# Authorization

These sections show you how to configure the authorization of AxoConsole with different authentication backends.

Authorization is configured in the `kcp.rbac.roles` section of `/var/lib/rancher/k3s/server/manifests/axoflow-config.yaml`.

## Default configuration

The installer sets up the following default role bindings, which grant full access to users in the `admin` group of your identity provider:
```
 
    kcp:
      rbac:
        roles:
          IAMadmin:
            groups:
              - "groups:admin"
          admin:
            groups:
              - "groups:admin"
    
```

Verify that this matches your requirements by checking the file:
```
 
    grep -A20 'rbac:' /var/lib/rancher/k3s/server/manifests/axoflow-config.yaml
    
```

## Available roles

The following roles are available in AxoConsole by default:

  * `IAMadmin`: Can manage the roles and permissions to access AxoConsole. Only this role can make changes on the **Settings > Roles** page.

  * `admin`: Has full access to AxoConsole, but has only read access to the **Settings > Roles** page.

  * `infrastructureManager`: Can manage the infrastructure (without the permissions to view or tap log contents, or to rehydrate data). Has full access to the following pages: **Activity Logs** , **Alerting** , **Routers** , **Sources** , **Flows** , **Provisioning** , **Search Logs**. Can tap into service logs which may contain event payload.

  * `infrastructureViewer`: Similar to **infrastructure-manager** , but can only view the pages.

  * `contentManager`: Can view log content and manage content related details like flows (without the permissions to manage infrastructure, but including access to view infrastructure details).

    * Has full access to the **Rehydration** page.
    * Can view and modify **Flows** , but can’t create or delete them.
    * Can view **Routers** , **Sources** , **Search Logs** , **Analytics**.
    * Can tap into logs.
  * `contentViewer`: Can view content like analytics, log search, log tapping (without the permissions to manage or view infrastructure details).

    * Can view **Search Logs** , **Analytics**.
    * Can tap into logs.



If you need other roles, [contact the Axoflow support team](<https://axoflow.com/contact?contact_form_subject=support_request>). Composing other roles is possible as part of a custom integration.

## Customize role bindings

To assign additional groups to a role, add them to the `groups` list. The group format depends on your authentication backend:

  * Built-in identity provider (axoidp) and LDAP: `groups:<group-name>`
  * Email domain: `emaildomain:<domain>`



Edit the manifest and save — k3s picks up the change automatically:
```
 
    sudo vi /var/lib/rancher/k3s/server/manifests/axoflow-config.yaml
    
```