|
| 1 | +--- |
| 2 | +title: "{{site.konnect_short_name}} teams and roles" |
| 3 | +content_type: reference |
| 4 | +layout: reference |
| 5 | + |
| 6 | +products: |
| 7 | + - gateway |
| 8 | + |
| 9 | +works_on: |
| 10 | + - konnect |
| 11 | + |
| 12 | +description: Explains which teams and roles {{site.konnect_short_name}} has and how to manage them. |
| 13 | + |
| 14 | +related_resources: |
| 15 | + - text: "{{site.konnect_short_name}} Account, Pricing, and Organization Deactivation" |
| 16 | + url: /konnect-platform/konnect-account/ |
| 17 | +faqs: |
| 18 | + - q: What is required to manage users, teams, and roles in {{site.konnect_short_name}}? |
| 19 | + a: You must be part of the **Organization Admin team** to manage users, teams, and roles. |
| 20 | + - q: What is a team in {{site.konnect_short_name}}? |
| 21 | + a: A team is a group of users with access to the same roles. Teams allow assigning access to {{site.konnect_short_name}} resources based on roles. |
| 22 | + - q: What is a role in {{site.konnect_short_name}}? |
| 23 | + a: | |
| 24 | + A role defines predefined access to a particular resource or instances of a resource type. For example, API product roles can be scoped to a specific API product or all API products, while Control Plane roles can be scoped to a specific Control Plane or all Control Planes. |
| 25 | + - q: Can predefined teams in {{site.konnect_short_name}} be modified or deleted? |
| 26 | + a: No, predefined teams have fixed role sets that cannot be modified or deleted. |
| 27 | +--- |
| 28 | + |
| 29 | +To help secure and govern your environment, {{site.konnect_short_name}} provides |
| 30 | +the ability to manage authorization with teams and roles. You can use {{site.konnect_short_name}}'s |
| 31 | +predefined teams for a standard set of roles, or create custom teams with |
| 32 | +any roles you choose. Invite users and add them to these teams to manage user |
| 33 | +access. |
| 34 | + |
| 35 | +You must be part of the Organization Admin team to manage users, teams, and |
| 36 | +roles. |
| 37 | + |
| 38 | +{:.info} |
| 39 | +> **Note:** If the Okta integration is [enabled](/konnect-platform/konnect-sso/), |
| 40 | +{{site.konnect_short_name}} users and teams become read-only. An organization |
| 41 | +admin can view all registered users in {{site.konnect_short_name}}, but cannot |
| 42 | +edit their team membership from the {{site.konnect_short_name}} side. To manage |
| 43 | +automatically-created users, adjust user permissions through Okta, or |
| 44 | +[adjust team mapping](/konnect-platform/konnect-sso/). |
| 45 | + |
| 46 | +## Access precedence |
| 47 | + |
| 48 | +Users can be part of any number of teams, and the roles gained from the teams |
| 49 | +are additive. For example, if you add a user to both the Service Developer and |
| 50 | +Portal Viewer teams, the user can create and manage Services |
| 51 | +through API Products _and_ register applications through the Dev Portal. |
| 52 | + |
| 53 | +If two roles provide access to the same [entity](/gateway/entities/), the role with more access |
| 54 | +takes effect. For example, if you have the Service Admin and Service Deployer |
| 55 | +roles on the same Service, the Service Admin role takes precedence. |
| 56 | + |
| 57 | +## Geographic region assignment |
| 58 | + |
| 59 | +Teams and roles can be assigned to a specific [geographic region](/konnect-geos/) in {{site.konnect_short_name}}. Those teams and roles only access {{site.konnect_short_name}} objects, such as Services, that are also located in the same geo they are assigned to. |
| 60 | + |
| 61 | +## Teams |
| 62 | + |
| 63 | +A team is a group of users with access to the same roles. Teams are useful |
| 64 | +for assigning access by functionality, where they can provide granular access to |
| 65 | +any group of {{site.konnect_short_name}} resources based on roles. |
| 66 | + |
| 67 | +You can create and manage teams by navigating to [**Organization**](https://cloud.konghq.com/organization/) > **Teams** in {{site.konnect_short_name}}. |
| 68 | + |
| 69 | +### Predefined teams |
| 70 | + |
| 71 | +All new and existing organizations in {{site.konnect_short_name}} have predefined default teams. The default teams can't be modified or deleted. |
| 72 | + |
| 73 | +{% table %} |
| 74 | +columns: |
| 75 | + - title: Team |
| 76 | + key: team |
| 77 | + - title: Description |
| 78 | + key: description |
| 79 | +rows: |
| 80 | + - team: Analytics Admin |
| 81 | + description: Users can fully manage all [Analytics](/advanced-analytics/) content, which includes creating, editing, and deleting reports, as well as viewing the analytics summary. |
| 82 | + - team: Analytics Viewer |
| 83 | + description: Users can view the [Analytics](/advanced-analytics/) summary and report data. |
| 84 | + - team: Organization Admin |
| 85 | + description: Users can fully manage all entities and configuration in the organization. |
| 86 | + - team: Organization Admin (Read Only) |
| 87 | + description: Users can view all entities and configuration in the organization. |
| 88 | + - team: Portal Admin |
| 89 | + description: Users can fully manage all Dev Portal content, which includes {{site.konnect_short_name}} service pages and supporting content, as well as Dev Portal configuration and Service connections. <br> To manage app registration requests, members must also be assigned to the Admin or Maintainer roles for the corresponding Services. |
| 90 | + - team: API Product Admin |
| 91 | + description: Users can create and manage API products, including publishing API product versions to Dev Portal and enabling application registration. |
| 92 | + - team: API Product Developer |
| 93 | + description: Users can create and manage versions of API products. |
| 94 | + - team: Control Plane Admin |
| 95 | + description: Users can create and manage Control Planes. |
| 96 | +{% endtable %} |
| 97 | + |
| 98 | +## Roles |
| 99 | + |
| 100 | +Roles predefine access to a particular resource, or |
| 101 | +instances of a particular resource type (for example, API product roles can be scoped to a particular API product or all API products while Control Plane roles can be scoped to a particular Control Plane or all Control Planes). |
| 102 | + |
| 103 | +You can manage a user's roles by navigating to [**Organization**](https://cloud.konghq.com/organization/) > **Users** in {{site.konnect_short_name}} and clicking the **Role Assignments** tab for a user. |
| 104 | + |
| 105 | +### Predefined roles |
| 106 | + |
| 107 | +{{site.konnect_short_name}} provides the following predefined roles. |
| 108 | + |
| 109 | +#### API Products |
| 110 | + |
| 111 | +The following describes the predefined roles for API Products: |
| 112 | + |
| 113 | +<!-- vale off --> |
| 114 | +{% konnect_roles_table %} |
| 115 | +schema: api_products |
| 116 | +{% endkonnect_roles_table %} |
| 117 | +<!-- vale on --> |
| 118 | + |
| 119 | +#### Control Planes |
| 120 | + |
| 121 | +The following describes the predefined roles for Control Planes: |
| 122 | + |
| 123 | +<!-- vale off --> |
| 124 | +{% konnect_roles_table %} |
| 125 | +schema: control_planes |
| 126 | +{% endkonnect_roles_table %} |
| 127 | +<!-- vale on --> |
| 128 | + |
| 129 | +#### Audit logs |
| 130 | + |
| 131 | +The following describes the predefined roles for audit logs: |
| 132 | + |
| 133 | +<!-- vale off --> |
| 134 | +{% konnect_roles_table %} |
| 135 | +schema: audit_logs |
| 136 | +{% endkonnect_roles_table %} |
| 137 | +<!-- vale on --> |
| 138 | + |
| 139 | +#### Identity |
| 140 | + |
| 141 | +The following describes the predefined roles for identity: |
| 142 | + |
| 143 | +<!-- vale off --> |
| 144 | +{% konnect_roles_table %} |
| 145 | +schema: identity |
| 146 | +{% endkonnect_roles_table %} |
| 147 | +<!-- vale on --> |
| 148 | + |
| 149 | +#### Mesh control planes |
| 150 | + |
| 151 | +The following describes the predefined roles for Mesh: |
| 152 | + |
| 153 | +<!-- vale off --> |
| 154 | +{% konnect_roles_table %} |
| 155 | +schema: mesh_control_planes |
| 156 | +{% endkonnect_roles_table %} |
| 157 | +<!-- vale on --> |
| 158 | + |
| 159 | +#### Networks |
| 160 | + |
| 161 | +The following describes the predefined roles for networks: |
| 162 | + |
| 163 | +{% table %} |
| 164 | +columns: |
| 165 | + - title: Role |
| 166 | + key: role |
| 167 | + - title: Description |
| 168 | + key: description |
| 169 | +rows: |
| 170 | + - role: "`Network Admin`" |
| 171 | + description: Access to all read and write permissions related to a network. |
| 172 | + - role: "`Network Creator`" |
| 173 | + description: Access to creating networks. |
| 174 | + - role: "`Network Viewer`" |
| 175 | + description: Access to read-only permissions to networks. |
| 176 | +{% endtable %} |
| 177 | + |
| 178 | +#### Service Catalog |
| 179 | + |
| 180 | +The following describes the predefined roles for Service Catalog: |
| 181 | + |
| 182 | +{% table %} |
| 183 | +columns: |
| 184 | + - title: Role |
| 185 | + key: role |
| 186 | + - title: Description |
| 187 | + key: description |
| 188 | +rows: |
| 189 | + - role: "`Discovery Admin`" |
| 190 | + description: Access to all read and write permissions related to service discoveries. |
| 191 | + - role: "`Discovery Viewer`" |
| 192 | + description: Access to read-only permissions related to service discoveries. |
| 193 | + - role: "`Integration Admin`" |
| 194 | + description: Can view and edit all integrations (install/authorize). |
| 195 | + - role: "`Integration Viewer`" |
| 196 | + description: Access to read-only permissions to integrations. |
| 197 | + - role: "`Service Admin`" |
| 198 | + description: Can view and edit a select list of services, map resources to those services, and manage all resources and discovery rules. |
| 199 | + - role: "`Service Creator`" |
| 200 | + description: Can create new services, becomes the service admin for any service they create, and can view, edit, and create all resources and discovery rules. |
| 201 | + - role: "`Service Viewer`" |
| 202 | + description: Can view a select list of services and all resources and discovery rules. |
| 203 | +{% endtable %} |
| 204 | + |
| 205 | +#### Dev Portal |
| 206 | + |
| 207 | +The following describes the predefined roles for Dev Portal: |
| 208 | + |
| 209 | +{% table %} |
| 210 | +columns: |
| 211 | + - title: Role |
| 212 | + key: role |
| 213 | + - title: Description |
| 214 | + key: description |
| 215 | +rows: |
| 216 | + - role: "`Admin`" |
| 217 | + description: Owner of an existing Dev Portal instance. The owner has full write access related to any developers and applications in the organization. |
| 218 | + - role: "`Appearance Maintainer`" |
| 219 | + description: Access the Portal instance and edit its appearance. |
| 220 | + - role: "`Creator`" |
| 221 | + description: Create new Portals. |
| 222 | + - role: "`Maintainer`" |
| 223 | + description: Edit, view, and delete Dev Portal applications, and view developers. |
| 224 | + - role: "`Product Publisher`" |
| 225 | + description: Manage publishing products to a Dev Portal. |
| 226 | + - role: "`Viewer`" |
| 227 | + description: Read-only access to Dev Portal developers and applications. |
| 228 | +{% endtable %} |
| 229 | + |
| 230 | +#### Application auth strategies |
| 231 | + |
| 232 | +The following describes the predefined roles for application auth strategies: |
| 233 | + |
| 234 | +{% table %} |
| 235 | +columns: |
| 236 | + - title: Role |
| 237 | + key: role |
| 238 | + - title: Description |
| 239 | + key: description |
| 240 | +rows: |
| 241 | + - role: "`Creator`" |
| 242 | + description: Create new app auth strategies. |
| 243 | + - role: "`Maintainer`" |
| 244 | + description: Edit one or all app auth strategies. |
| 245 | + - role: "`Viewer`" |
| 246 | + description: Read-only access to one or all app auth strategies. |
| 247 | +{% endtable %} |
| 248 | + |
| 249 | + |
| 250 | +#### DCR |
| 251 | + |
| 252 | +The following describes the predefined roles for dynamic client registration (DCR): |
| 253 | + |
| 254 | +{% table %} |
| 255 | +columns: |
| 256 | + - title: Role |
| 257 | + key: role |
| 258 | + - title: Description |
| 259 | + key: description |
| 260 | +rows: |
| 261 | + - role: "`Creator`" |
| 262 | + description: Create new DCR providers. |
| 263 | + - role: "`Maintainer`" |
| 264 | + description: Edit one or all DCR providers. |
| 265 | + - role: "`Viewer`" |
| 266 | + description: Read-only access to one or all DCR providers. |
| 267 | +{% endtable %} |
| 268 | + |
0 commit comments