| 78 | + }' |
| 79 | +---- |
| 80 | +
|
| 81 | +Replace `<group-name>` with the name that matches the group in your IdP (for example, `engineering`). The name must match exactly for GBAC to map the group correctly. |
| 82 | +-- |
| 83 | +==== |
| 84 | + |
| 85 | +== Predefined roles |
| 86 | + |
| 87 | +include::security:partial$predefined-roles.adoc[] |
| 88 | + |
| 89 | +== Custom roles |
| 90 | + |
| 91 | +In addition to the predefined roles, administrators can create custom roles to mix and match permissions for specific use cases. Custom roles let you grant only the permissions a group needs, without the broad access of predefined roles. |
| 92 | + |
| 93 | +Custom roles are created on the *Roles* tab in *Organization IAM*. For steps to create a custom role, see xref:security:authorization/rbac/rbac.adoc#custom-roles[Custom roles in RBAC]. |
| 94 | + |
| 95 | +When you register a group or edit a group's role binding, you can assign any predefined or custom role to the group. |
| 96 | + |
| 97 | +== Suggested reading |
| 98 | + |
| 99 | +* xref:security:authorization/gbac/gbac_dp.adoc[] |
| 100 | +* xref:security:authorization/rbac/rbac.adoc[] |
| 101 | +* xref:security:authorization/rbac/rbac_dp.adoc[] |
| 102 | +* xref:security:cloud-authentication.adoc#single-sign-on[Single sign-on] |
0 commit comments