2 Setting Up Permissions for Groups, and Users

This chapter describes how Private Automation Hub enables administrators to create roles, groups, and users where permissions can be allocated at the group level and defined at the role level. These permissions are based on role-based access controls.

Note:

You can integrate the Private Automation Hub access levels discussed in this chapter with external identity management services, such as LDAP. Note that LDAP user account information does not appear in Private Automation Hub until after the LDAP user account first logs in to Private Automation Hub. See Oracle Linux Automation Manager 2: Private Automation Hub Installation Guide for more information about LDAP authentication and mappings for users and groups.

You can assign roles that specify which permissions are available to a group, and hence available to all the users within that group. You can add from the predefined roles listed in the following table.

Note:

Additionally, you can create custom roles based one or more of the predefined permissions.

Table 2-1 Role-Based Access Control Role Descriptions

Role	Permissions	Description
galaxy.collection_admin	Add namespace Change namespace Delete namespace Upload to namespace Modify Ansible repo content Delete collection Change collection remote View collection remote	Members of a group with this role can do the following: Create, change, and delete a namespace. Upload a collection to a namespace. Use the Approval feature to certify or reject content in the Staging repository and thus move it to the Publishing or Rejected repositories respectively. Delete collections. Use the Repository Management feature to Configure remote repositories.
galaxy.collection_curator	Modify Ansible repo content Change collection remote View collection remote	Members of a group with this role can do the following: Use the Approval feature to certify or reject content in the Staging repository and thus move it to the Publishing or Rejected repositories respectively. Use the Repository Management feature to Configure remote repositories.
galaxy.collection_namespace_owner	Change namespace Upload to namespace	Members of a group with this role can do the following: Change a namespace. Upload a collection to a namespace.
galaxy.collection_publisher	Add namespace Change namespace Upload to namespace	Members of a group with this role can do the following: Create and change a namespace. Upload a collection to a namespace.
galaxy.content_admin	Add namespace Change namespace Delete namespace Upload to namespace Change collection remote View collection remote Create new containers Change container namespace permissions Change containers Change image tags Push to existing containers Delete container repository Add remote registry Change remote registry Delete remote registry	Members of a group with this role can do the following: Create, change, and delete a namespace. Upload a collection to a namespace. Use the Repository Management feature to Configure remote repositories. Manage container repositories. Add, change, or delete remote registries added to Private Automation Hub.
galaxy.execution_environment_admin	Create new containers Change container namespace permissions Change containers Change image tags Push to existing containers Delete container repository Add remote registry Change remote registry Delete remote registry	Members of a group with this role can do the following: Manage container repositories. Add, change, or delete remote registries added to Private Automation Hub.
galaxy.execution_environment_collaborator	Change containers Change image tags Push to existing containers	Members of a group with this role can do the following: Change existing execution environments.
galaxy.execution_environment_namespace_owner	Change container namespace permissions Change containers Change image tags	Members of a group with this role can do the following: Create and update execution environments under existing container namespaces.
galaxy.execution_environment_publisher	Create new containers Change container namespace permissions Change containers Change image tags Push to existing containers	Members of a group with this role can do the following: Push, and change execution environments.
galaxy.group_admin	Add group Change group Delete group	Members of a group with this role can do the following: View, add, remove and change groups.
galaxy.task_admin	Change task Delete task View all tasks	Members of a group with this role can do the following: View, and cancel any task.
galaxy.user_admin	Add a standard user Change a standard user Delete a standard user View a standard user Note: Only a super user can edit super user accounts. The galaxy.user_admin role's permissions apply to standard users only.	Members of a group with this role can do the following: View, add, remove and change users.

Setting Up Users

Private Automation Hub provides the following user types:

The Default admin Super User

When you install Private Automation Hub, a super user with username admin is created for you automatically. The admin account enables you to log in and set up your system, for example by creating users, other super users, groups, and roles as required by your organization. By default, admin does not belong to any group.

Note:

Super users, sudh as admin, have all system permissions regardless of groups they belong to.

Super Users

Private Automation Hub enables you to use a super user account to create other super users in addition to the default admin user.

Users

Private Automation Hub also enables you to create standard users who do not have super-user privileges.

Note:

Standard users get most permissions by virtue of their group memberships.

For example, if you create standard user standard_user_1, the newly created user will not be able to upload any collections to the namespaces you have in your Private Automation Hub. To enable standard_user_1 to upload collections to existing namespaces, you would need to carry out additional steps similar to the following:

1. Create group Group_Namespace_Uploaders.

2. Assign a built-in role, for example galaxy.collection_namespace_owner, that has permissions to upload to a namespace, to group Group_Namespace_Uploaders.

3. Add standard_user_1 to group Group_Namespace_Uploaders.

4. Verify standard_user_1 can log on and upload collections to namespaces in Private Automation Hub.

For more information on groups and roles see Setting Up Permissions for Groups, and Users, Setting Up Roles, and Setting Up Groups

To set up a user, do the following:

1. Log into Private Automation Hub.

2. From the User Access section, click Users.

   The Users page appears.

3. Click the Create button.

   The Create new user page appears.

4. In the Username field, enter a username.
5. In the First name field, enter a first name.
6. In the Last name field, enter a last name.
7. In the Email field, enter an email address.
8. In the Password field, enter a password.

   Note:

   The password must contain at least 9 characters, and include special characters , ex <!@$%>. Avoid using common names or expressions.
9. In the Password confirmation field, repeat the password.
10. From the Groups list, select one or more groups.
11. Click the User type button if you want the user to have super-user privileges.
12. Click Save.

Setting Up Roles

To create custom roles based on permissions associated to the predefined roles, do the following:

1. Log into Private Automation Hub.

2. From the User Access section, click Roles.

   The Roles page appears listing all available predefined and custom roles.

3. Click the Add roles button.

   The Create a new role page appears.

4. In the Name field, enter a role name. The name must begin with the word galaxy. and can contain only letters and numbers.
5. In the Description field, enter a description of the role.
6. In the permissions area, select one or more permissions from one or more of the predefined permissions.
7. Click Save.

   Your newly created role is added to the list on the Roles page.

Setting Up Groups

To create a group, do the following:

1. Log into Private Automation Hub.

2. From the User Access section, click Groups.

   The groups page appears.

3. Click the Create button.

   The Create a group dialog appears.

4. In the Name field, enter a name for your group.

5. Click Create.

   A new page for the group appears.

6. Click the Access tab.
7. Click Add roles.

   The Add roles dialog appears.

8. From the Select roles area, select from the list of roles that define the permissions available to users associated to this group. For more information about the predefined roles, see Setting Up Permissions for Groups, and Users. For more information about custom roles, see Setting Up Roles.

9. Click Next.

   The Preview page appears.

10. Click Add.

    The group page appears.

11. Click the Users tab.

    A list of users associated to the group appears. As this group is newly created, no users are listed.

12. Click Add.

    The Add selected users to group dialog appears.

13. From the list, select one or more user.
14. Click Add.

    The users you have added now appear in the Users tab.