mirror of
https://github.com/grafana/grafana.git
synced 2026-07-29 15:59:50 -05:00
Docs: refactored manage users and permissions content (#44343)
* initial refactor * initial draft for teams * restructed topics, added front matter * modified aliases * removes old files * removed files * initial refactor * initial draft for teams * restructed topics, added front matter * modified aliases * removes old files * removed files * final xrefs updates * xref adjustment * copy updates * copy and content updates to about, add to org, add user, admin * copy updates to remove user from org * update org vs server admin section names, cross-link * cross-link add and invite users to org * add remaining cross-links between org and server admin * add dashboard permissions table * add permissions information to teams * add copy invite instructions to invite management * tweaks and link updates * incorporated PM feedback * fixed xrefs * yarn prettier * fix codespell * combined teams and dashboard permissions content Co-authored-by: Mitchel Seaman <mitchel.seaman@gmail.com>
This commit is contained in:
Christopher Moyer
co-authored by
Mitchel Seaman
Mitchel Seaman
parent
d665306ad1
commit
46360ca0c3
@@ -10,7 +10,7 @@ weight = 100
|
||||
> **Note:** Fine-grained access control is in beta, and you can expect changes in future releases.
|
||||
|
||||
Fine-grained access control provides a standardized way of granting, changing, and revoking access when it comes to viewing and modifying Grafana resources, such as users and reports.
|
||||
Fine-grained access control works alongside the current [Grafana permissions]({{< relref "../../permissions/_index.md" >}}), and it allows you granular control of users’ actions.
|
||||
Fine-grained access control works alongside the current Grafana permissions, and it allows you granular control of users’ actions. For more information about Grafana permissions, refer to [About users and permissions]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md" >}}).
|
||||
|
||||
To learn more about how fine-grained access control works, refer to [Roles]({{< relref "./roles.md" >}}) and [Permissions]({{< relref "./permissions.md" >}}).
|
||||
To use the fine-grained access control system, refer to [Fine-grained access control usage scenarios]({{< relref "./usage-scenarios.md" >}}).
|
||||
@@ -28,7 +28,7 @@ Refer to [Assign roles]({{< relref "./roles.md#assign-roles" >}}) to learn about
|
||||
Fine-grained access control is available for the following capabilities:
|
||||
|
||||
- [Use Explore mode]({{< relref "../../explore/_index.md" >}})
|
||||
- [Manage users]({{< relref "../../manage-users/_index.md" >}})
|
||||
- [Manage users]({{< relref "../../administration/manage-users-and-permissions/manage-server-users/_index.md" >}})
|
||||
- [Manage LDAP authentication]({{< relref "../../auth/ldap/_index.md" >}})
|
||||
- [Manage data sources]({{< relref "../../datasources/_index.md" >}})
|
||||
- [Manage data source permissions]({{< relref "../datasource_permissions.md" >}})
|
||||
|
||||
@@ -43,9 +43,9 @@ The reference information that follows complements conceptual information about
|
||||
|
||||
## Default built-in role assignments
|
||||
|
||||
| Built-in role | Associated role | Description |
|
||||
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Grafana Admin | `fixed:roles:reader`<br>`fixed:roles:writer`<br>`fixed:users:reader`<br>`fixed:users:writer`<br>`fixed:org.users:reader`<br>`fixed:org.users:writer`<br>`fixed:ldap:reader`<br>`fixed:ldap:writer`<br>`fixed:stats:reader`<br>`fixed:settings:reader`<br>`fixed:settings:writer`<br>`fixed:provisioning:writer`<br>`fixed:organization:reader`<br>`fixed:organization:maintainer`<br>`fixed:licensing:reader`<br>`fixed:licensing:writer` | Default [Grafana server administrator]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) assignments. |
|
||||
| Admin | `fixed:reports:reader`<br>`fixed:reports:writer`<br>`fixed:datasources:reader`<br>`fixed:datasources:writer`<br>`fixed:organization:writer`<br>`fixed:datasources.permissions:reader`<br>`fixed:datasources.permissions:writer`<br>`fixed:teams:writer`<br> | Default [Grafana organization administrator]({{< relref "../../permissions/organization_roles.md" >}}) assignments. |
|
||||
| Editor | `fixed:datasources:explorer` and <br> `fixed:teams:creator` if the `editors_can_admin` configuration flag is enabled | Default [Editor]({{< relref "../../permissions/organization_roles.md" >}}) assignments. |
|
||||
| Viewer | `fixed:datasources:id:reader`<br>`fixed:organization:reader` | Default [Viewer]({{< relref "../../permissions/organization_roles.md" >}}) assignments. |
|
||||
| Built-in role | Associated role | Description |
|
||||
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Grafana Admin | `fixed:roles:reader`<br>`fixed:roles:writer`<br>`fixed:users:reader`<br>`fixed:users:writer`<br>`fixed:org.users:reader`<br>`fixed:org.users:writer`<br>`fixed:ldap:reader`<br>`fixed:ldap:writer`<br>`fixed:stats:reader`<br>`fixed:settings:reader`<br>`fixed:settings:writer`<br>`fixed:provisioning:writer`<br>`fixed:organization:reader`<br>`fixed:organization:maintainer`<br>`fixed:licensing:reader`<br>`fixed:licensing:writer` | Default [Grafana server administrator]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#grafana-server-administrators" >}}) assignments. |
|
||||
| Admin | `fixed:reports:reader`<br>`fixed:reports:writer`<br>`fixed:datasources:reader`<br>`fixed:datasources:writer`<br>`fixed:organization:writer`<br>`fixed:datasources.permissions:reader`<br>`fixed:datasources.permissions:writer`<br>`fixed:teams:writer`<br> | Default [Grafana organization administrator]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) assignments. |
|
||||
| Editor | `fixed:datasources:explorer` and <br> `fixed:teams:creator` if the `editors_can_admin` configuration flag is enabled | Default [Editor]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) assignments. |
|
||||
| Viewer | `fixed:datasources:id:reader`<br>`fixed:organization:reader` | Default [Viewer]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) assignments. |
|
||||
|
||||
@@ -7,7 +7,7 @@ weight = 115
|
||||
|
||||
# Manage role assignments
|
||||
|
||||
To grant or revoke access to your users, you can assign [Roles]({{< relref "../roles.md" >}}) to users and teams, or to [Organization roles]({{< relref "../../../permissions/organization_roles.md" >}}) and [Grafana Server Admin]({{< relref "../../../permissions/_index.md#grafana-server-admin-role" >}}) role.
|
||||
To grant or revoke access to your users, you can assign [Roles]({{< relref "../roles.md" >}}) to users and teams, or to [Organization roles]({{< relref "../../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) and the [Grafana Server Admin]({{< relref "../../../administration/manage-users-and-permissions/about-users-and-permissions.md#grafana-server-administrators" >}}) role.
|
||||
|
||||
The following pages provide more information on how to manage role assignments:
|
||||
|
||||
|
||||
+2
-1
@@ -7,7 +7,8 @@ weight = 210
|
||||
|
||||
# Built-in role assignments
|
||||
|
||||
To control what your users can access or not, you can assign or unassign [Custom roles]({{< ref "#custom-roles" >}}) or [Fixed roles]({{< ref "#fixed-roles" >}}) to the existing [Organization roles]({{< relref "../../../permissions/organization_roles.md" >}}) or to [Grafana Server Admin]({{< relref "../../../permissions/_index.md#grafana-server-admin-role" >}}) role.
|
||||
To control what your users can access or not, you can assign or unassign [Custom roles]({{< ref "#custom-roles" >}}) or [Fixed roles]({{< ref "#fixed-roles" >}}) to the existing [Organization roles]({{< relref "../../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) or to the [Grafana Server Admin]({{< relref "../../../administration/manage-users-and-permissions/about-users-and-permissions.md#grafana-server-administrators" >}}) role.
|
||||
|
||||
These assignments are called built-in role assignments.
|
||||
|
||||
During startup, Grafana will create default assignments for you. When you make any changes to the built-on role assignments, Grafana will take them into account and won’t overwrite during next start.
|
||||
|
||||
@@ -7,7 +7,7 @@ weight = 105
|
||||
|
||||
# Roles
|
||||
|
||||
A role represents set of permissions that allow you to perform specific actions on Grafana resources. Refer to [Permissions]({{< relref "./permissions.md" >}}) to understand how permissions work.
|
||||
A role represents set of permissions that allow you to perform specific actions on Grafana resources. Refer to [About users and permissions]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md" >}}) to understand how permissions work.
|
||||
|
||||
There are two types of roles:
|
||||
|
||||
@@ -81,7 +81,7 @@ Note that you won't be able to create, update or delete a custom role with permi
|
||||
|
||||
## Assign roles
|
||||
|
||||
[Custom roles]({{< ref "#custom-roles" >}}) and [Fixed roles]({{< ref "#fixed-roles" >}}) can be assigned to users, the existing [Organization roles]({{< relref "../../permissions/organization_roles.md" >}}) and to [Grafana Server Admin]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) role.
|
||||
[Custom roles]({{< ref "#custom-roles" >}}) and [Fixed roles]({{< ref "#fixed-roles" >}}) can be assigned to users, the existing [Organization roles]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) and to the [Grafana Server Admin]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#grafana-server-administrators" >}}) role.
|
||||
|
||||
Visit [Manage role assignments]({{< relref "manage-role-assignments/_index.md" >}}) page for more details.
|
||||
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
+++
|
||||
title = "Data source permissions"
|
||||
description = "Grafana Datasource Permissions Guide "
|
||||
description = "Grafana Datasource Permissions Guide"
|
||||
aliases = ["docs/sources/permissions/datasource_permissions.md"]
|
||||
keywords = ["grafana", "configuration", "documentation", "datasource", "permissions", "users", "teams", "enterprise"]
|
||||
weight = 500
|
||||
+++
|
||||
@@ -18,7 +19,7 @@ Data source permissions allow you to restrict access for users to query a data s
|
||||
By default, data sources in an organization can be queried by any user in that organization. For example, a user with the `Viewer` role can issue any possible query to a data source, not just
|
||||
queries that exist on dashboards they have access to.
|
||||
|
||||
When permissions are enabled for a data source in an organization, you restrict admin and query access for that data source to [admin users]({{< relref "../permissions/organization_roles/#admin-role" >}}) in that organization.
|
||||
When permissions are enabled for a data source in an organization, you restrict admin and query access for that data source to admin users in that organization.
|
||||
|
||||
**Enable permissions for a data source:**
|
||||
|
||||
|
||||
@@ -38,10 +38,10 @@ Your Grafana license includes a maximum number of _Viewer_ and _Editor/Admin_ ac
|
||||
|
||||
You can assign role permissions _globally_ and restrict access to a specific dashboard or set of dashboards.
|
||||
|
||||
**Organization permissions**: When you create a user, you select a role on the user details page. Your selection applies to all Grafana dashboards within the Organization. For example, a user with the viewer role can see all dashboards, but cannot create or edit dashboards. For more information about user roles and permissions, refer to
|
||||
[Organization roles]({{< relref "../../permissions/organization_roles.md" >}}).
|
||||
**Organization permissions**: When you create a user, you select a role on the user details page. Your selection applies to all Grafana dashboards within the Organization. For example, a user with the viewer role can see all dashboards, but cannot create or edit dashboards. For more information about user roles and permissions, refer to [About users and permissions]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md" >}}).
|
||||
|
||||
**Dashboard permissions**: You can also assign permissions to dashboards or groups (folders) of dashboards. For example, you might want a viewer to also have editor permissions for a specific dashboard. While that user can see _all_ dashboards, they can only update one of them. For more information about dashboard permissions, refer to [Dashboard and Folder Permissions]({{< relref "../../permissions/dashboard-folder-permissions.md" >}}).
|
||||
**Dashboard permissions**: You can also assign permissions to dashboards or groups (folders) of dashboards. For example, you might want a viewer to also have editor permissions for a specific dashboard. While that user can see _all_ dashboards, they can only update one of them. For more information about dashboard permissions, refer to
|
||||
[Dashboard permissions]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#dashboard-permissions" >}}).
|
||||
|
||||
When you grant editor/admin dashboard permissions to a viewer, the editor/admin active-user count increases by one as shown on the **Utilization** panel of the **Statistics and licensing** page, and the user’s licensed role changes to editor/admin.
|
||||
|
||||
|
||||
@@ -47,7 +47,7 @@ To tell if a data source works with query caching, follow the instructions below
|
||||
|
||||
## Enable and configure query caching
|
||||
|
||||
You must be an Org admin or Grafana admin to enable query caching for a data source. For more information on Grafana roles and permissions, visit the [Permissions page]({{< relref "../permissions/_index.md" >}}).
|
||||
You must be an Org admin or Grafana admin to enable query caching for a data source. For more information on Grafana roles and permissions, refer to [About users and permissions]({{< relref "../administration/manage-users-and-permissions/about-users-and-permissions.md" >}}).
|
||||
|
||||
By default, data source queries are not cached. To enable query caching for a single data source:
|
||||
|
||||
|
||||
@@ -152,7 +152,7 @@ To use SAML Team sync, set [`assertion_attribute_groups`]({{< relref "./enterpri
|
||||
|
||||
> Only available in Grafana v7.0+
|
||||
|
||||
Role sync allows you to map user roles from an identity provider to Grafana. To enable role sync, configure role attribute and possible values for the [Editor]({{< relref "../permissions/organization_roles.md#editor-role" >}}), [Admin]({{< relref "../permissions/organization_roles.md#admin-role" >}}) and [Grafana Admin]({{< relref "../permissions/_index.md#grafana-admin" >}}) roles.
|
||||
Role sync allows you to map user roles from an identity provider to Grafana. To enable role sync, configure role attribute and possible values for the Editor, Admin, and Grafana Admin roles. For more information about user roles, refer to [About users and permissions]({{< relref "../administration/manage-users-and-permissions/about-users-and-permissions.md" >}}).
|
||||
|
||||
1. In the configuration file, set [`assertion_attribute_role`]({{< relref "./enterprise-configuration.md#assertion-attribute-role" >}}) option to the attribute name where the role information will be extracted from.
|
||||
1. Set the [`role_values_editor`]({{< relref "./enterprise-configuration.md#role-values-editor" >}}) option to the values mapped to the `Editor` role.
|
||||
@@ -161,7 +161,7 @@ Role sync allows you to map user roles from an identity provider to Grafana. To
|
||||
|
||||
If a user role doesn't match any of configured values, then the `Viewer` role will be assigned.
|
||||
|
||||
Refer to [Organization roles]({{< relref "../permissions/organization_roles.md" >}}) for more information about roles and permissions in Grafana.
|
||||
Refer to [About users and permissions]({{< relref "../administration/manage-users-and-permissions/about-users-and-permissions.md" >}}) for more information about roles and permissions in Grafana.
|
||||
|
||||
Example configuration:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user