You signed in with another tab or window.Reload to refresh your session.You signed out in another tab or window.Reload to refresh your session.You switched accounts on another tab or window.Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: _docs/administration/account-user-management.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,8 +10,8 @@ Codefresh has comprehensive support for all aspects of administration for organi
10
10
Review:
11
11
12
12
{% if page.collection != site.gitops_collection %}
13
-
*[Add users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/)
14
-
* Configure access control for[pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/) and for[GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/)
13
+
*[Add users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/)
14
+
* Configure access control for[pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) and for[GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/)
15
15
*[Configure access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/)
16
16
*[Configure Single Sign-On (SSO)]({{site.baseurl}}/docs/administration/single-sign-on/)
17
17
* Get[audit logs]({{site.baseurl}}/docs/administration/account-user-management/audit/) for runtimes (hosted or private)
@@ -21,7 +21,7 @@ For on-premises environments, see [On-premises account and user setup]({{site.ba
21
21
{% endif %}
22
22
23
23
{% if page.collection == site.gitops_collection %}
24
-
*[Add users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/)
24
+
*[Add users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/)
25
25
*[Configure access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/)
26
26
*[Configure Single Sign-On (SSO)]({{site.baseurl}}/docs/administration/single-sign-on/)
@@ -38,7 +39,7 @@ Let's review the different access mechanisms in more detail, including privilege
38
39
39
40
##Role-based access for users and administrators
40
41
41
-
Role-based access is usually defined when you[add teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/#teams-in-codefresh) to accounts. Role-based access means assigning either a user or an administrator role.
42
+
Role-based access is usually defined when you[add teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/#teams-in-codefresh) to accounts. Role-based access means assigning either a user or an administrator role.
42
43
43
44
>**NOTE**
44
45
Only a user with an administrator role can add other users, and assign or change user roles.
@@ -248,7 +249,7 @@ Also review our examples in [Creating rules for pipelines by project tags](#crea
248
249
249
250
#####Before you begin
250
251
Make sure you have:
251
-
*[Created at least one team]({{site.baseurl}}/docs/administration/account-user-management/add-users/#teams-in-codefresh)
252
+
*[Created at least one team]({{site.baseurl}}/docs/administration/account-user-management/add-user-teams/#teams-in-codefresh)
252
253
* Reviewed[CRUD privileges for entities/resources](#crud-privileges-for-entitiesresources)
253
254
* Added tags for all entities, except pipelines
254
255
@@ -385,7 +386,7 @@ We want:
385
386
386
387
**Step 1: Set up the teams**
387
388
The first step is to create the teams, and add the users you want to each team.
388
-
See[Teams in Codefresh]({{site.baseurl}}/docs/administration/account-user-management/add-users/#teams-in-codefresh).
389
+
See[Teams in Codefresh]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/#teams-in-codefresh).
389
390
390
391
If you have already created the DevOps and Users teams, you'll need to create the Marvel team.
391
392
@@ -624,6 +625,7 @@ By default, if configured for the account, users can also load pipeline definiti
624
625
625
626
626
627
##Related articles
628
+
[Access control for user accounts]({{site.baseurl}}/docs/administration/account-user-management/access-control-user-accounts)
627
629
[Codefresh Provider for Terraform](https://registry.terraform.io/providers/codefresh-io/codefresh/latest/docs){:target="\_blank"}
628
630
[Managing your Kubernetes cluster]({{site.baseurl}}/docs/deployments/kubernetes/manage-kubernetes/)
description:"Define session timeouts and domain restrictions for all users"
4
+
toc:true
5
+
---
6
+
7
+
##User account access control
8
+
9
+
You can configure general access control settings that apply to all users in your Codefresh account. These include enforcing automatic logout after periods of inactivity, and restricting invitations to approved email domains. These controls help enforce organizational security policies across the platform.
10
+
11
+
##Define access controls for user accounts
12
+
13
+
Define sessions timeouts and email domain restrictions for all users in the account.
14
+
15
+
>**NOTE**
16
+
>The maximum duration for inactivity is 30 days. Inactive users are warned 15 minutes before they are logged out.
17
+
18
+
1. In the Codefresh UI, on the toolbar, click the**Settings** icon.
19
+
1. From the sidebar, select**Access Control**.
20
+
1.**User Session**: Define the maximum duration for inactivity in minutes/hours/days before enforcing a timeout.
21
+
1.**User Invitation**:
22
+
* To restrict invitations to specific email domains, turn on**Restrict inviting additional users..**
23
+
* In the**Email domains** field, type in the domains to allow, one per line.
Once you have created a Codefresh account, you can add any number of users to collaborate on repositories, entities, and processes.
16
+
15
17
{% if page.collection != site.gitops_collection %}
16
18
For Codefresh on-premises, see[On-premises account & user setup]({{site.baseurl}}/docs/installation/on-premises/on-prem-configuration/).
17
19
{% endif %}
18
20
19
-
You can then create teamsin Codefreshto group users who share a common denominator, such as the same permissions, access to the same functionality, or roles. Teams make it easy for administrators to both define and manage items shared by multiple users in an organization.
21
+
You can then create teams to group users who share a common denominator, such as the same permissions, access to the same functionality, or roles. Teams make it easy for administrators to both define and manage items shared by multiple users in an organization.
20
22
21
23
##Users in Codefresh
22
24
23
25
Adding a user to an account requires assigning a role to define access to account resources, and optionally, selecting an SSO provider for the user:
24
26
27
+
***Email address**: The user's company email address.
25
28
***Role**: Defines the user's access level to the resources in the account.
26
29
***User**: The default. With this role, users can work with repositories and entities, but cannot change configuration settings.
27
30
***Administrator**: With this role, users have full access to accounts, and can change all settings, so make sure that they are trusted colleagues.
28
31
{% if page.collection != site.gitops_collection %}
29
-
For guidelines on access control, see[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/) and[Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/).
32
+
For guidelines on access control, see[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) and[Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/).
30
33
{% endif %}
31
34
{% if page.collection == site.gitops_collection %}
32
-
For guidelines on access control, see[Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/).
35
+
For guidelines on access control, see[Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/).
33
36
{% endif %}
34
37
***SSO**: By default, SSO is not enabled for users. If required, explicitly select the SSO provider. For an overview of SSO, see[About Federated Single Sign-on]({{site.baseurl}}/docs/administration/single-sign-on/).
35
38
36
39
###Add a user to a Codefresh account
37
40
38
-
1. In the Codefresh UI, on the toolbar, click the**Settings** icon and then select**Account Settings**.
39
-
1. From the sidebar select**Users & Teams**.
40
-
1. Select**Users**, and then select**+[Add User]**.
41
-
1. Type the**User's email address**, and click**Invite**.
41
+
1. In the Codefresh UI, on the toolbar, click the**Settings** icon.
42
+
1. From the sidebar select**Users**, and then click**Add User**.
43
+
1. Add the user's**Email address**.
42
44
<!---add screenshot-->
43
-
The user receives an email invitation, and in the Users list, the username is set to Pending, and status to Resend.
44
-
1. From the**Role** dropdown, select either**User** or**Administrator**.
45
-
1. If SSO is configured for the account,**Select SSO provider**.
45
+
1. From**Assign a role**, select either**Administrator** or**User**.
46
+
1. If SSO is configured for the account,**Select the SSO provider** from the list.
46
47
47
48
###Manage users in a Codefresh account
48
49
49
-
Once you add a user to your Codefresh account, you can do the following to manage that user:
50
-
51
-
* Resend invitations that are pending acceptance: Select**Resend**.
52
-
* Edit the user's email address: Select**Edit**.
53
-
* Change the role: From the**Role** dropdown, select the new role.
54
-
* Change SSO provider: From the**SSO** dropdown, select the new SSO provider.
55
-
* Remove the user account: Select**Delete**.
50
+
Once you add a user to your Codefresh account, you have the following options in the context menu of the user in the Users page.
51
+
***Edit**: Edit user's email address, change the role, or select a new SSO provider.
52
+
***Delete**: Remove the user account.
56
53
57
54
##Teams in Codefresh
58
55
59
-
Teams are users who share the same permissions, roles, or requirements defined according to company processes. Teams allow you to enforce access control through ABAC (Attribute Based Access Control).
60
-
61
-
By default, there are two teams:
56
+
Teams are users who share the same permissions, roles, or requirements, defined according to company processes.
57
+
You first create a team and then invite users to it. You can then view the service accounts the user is assigned to, if any.
62
58
59
+
{% if page.collection != site.gitops_collection %}
63
60
* Users
64
61
* Admins with users[invited as collaborators](#assign-a-user-to-a-team)
65
-
<!--- is this correct?-->
62
+
66
63
>**NOTE**
67
64
>Only Enterprise customers can add new teams. Other Codefresh plans can only use the predefined*Users* and*Admin* teams.[Contact us](https://codefresh.io/contact-us/){:target="\_blank"} to upgrade to an Enterprise plan.
68
65
69
-
{% if page.collection != site.gitops_collection %}
66
+
70
67
###Automatically creating projects for teams
71
68
72
69
As part of the global pipeline settings for an account, when creating a team, you can also automatically create a project and a project tag with the same name as that of the team. Enabling**auto-create projects for teams** (disabled by default), simplifies permissions setup for pipelines and projects, as it also creates a Read rule for the project. See[Auto-create projects for teams]({{site.baseurl}}/docs/pipelines/configuration/pipeline-settings/#auto-create-projects-for-teams).
73
-
{% endif %}
74
70
75
-
###Create a team in Codefresh
71
+
{% endif %}
76
72
77
-
Createa team in Codefresh and then assign users to the team. You can assign the same user to multipleteams, asinmost companies, users have overlapping roles.
73
+
###Create teamsinCodefresh
78
74
79
-
1. In the Codefresh UI, on the toolbar, click the**Settings** icon and then select**User Management**.
80
-
1.From thesidebar, select**Users & Teams**.
81
-
1.Select**Teams**, and thenselect**Create a Team**.
82
-
1. Enter the**Team Name**.
75
+
Create multiple teams in Codefresh.
76
+
1.In theCodefresh UI, on the toolbar, click the**Settings** icon.
77
+
1.From the sidebar, select**Teams**, and thenclick**Add Team**.
78
+
1. Enter the**Team Name** and click**Create**.
83
79
>**NOTE**
84
80
>The team name can include only lower-case alphanumeric characters and hyphens, without spaces.
85
81
86
-
See the screenshot below for some sample team names.
1. Hover over the team name and click the**Settings** icon.
101
-
1. Click**Invite to team**, type the email address of the user to invite, and then click**Add**.
102
-
1. To change the name of the team, click**Edit** and type the new name.
85
+
###Assign users to teams
86
+
Add one or more users to a team. You can assign the same user to multiple teams, as in most companies, users have overlapping roles.
103
87
104
-
##Define session timeouts and domain restrictions for user accounts
88
+
1. In the Codefresh UI, on the toolbar, click the**Settings** icon.
89
+
1. From the sidebar, select**Teams**, and then click the team to which to add users.
90
+
1. Click**Add to team**, and select the user from the list.
91
+
1. Click**Add**.
92
+
93
+
###Manage teams and users
94
+
95
+
You can change the name of the team, delete the team, or remove users from a team .
96
+
97
+
***Remove user from team**: Click the team name and from the user's context menu, select** user's email address, change the role, or select a new SSO provider.
98
+
***Delete**: Remove the user account.
105
99
106
-
As an administrator, you can optionally define session timeouts to automatically log out users who have been inactive for the specified duration, and restrict invitations to specific email domains.
107
100
108
-
>**NOTE**
109
-
>The maximum duration for inactivity is 30 days. Inactive users are warned 15 minutes before they are logged out.
110
-
111
-
1. In the Codefresh UI, on the toolbar, click the**Settings** icon, and then select**Account Settings**.
112
-
1. From the sidebar, select**Users & Teams**.
113
-
1. Select**Security**.
114
-
1. For**User Session**, add the timeout duration in minutes/hours/days.
115
-
1. To restrict invitations to specific email domains, below User Invitations, turn on**Restrict inviting additional users..** and then in the**Email domains**, type in the domains to allow, one per line.