|
| 1 | +--- |
| 2 | +products: oss-enterprise, cloud-teams |
| 3 | +--- |
| 4 | + |
| 5 | +# RBAC Role Mapping |
| 6 | + |
| 7 | +Role-Based Access Control (RBAC) role mapping allows automatic assignment of specific permissions to Airbyte users based on existing roles in your organization. It ensures users have appropriate Airbyte access without manual oversight. RBAC functionality is only available in Airbyte Teams and Self-Managed Enterprise. |
| 8 | + |
| 9 | +Enabling role mapping in Airbyte requires use of the Airbyte API. The Airbyte API exposes endpoints that allow you to retrieve and update user permissions. These endpoints can be used to build automation that manages user access to different workspaces. This functionality is currently limited to the Airbyte API, and is not available in the Terraform Provider. |
| 10 | + |
| 11 | +To enable the Airbyte API in Airbyte Teams or Self-Managed Enterprise, follow these [prerequisites](../enterprise-setup/api-access-config.md). |
| 12 | + |
| 13 | +## Relevant API Endpoints |
| 14 | + |
| 15 | +Organization-wide permissions and each set of workspace permissions each count as their own permission object. For example, if an Airbyte user is an 'Organization Member' and has 'Workspace Editor' access in 3 distinct workspaces, this user has 4 permissions in total. |
| 16 | + |
| 17 | +1. [Get a list of current Airbyte users in your organization](https://reference.airbyte.com/reference/listuserswithinanorganization). |
| 18 | +2. [Get a list of current Airbyte workspaces](https://reference.airbyte.com/reference/listworkspaces). |
| 19 | +2. [Create a permission for an Airbyte user to access to a new workspace](https://reference.airbyte.com/reference/createpermission). |
| 20 | +3. [Get a list of a user's current permissions](https://reference.airbyte.com/reference/listpermissions). |
| 21 | +3. [Modify permission scope or level of access](https://reference.airbyte.com/reference/updatepermission). |
| 22 | +4. [Delete a permission](https://reference.airbyte.com/reference/deletepermission). |
| 23 | + |
| 24 | +## Script Example |
| 25 | + |
| 26 | +### Prerequisites |
| 27 | + |
| 28 | +1. A mapping of user emails to your company-specific roles (e.g. `finance-team`, `security-team`, `us-employee`, etc.): |
| 29 | + |
| 30 | +```yaml |
| 31 | +{ |
| 32 | +"user1@company.com": ["companyGroup1", "companyGroup2"], |
| 33 | +"user1@company.com": ["companyGroup2", "companyGroup3"] |
| 34 | +} |
| 35 | +``` |
| 36 | + |
| 37 | +2. A mapping of your company-specific roles to desired Airbyte permissions: |
| 38 | + |
| 39 | +```yaml |
| 40 | +{ |
| 41 | + "companyGroup1": [ |
| 42 | + { |
| 43 | + "scope": "workspace", |
| 44 | + "scopeId": "11111111-11111111-11111111-11111111", |
| 45 | + "permissionType": "workspace_admin" |
| 46 | + }, |
| 47 | + { |
| 48 | + "scope": "workspace", |
| 49 | + "scopeId": "22222222-22222222-22222222-22222222", |
| 50 | + "permissionType": "workspace_reader" |
| 51 | + } |
| 52 | + ], |
| 53 | + "companyGroup2": [ |
| 54 | + { |
| 55 | + "scope": "workspace", |
| 56 | + "scopeId": "33333333-33333333-33333333-33333333", |
| 57 | + "permissionType": "workspace_reader" |
| 58 | + } |
| 59 | + ] |
| 60 | +} |
| 61 | +``` |
| 62 | +Notes: |
| 63 | +- `scope` must be set to either 'workspace' or 'organization'. |
| 64 | +- `scopeId` must the identifier of scope access is granted for. It is a GUID and for organization scope is always '00000000-00000000-00000000-00000000'. For workspace, refer to the UI and the output of a list workspace to identify your workspaceId. |
| 65 | +- `permissionType` must be set to a valid value, e.g. 'workspace_admin', 'workspace_reader', 'organization_admin', etc. All valid values are listed [here](https://github.com/airbytehq/airbyte-api-python-sdk/blob/main/src/airbyte_api/models/publicpermissiontype.py). |
| 66 | + |
| 67 | +### Complete Python Script |
| 68 | + |
| 69 | +Below is an example Python script using the above prerequisite files and the `airbyte-api` Python package to set user roles programmatically: |
| 70 | + |
| 71 | +<details> |
| 72 | +<summary>RBAC Role Mapping Python Example</summary> |
| 73 | + |
| 74 | +```python |
| 75 | +import json |
| 76 | +import airbyte_api |
| 77 | +from airbyte_api import api, models |
| 78 | + |
| 79 | +usersGroupsFile = open('usersGroups.json') |
| 80 | +usersGroups = json.load(usersGroupsFile) |
| 81 | +groupPermissionsFile = open('groupPermissions.json') |
| 82 | +groupPermissions = json.load(groupPermissionsFile) |
| 83 | + |
| 84 | +# 0. - Enter your own credentials to use Airbyte API. |
| 85 | +s = airbyte_api.AirbyteAPI( |
| 86 | + security=models.Security( |
| 87 | + bearer_auth='...' |
| 88 | + ), |
| 89 | +) |
| 90 | + |
| 91 | +# 1. - List all users in your organization. Find your organization ID in the Airbyte settings page. |
| 92 | +res = s.users.list_users(request=api.ListUsersRequest( |
| 93 | + api.ListUsersRequest(organization_id='00000000-00000000-00000000-00000000') |
| 94 | +)) |
| 95 | + |
| 96 | +allAirbyteUsers = res.users_response.data |
| 97 | +print("all users: ", allAirbyteUsers) |
| 98 | + |
| 99 | +# 2. grant permissions |
| 100 | +# for each user |
| 101 | +for airbyteUserResponse in allAirbyteUsers: |
| 102 | + if airbyteUserResponse.email in usersGroups: |
| 103 | + userGroups = usersGroups[airbyteUserResponse.email] |
| 104 | + # for each group where user belongs to |
| 105 | + for group in userGroups: |
| 106 | + if group in groupPermissions: |
| 107 | + permissionsToGrant = groupPermissions[group] |
| 108 | + # for each permission to create |
| 109 | + for permission in permissionsToGrant: |
| 110 | + print("permission to grant: ", permission) |
| 111 | + if permission["scope"] == "workspace": |
| 112 | + # create workspace level permission |
| 113 | + permissionCreated = s.permissions.create_permission( |
| 114 | + request=models.PermissionCreateRequest( |
| 115 | + permission_type=permission["permissionType"], |
| 116 | + user_id=airbyteUserResponse.user_id, |
| 117 | + workspace_id=permission["scopeId"] |
| 118 | + )) |
| 119 | + elif permission["scope"] == "organization": |
| 120 | + # create organization permission |
| 121 | + permissionCreated = s.permissions.create_permission( |
| 122 | + request=models.PermissionCreateRequest( |
| 123 | + permission_type=permission["permissionType"], |
| 124 | + user_id=airbyteUserResponse.user_id, |
| 125 | + organization_id=permission["scopeId"] |
| 126 | + )) |
| 127 | + else: |
| 128 | + print("permission scope not supported!") |
| 129 | +``` |
| 130 | + |
| 131 | +</details> |
| 132 | + |
| 133 | +Please feel free to add your own logging and error-handling workflow in the example script, and you are free to configure it on a CRON job to run at the frequency of your choice. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?v=4&size=40){kind=avatar}
0 commit comments