mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-08 16:28:11 +00:00
improvement: minor doc adjustment and add new page to sidebar
This commit is contained in:
@@ -7,30 +7,30 @@ Infisical's Attribute-based Access Controls (ABAC) allow for dynamic, attribute-
|
|||||||
ABAC policies use metadata attributes—stored as key-value pairs on identities—to enforce fine-grained permissions that are context aware.
|
ABAC policies use metadata attributes—stored as key-value pairs on identities—to enforce fine-grained permissions that are context aware.
|
||||||
|
|
||||||
In ABAC, access controls are defined using metadata attributes, such as location or department, which can be set directly on user or machine identities.
|
In ABAC, access controls are defined using metadata attributes, such as location or department, which can be set directly on user or machine identities.
|
||||||
During policy execution, these attributes are evaluated, and determine whether said actor can gain access to requested resource.
|
During policy execution, these attributes are evaluated, and determine whether said actor can access the requested resource or perform the requested operation.
|
||||||
|
|
||||||
## Project-level Permissions
|
## Project-level Permissions
|
||||||
|
|
||||||
Attribute based access control is currently available for polices defined on projects. You can set ABAC permissions to control access to environments, folders, secrets, and secret tags.
|
Attribute-based access controls are currently available for polices defined on projects. You can set ABAC permissions to control access to environments, folders, secrets, and secret tags.
|
||||||
|
|
||||||
### Setting Metadata on Identities
|
### Setting Metadata on Identities
|
||||||
|
|
||||||
<Tabs>
|
<Tabs>
|
||||||
<Tab title="Manually configure metadata">
|
<Tab title="Manually Configure Metadata">
|
||||||
<Steps>
|
<Steps>
|
||||||
<Step title="Navigate to access control at the organizations setting and choose a identity (user or machine)">
|
<Step title="Navigate to the Access Control page on the organization sidebar and select an identity (user or machine).">
|
||||||
<img src="images/platform/access-controls/add-metadata-step1.png" />
|
<img src="images/platform/access-controls/add-metadata-step1.png" />
|
||||||
</Step>
|
</Step>
|
||||||
<Step title="Click on the pencil to edit the selected identity">
|
<Step title="On the Identity Page, click the pencil icon to edit the selected identity.">
|
||||||
<img src="images/platform/access-controls/add-metadata-step2.png" />
|
<img src="images/platform/access-controls/add-metadata-step2.png" />
|
||||||
</Step>
|
</Step>
|
||||||
<Step title="Add metadata via key and value">
|
<Step title="Add metadata via key-value pairs and update the identity.">
|
||||||
<img src="images/platform/access-controls/add-metadata-step3.png" />
|
<img src="images/platform/access-controls/add-metadata-step3.png" />
|
||||||
</Step>
|
</Step>
|
||||||
</Steps>
|
</Steps>
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab title="Automatically populate metadata">
|
<Tab title="Automatically Populate Metadata">
|
||||||
For organizations using SAML for login, Infisical automatically maps metadata attributes from SAML assertions.
|
For organizations using SAML for login, Infisical automatically maps metadata attributes from SAML assertions to user identities.
|
||||||
This makes it easy to create policies that dynamically adapt based on the SAML user’s attributes.
|
This makes it easy to create policies that dynamically adapt based on the SAML user’s attributes.
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
@@ -40,26 +40,26 @@ Attribute based access control is currently available for polices defined on pro
|
|||||||
|
|
||||||
<img src="images/platform/access-controls/example-abac-1.png" />
|
<img src="images/platform/access-controls/example-abac-1.png" />
|
||||||
|
|
||||||
ABAC policies make use of identity metadata to define dynamic permissions.
|
ABAC policies make use of identity metadata to define dynamic permissions. Each attribute must start and end with double curly-brackets `{{ <attribute-name> }}`.
|
||||||
The following attributes are available within project permissions. Each attribute much begin `{{` and end with `}}`.
|
The following attributes are available within project permissions:
|
||||||
|
|
||||||
- **User ID**: `{{ identity.id }}`
|
- **User ID**: `{{ identity.id }}`
|
||||||
- **Username**: `{{ identity.username }}`
|
- **Username**: `{{ identity.username }}`
|
||||||
- **Metadata Attributes**: `{{ identity.metadata.<metadata-key-name> }}`
|
- **Metadata Attributes**: `{{ identity.metadata.<metadata-key-name> }}`
|
||||||
|
|
||||||
During policy execution, these placeholders are first replaced by their actual values then the policy is executed.
|
During policy execution these placeholders are replaced by their actual values prior to evaluation.
|
||||||
|
|
||||||
### Example Use Case
|
### Example Use Case
|
||||||
|
|
||||||
#### Geography-based Access Control
|
#### Location-based Access Control
|
||||||
|
|
||||||
Suppose you want to restrict access to secrets within a folder access based on user geography.
|
Suppose you want to restrict access to secrets within a specific folder based on a user's geographic region.
|
||||||
You could assign a `geography` attribute to each user (e.g., `identity.metadata.geography`).
|
You could assign a `location` attribute to each user (e.g., `identity.metadata.location`).
|
||||||
Then, you can structure your folders to align with this attribute and define permissions accordingly.
|
You could then structure your folders to align with this attribute and define permissions accordingly.
|
||||||
|
|
||||||
For example, a policy might allow access only to folders matching the user's geographic attribute:
|
For example, a policy might restrict access to folders matching the user's location attribute in the following pattern:
|
||||||
```
|
```
|
||||||
/appA/{{ identity.metadata.geography }}
|
/appA/{{ identity.metadata.location }}
|
||||||
```
|
```
|
||||||
With this structure, users can only access folders that correspond to their own geography attribute.
|
Using this structure, users can only access folders that correspond to their configured `location` attribute.
|
||||||
This means that if the users attribute changes due to relocation, no policy needs to be changed to gain access to the new folders.
|
Consequently, if a users attribute changes due to relocation, no policies need to be changed to gain access to the folders associated with their new location.
|
||||||
|
|||||||
+1
-1
@@ -135,11 +135,11 @@
|
|||||||
"pages": [
|
"pages": [
|
||||||
"documentation/platform/access-controls/overview",
|
"documentation/platform/access-controls/overview",
|
||||||
"documentation/platform/access-controls/role-based-access-controls",
|
"documentation/platform/access-controls/role-based-access-controls",
|
||||||
|
"documentation/platform/access-controls/attribute-based-access-controls",
|
||||||
"documentation/platform/access-controls/additional-privileges",
|
"documentation/platform/access-controls/additional-privileges",
|
||||||
"documentation/platform/access-controls/temporary-access",
|
"documentation/platform/access-controls/temporary-access",
|
||||||
"documentation/platform/access-controls/access-requests",
|
"documentation/platform/access-controls/access-requests",
|
||||||
"documentation/platform/pr-workflows",
|
"documentation/platform/pr-workflows",
|
||||||
"documentation/platform/audit-log-streams",
|
|
||||||
"documentation/platform/groups"
|
"documentation/platform/groups"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|||||||
Reference in New Issue
Block a user