diff --git a/content/for-administrators/giving-access-to-oauth-users.md b/content/for-administrators/giving-access-to-oauth-users.md deleted file mode 100644 index 94b78e62..00000000 --- a/content/for-administrators/giving-access-to-oauth-users.md +++ /dev/null @@ -1,16 +0,0 @@ -# OAuth User Access - -By default, users logged in with OAuth do not have any access. To give them access, you must add them to a group called `admin` that must have the label `team: admin`. - -Example - -```yaml -kind: Group -apiVersion: user.openshift.io/v1 -metadata: - name: admin - labels: - team: admin -users: - - user1 -``` diff --git a/content/for-administrators/giving-access-to-users.md b/content/for-administrators/giving-access-to-users.md new file mode 100644 index 00000000..1a2403b8 --- /dev/null +++ b/content/for-administrators/giving-access-to-users.md @@ -0,0 +1,27 @@ +# User Access + +By default, users logged in (via OAuth external IDPs) do not have any permissions + +Two types of permissions can be granted to a user: + +- [SAAP Cluster Admin](#saap-cluster-admin) +- [Tenant Level Permissions](#tenant-level-permissions) + +## SAAP Cluster Admin + +SAAP Cluster is an administrator level role for a user (with restrictive access). A user with this role can: + +- Create/Manage/Delete Tenants +- Read cluster status (Overview page) +- Administrate non-managed Projects/Namespaces +- Install/Modify/Delete operators in non-managed Projects/Namespaces + +To grant this permission to a user please open a support case with Username/Email of the desired user. + +## Tenant level Permissions + +These permissions are granted per Tenant and are only restricted to the tenant's Namespaces/Projects. For detailed explanation of these roles see [Tenant Member Roles](https://docs.stakater.com/mto/main/tenant-roles.html) + +These roles can be granted by [SAAP Cluster Admin](#saap-cluster-admin) by creating/editing the *Tenant* CR. + +To grant Tenant level permissions see detailed example for [Tenant CR](https://docs.stakater.com/mto/main/customresources.html#2-tenant) diff --git a/mkdocs.yml b/mkdocs.yml index 57c503a7..15c65311 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -79,7 +79,7 @@ nav: - For Administrators: - for-administrators/overview.md - for-administrators/requirements.md - - for-administrators/giving-access-to-oauth-users.md + - for-administrators/giving-access-to-users.md - for-administrators/autoscaling.md - for-administrators/hibernating-your-cluster.md - for-administrators/node-configuration.md