Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RS: Update RBAC for the new UI #2690

Merged
merged 2 commits into from
Aug 1, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 12 additions & 8 deletions content/rs/security/access-control/rbac/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,23 +12,27 @@ Role-based access control (RBAC) allows you to configure the level of access eac

## Role types

Assign a role, which grants specific cluster and database permissions, to multiple users.
You can create custom user roles that determine cluster management permissions, data access permissions, or a combination of both.

There are two types of roles:
- [Management roles]({{<relref "/rs/security/access-control/admin-console-access">}}) determine user access to the cluster’s admin console and [REST API]({{<relref "/rs/references/rest-api">}}).

- [Management roles]({{<relref "/rs/security/access-control/admin-console-access">}}), which determine user access to the cluster’s admin console and [REST API]({{<relref "/rs/references/rest-api">}}).
- [Data access controls]({{<relref "/rs/security/access-control/database-access">}}) determine the permissions each role grants for each database in the cluster.

- [Data access controls]({{<relref "/rs/security/access-control/database-access">}}), which determine the permissions each role grants for each database in the cluster.
Multiple users can share the same role.

## Access control screen

There are three tabs on the **access control** screen:
The **Access Control** screen has the following tabs:

- **redis ACLs** - [Define named permissions]({{<relref "/rs/security/access-control/rbac/configure-acl">}}) for specific Redis commands, keys, and pub/sub channels. You can use defined Redis ACLs for multiple databases and roles.
- **Users** - [Create users]({{<relref "/rs/security/access-control/manage-users/add-users">}}) and [assign a role to each user]({{<relref "/rs/security/access-control/rbac/assign-user-role">}}) to grant access to the admin console, REST API, or databases.

- **roles** - [Create roles]({{<relref "/rs/security/access-control/rbac/create-roles">}}). Each role consists of a set of permissions (Redis ACLs) for one or more Redis databases. You can reuse these roles for multiple users.
- **Roles** - [Create roles]({{<relref "/rs/security/access-control/rbac/create-roles">}}). Each role consists of a set of permissions (Redis ACLs) for one or more Redis databases. You can reuse these roles for multiple users.

- **users** - [Create users]({{<relref "/rs/security/access-control/manage-users/add-users">}}) and [assign a role to each user]({{<relref "/rs/security/access-control/rbac/assign-user-role">}}) to grant access to the admin console, REST API, or databases.
- **Redis ACLs** - [Define named permissions]({{<relref "/rs/security/access-control/rbac/configure-acl">}}) for specific Redis commands, keys, and pub/sub channels. Redis version 7.2 lets you specify read and write access for key patterns and use selectors to define multiple sets of rules in a single Redis ACL. You can use defined Redis ACLs for multiple databases and roles.

- **LDAP Mappings** - Map LDAP groups to access control roles.

- **Settings** - Additional access control settings, such as default permissions for pub/sub ACLs.

## Active-Active databases

Expand Down
8 changes: 6 additions & 2 deletions content/rs/security/access-control/rbac/assign-user-role.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,15 @@ aliases:

Assign a role, associated with specific databases and access control lists (ACLs), to a user to grant database access:

1. From the **access control > users** tab in the admin console, select an existing user from the list or select ![Add](/images/rs/icon_add.png#no-click "Add") to [create a new user]({{<relref "/rs/security/access-control/manage-users/add-users">}}).
1. From the **Access Control > Users** tab in the admin console, you can:

- Point to an existing user and select <img src="/images/rs/buttons/edit-button.png#no-click" alt="The Edit button" width="25px"> to edit the user.

- Select **+ Add user** to [create a new user]({{<relref "/rs/security/access-control/manage-users/add-users">}}).

1. Select a role to assign to the user.

1. Select the **Save** icon.
1. Select **Save**.

## Next steps

Expand Down
21 changes: 9 additions & 12 deletions content/rs/security/access-control/rbac/create-roles.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,10 @@ categories: ["RS"]
aliases: ["/rs/security/access-control/create-roles/"]
---

From **access control** > **roles**, you can configure user roles with:
From **Access Control** > **Roles**, you can create custom user roles that determine cluster management permissions, data access permissions, or a combination of both.

- [**Management roles**](#default-management-roles) - Management roles define user access to the cluster's admin console and API.

- **Data access controls** - Data access controls define the permissions each role has for each database in the cluster.

## Default management roles
Expand All @@ -32,28 +33,24 @@ To create a role that grants database access to users but blocks access to the R

To define a role for database access:

1. From **access control** > **roles**, you can either:
1. From **Access Control** > **Roles**, you can:

- Point to a role and select ![Edit](/images/rc/icon_edit.png#no-click "Edit") to edit an existing role.
- Point to a role and select <img src="/images/rs/buttons/edit-button.png#no-click" alt="The Edit button" width="25px"> to edit an existing role.

- Select ![Add](/images/rs/icon_add.png#no-click "Add") to create a new role.
- Select **+ Add role** to create a new role.

1. Enter a descriptive name for the role. This will be used to reference the role when configuring users.

1. Select a **Cluster management role**. The default is **None**.

1. Select **Add** under **Redis ACLs** ![Add](/images/rs/icon_add.png#no-click "Add").
1. Choose a **Cluster management role**. The default is **None**.

1. Select the databases the role applies to.
1. Select **+ Add ACL**.

1. Select the Redis ACL to apply to the role.
1. Choose a Redis ACL and databases to associate with the role.

1. Select the save icon.
1. Select the check mark to confirm.

1. Select **Save**.

{{< video "/images/rs/new-redis-role.mp4" "Create a new Redis Role" >}}

## Next steps

- [Assign the role to a user]({{<relref "/rs/security/access-control/rbac/assign-user-role">}}).
Binary file added static/images/rs/buttons/edit-button.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.