Authorization

These sections show you how to configure the authorization of AxoConsole with different authentication backends.

Authorization is configured in the kcp.rbac.roles section of /var/lib/rancher/k3s/server/manifests/axoflow-config.yaml.

Default configuration

The installer sets up the following default role bindings, which grant full access to users in the admin group of your identity provider:

kcp:
  rbac:
    roles:
      IAMadmin:
        groups:
          - "groups:admin"
      admin:
        groups:
          - "groups:admin"

Verify that this matches your requirements by checking the file:

grep -A20 'rbac:' /var/lib/rancher/k3s/server/manifests/axoflow-config.yaml

Available roles

The following roles are available in AxoConsole by default:

• IAMadmin: Can manage the roles and permissions to access AxoConsole. Only this role can make changes on the Settings > Roles page. If your identity provider has an administration page, this role can also see the Identity Provider Admin Panel link to it on the Settings > Roles page. (If your identity provider has a profile page, every user can open their own profile by selecting <their username> > Profile in the top-right corner.)

• admin: Has full access to AxoConsole, except:

  • Has only read access to the Settings > Roles page.
  • Can’t search logs in stores. Searching requires the logSearcher role, or an access role to the specific store.

• infrastructureManager: Can manage the infrastructure (without the permissions to view or tap log contents, or to rehydrate data). Has full access to the following pages: Activity Logs, Alerting, Routers, Sources, Flows, Provisioning, Search Logs. Can tap into service logs which may contain event payload.

• infrastructureViewer: Similar to infrastructure-manager, but can only view the pages.

• contentManager: Can view log content and manage content related details like flows (without the permissions to manage infrastructure, but including access to view infrastructure details).

  • Has full access to the Rehydration page.
  • Can view and modify Flows, but can’t create or delete them.
  • Can view Routers, Sources, Search Logs, Analytics.
  • Can tap into logs.

• contentViewer: Can view content like analytics, log search, log tapping (without the permissions to manage or view infrastructure details).

  • Can view Search Logs, Analytics.
  • Can tap into logs.

• logSearcher: Can search in every store. You can also grant access to specific stores.

If you need other roles, contact the Axoflow support team. Composing other roles is possible as part of a custom integration.

Customize role bindings

To assign additional groups to a role, add them to the groups list. The group format depends on your authentication backend:

• Built-in identity provider (axoidp) and LDAP: groups:<group-name>
• Email domain: emaildomain:<domain>

Edit the manifest and save — k3s picks up the change automatically:

sudo vi /var/lib/rancher/k3s/server/manifests/axoflow-config.yaml