Admin roles
3 minute read
Combine admin roles with group, special, and global roles to give users exactly the administrative capabilities they need, such as a slice of what a Super Admin can do.
Example: to let a user manage resource handlers but nothing else an administrator can do, create an admin role with only the Manage Resource Handlers permission.
With multi-tenancy, admin roles control the management permissions users have within their tenant. For users who are not part of a tenant, their admin roles apply everywhere: across all tenants and to global objects.
Manage admin roles
Admin roles are listed on the Admin Roles tab of the Admin > Roles page, where you can add, edit, and delete them. The add and edit dialogs set the role’s admin permissions, assign it to users, and apply resource technology restrictions.
Add an admin role
- Go to Admin > Roles and select the Admin Roles tab.
- On the tab, select Add.
- Provide a Label, Name, and optional Description.
- Select Permissions for this role.
- Optionally assign users to the role.
Selecting any of the four resource handler-related permissions (Manage Resource Handlers, Manage Environments, Manage Networks, or Manage OS Builds) reveals the Resource Technologies field. Set one or more technologies to scope those permissions to them, or leave it empty to apply them across all technologies. The field affects only those four permissions, which is useful when, for example, different teams manage AWS versus VMware. For environments, networks, and OS builds, the technology is provided by the associated resource handler.
Assign admin roles
You can assign admin roles in two places: when adding or editing a role on the Roles page, and when adding users to a tenant, where the roles then apply only in that tenant. When users are removed from a tenant, their admin roles are removed.
A user’s profile shows their admin roles and tenant membership. To assign roles automatically, use External User Sync/LDAP Mappings: when adding or editing an LDAP mapping (Admin > LDAP Authentication Settings > your LDAP utility > Group Mappings), select one or more admin roles to grant to matching LDAP users.
Admin role permissions
The set of admin permissions is fixed: you can select from those provided but cannot add new ones. If you need a permission that does not exist, contact CloudBolt Support.
When a permission grants management of a type of object, it applies to all objects of that type, or, for a user in a tenant, only those in their tenant.
A tenant-specific admin role can view and manage only the groups allowed by its group role membership, so it can assign the environments it creates only to those groups. It cannot see or modify groups in other tenants.
Available admin permissions
| Name | Label |
|---|---|
| application.manage | Manage Applications |
| configmanager.manage | Manage Configuration Managers |
| containerorchestrator.manage | Manage Container Orchestrators |
| environment.manage | Manage Environments |
| flowcontrol.operator | Manage Flow Control Operations |
| flowcontrol.manage_filters | Manage Flow Control Filters |
| ipam.manage | Manage IPAMs |
| network.manage | Manage Networks |
| osbuild.manage | Manage OS Builds |
| preconfiguration.manage | Manage Preconfigurations |
| resourcehandler.manage | Manage Resource Handlers |
| resourcepool.manage | Manage Resource Pools |
| sshkey.manage | Manage SSH Keys |
| user.manage | Manage Users |
| vaults.manage | Manage Password Vaults |
Manage Resource Handlers, Manage Environments, Manage Networks, and Manage OS Builds can be scoped to specific resource technologies. See Manage admin roles.