Unknown macro: {next_previous_links}
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 7 Next »

A user role is a consolidation of several permissions. A permission is a delegation of authority or a right that is assigned to a user or a group of users to perform an action on a system. Permissions can be granted to or revoked from a user/user group/user role automatically or by a system administrator. For example, if a user has the permission to sign into a system, then the permission to sign out is automatically implied without the need of granting it specifically. Instead of associating permissions with a user, admins can associate permissions with a user role and assign the role to users. User roles can be reused throughout the system and prevents the overhead of granting multiple permissions to each and every user individually.

Default user roles

The following are the roles that are available by default in WSO2 ES.

All WSO2 ES specific roles are stored internally in the DB that is shipped with WSO2 ES.

  • Internal/publisher  -  This is a sample role that is meant to demonstrate the permissions required from a Publisher user. 
  • Internal/store - This is a sample role that is meant to demonstrate the permissions required from a Store user. 
  • Internal/reviewer  - This is a sample role that is meant to demonstrate the permissions required from a Reviewer user. Every asset needs to be reviewed by a user in this role before the asset is published into the Store.
  • private_{username}  - users’ private role. Every user in the ES is automatically associated with a role that is created by prefixing their username with private_ . Use this role to control per-user permissions.
  • Internal/everyone - This role, which is a system reserved role, is used to create system operations.

    If you wish to prevent external operations being carried out by the Internal/everyone role, ensure to revoke operations from the  role.

Permissions associated with user roles

User roleAllowed Actions
Internal/publisher
  • Login to the Publisher.
  • View the asset list.
  • Create and update assets.
  • View the lifecycle management page.
Internal/reviewer
  • Login to the Publisher.
  • View the asset list.
  • View the lifecycle management page.
  • Update the lifecycle state.
Internal/store
  • Login to the Store.
  • View the asset list.
  • View details of an asset.
  • Bookmark assets.
  • Add a review and rate assets.
private_{username} By default, only the login permission is assigned to this role. However, if there are permissions that need to be allowed to specific users, they can be assigned using this role. Ensure to replace the {username} with that specific user's username.

If you create any custom roles that mimic the internal/publisher role, which is shipped with ES, it is mandatory for you to add the read/write access to the static part of the storage path defined in the RXTs. For example, gadgets is the static prefix in the following storage path.

/gadgets/@{overview_provider}/@{overview_name}/@{overview_version}

The Add, Modify, and Remove role options are only visible to administrators with privileges.

Adding a user role

Follow the instructions below to add a user role:

  1. Sign into the WSO2 ES Management Console.
  2. On the Main menu, navigate to Users and Roles, and click Add
  3. Click Add New Role
  4. Select the domain. By default, PRIMARY appears to indicate the primary user store; however, if secondary user stores have been added they are listed in the Domain drop-down list.
  5. Enter the name for the role.
  6. Click Next and proceed to the next step. You can also click Finish, in which case, the new roles will be created with default permissions (none) and no assigned users.
  7. Select permissions for the new role. 
  8. Click Next.
  9. Enter a username pattern. Use one of the following approaches: 
    • Enter the exact username.
    • Enter part of the username followed by or preceded by an asterisk (*) (for example, ad* - this option will return all the users that have usernames starting with "ad").
    • Enter only an asterisk (*). This option will return all the users under the selected domain.
  10. Select the users that will be assigned to the role. 
  11. Click Finish.
    The new role is added to the list on the Roles page.

When adding roles to external user stores

  • Some external user stores do not allow you to create empty roles. In that case, selecting users who belong to a role is mandatory.
  • If you connect to an external user store (e.g., LDAP) in the read-only mode, you can read existing roles from it, but you can not edit/delete the roles. In this case, you can still create new roles that are editable and can be managed internally.
  • If you connect to an external user store in read/write mode, you can edit the roles in the external user store as well.

Creating an internal role

Follow the instructions below to create an internal role:
  1. Sign into the WSO2 ES Management Console.
  2. On the Main menu, navigate to Users and Roles, and click Add
  3. Click Add New Role.
  4. Select Internal from the Domain drop-down menu.
  5. Enter a name for the role.
  6. Click Next to proceed to the next step. You can also click Finish, in which case, the new roles will be created with default permissions (none) and no assigned users.
  7. Select the respective permissions that need to be assigned to the role and click  Next.
  8. Enter a username pattern and click Search.
    • Enter the exact username.
    • Enter part of the username followed by or preceded by an asterisk (*) (for example, ad* - this option will return all the users that have usernames starting with "ad".)
    • Enter only an asterisk *. This option will return all the users that have not been assigned to this role.
  9. Select the respective users that need to be assigned to this role.
    You can also click Finish. In this case, the new roles will be created with no assigned users.
  10. Click Finish.

Searching for roles

Follow the instructions below to search for roles:

  1. Sign into the WSO2 ES Management Console.
  2. On the Main menu, navigate to Users and Roles, and click List
  3. Click Roles
  4. Select the user store domain.
  5. Enter a role name pattern using one of the following approaches:  
    • Enter the exact role name.
    • Enter part of the role name followed by or preceded by an asterisk (*) (for example, t* - this option will return all the roles that have role names starting with "t".)
    • Enter only an asterisk *. This option will return all the roles under the selected domain.
  6. Click Search.

Editing a user role

Follow the instructions below to edit a user role:

  1. Sign into the WSO2 ES Management Console.
  2. On the Main menu, navigate to Users and Roles, and click List
  3. Click Roles
  4. Search for the role.
  5. To Rename the role:
    • Click Rename.
    • Enter the new name of the role.
    • Click Finish.
  6. To edit the permissions of the role:
    • Click the respective  Permissions  link.
    • Select/De-select on the permissions that you wish to add/remove.
    • Click Update.
    • A confirmation message appears. Click OK.
  7. To assign users to the role:
    • Click the respective  Assign Users  link.
    • Select the users that you wish to assign to this role.
    • Click Update.
    • A confirmation message appears. Click OK.
    • Click Finish.

Deleting a user role

Follow the instructions below to delete a user role:

  1. Sign into the WSO2 ES Management Console.
  2. On the Main menu, navigate to Users and Roles, and click List
  3. Click Roles
  4. Search for the role.
  5. Click on the corresponding Delete link.
  6. Click Yes to accept the confirmation request.
  • No labels