Global roles
3 minute read
A user can be granted one or more of these roles:
- Super Admin
- Devops Admin
- Global Viewer
A fourth role, CloudBolt Admin, is available only when it is explicitly enabled. See CloudBolt Admin.
Manage global roles
- Select Admin > Users.
- Select the user’s email address to open their profile, where you can view their active global roles.
- Select Manage profile.
- Enable or disable global roles using the checkboxes.
Do not remove the Super Admin role from a user unless at least one other user is a Super Admin. Once a user is no longer a Super Admin, they cannot grant themselves or others that role.
Global role permissions
The following table describes each global role.
| Role | Description |
|---|---|
| Super Admin | The Super Admin role grants all permissions in Cloud Management Platform (CMP), including the ability to administer the platform and full access to all groups, servers, and resources. |
| Devops Admin | The Devops Admin role grants a user access to all servers without requiring membership in each server’s group. |
| Global Viewer | A Global Viewer can view most of the UI but, if this is their only role, has no edit capabilities. They may still see sensitive information, such as user details and portal settings. A Global Viewer cannot see: - Lists and details for all types of Actions (base Actions, Orchestration Actions, Server Actions, Resource Actions, Rules, and so on) - Lists and details for Recurring Jobs - Lists and details for Continuous Infrastructure Testing - Lists and details for Configuration Managers - Lists and details for External Orchestrators - Lists and details for Security Information and Event Management - Details for Parameters - Details for Blueprints - The Version & Upgrade Info details - Lists and details for LDAP Utilities - The SSL Root Certificates page - The Email Settings page - The Miscellaneous Settings page - Other items under the Maintenance and Support Tools sections of the Admin page, including Export & Download Database, View Application Log, Download All CloudBolt Logs, and Download Web Server Logs |
CloudBolt Admin
This role is only present when CB_ADMIN_ENABLED is set to True in customer_settings.py. It is off by default. For most deployments, the Super Admin global role provides sufficient administrator control, and CloudBolt Admin is not necessary.
The CloudBolt Admin role gives a user access to the Admin page, where they can create and edit all CMP objects, including:
- users
- resource handlers
- networks
- parameters
- preconfigurations
- actions
The Admin page also lets these users change email notifications and other global settings.
CloudBolt Admins are the only users allowed to create top-level groups in the group tree. They are not automatically granted any permissions on groups, servers, or resources; they only have the right to administer the platform itself.
For password policy settings and instructions on resetting the administrator password from the command line, see Password policies and admin password reset.