improvement: minor doc adjustment and add new page to sidebar

This commit is contained in:
Scott Wilson
2024-10-29 14:45:38 -07:00
parent 89a4fc91ca
commit 1986fe9617
2 changed files with 20 additions and 20 deletions
@@ -7,30 +7,30 @@ Infisical's Attribute-based Access Controls (ABAC) allow for dynamic, attribute-
ABAC policies use metadata attributes—stored as key-value pairs on identities—to enforce fine-grained permissions that are context aware. ABAC policies use metadata attributes—stored as key-value pairs on identities—to enforce fine-grained permissions that are context aware.
In ABAC, access controls are defined using metadata attributes, such as location or department, which can be set directly on user or machine identities. In ABAC, access controls are defined using metadata attributes, such as location or department, which can be set directly on user or machine identities.
During policy execution, these attributes are evaluated, and determine whether said actor can gain access to requested resource. During policy execution, these attributes are evaluated, and determine whether said actor can access the requested resource or perform the requested operation.
## Project-level Permissions ## Project-level Permissions
Attribute based access control is currently available for polices defined on projects. You can set ABAC permissions to control access to environments, folders, secrets, and secret tags. Attribute-based access controls are currently available for polices defined on projects. You can set ABAC permissions to control access to environments, folders, secrets, and secret tags.
### Setting Metadata on Identities ### Setting Metadata on Identities
<Tabs> <Tabs>
<Tab title="Manually configure metadata"> <Tab title="Manually Configure Metadata">
<Steps> <Steps>
<Step title="Navigate to access control at the organizations setting and choose a identity (user or machine)"> <Step title="Navigate to the Access Control page on the organization sidebar and select an identity (user or machine).">
<img src="images/platform/access-controls/add-metadata-step1.png" /> <img src="images/platform/access-controls/add-metadata-step1.png" />
</Step> </Step>
<Step title="Click on the pencil to edit the selected identity"> <Step title="On the Identity Page, click the pencil icon to edit the selected identity.">
<img src="images/platform/access-controls/add-metadata-step2.png" /> <img src="images/platform/access-controls/add-metadata-step2.png" />
</Step> </Step>
<Step title="Add metadata via key and value"> <Step title="Add metadata via key-value pairs and update the identity.">
<img src="images/platform/access-controls/add-metadata-step3.png" /> <img src="images/platform/access-controls/add-metadata-step3.png" />
</Step> </Step>
</Steps> </Steps>
</Tab> </Tab>
<Tab title="Automatically populate metadata"> <Tab title="Automatically Populate Metadata">
For organizations using SAML for login, Infisical automatically maps metadata attributes from SAML assertions. For organizations using SAML for login, Infisical automatically maps metadata attributes from SAML assertions to user identities.
This makes it easy to create policies that dynamically adapt based on the SAML user’s attributes. This makes it easy to create policies that dynamically adapt based on the SAML user’s attributes.
</Tab> </Tab>
</Tabs> </Tabs>
@@ -40,26 +40,26 @@ Attribute based access control is currently available for polices defined on pro
<img src="images/platform/access-controls/example-abac-1.png" /> <img src="images/platform/access-controls/example-abac-1.png" />
ABAC policies make use of identity metadata to define dynamic permissions. ABAC policies make use of identity metadata to define dynamic permissions. Each attribute must start and end with double curly-brackets `{{ <attribute-name> }}`.
The following attributes are available within project permissions. Each attribute much begin `{{` and end with `}}`. The following attributes are available within project permissions:
- **User ID**: `{{ identity.id }}` - **User ID**: `{{ identity.id }}`
- **Username**: `{{ identity.username }}` - **Username**: `{{ identity.username }}`
- **Metadata Attributes**: `{{ identity.metadata.<metadata-key-name> }}` - **Metadata Attributes**: `{{ identity.metadata.<metadata-key-name> }}`
During policy execution, these placeholders are first replaced by their actual values then the policy is executed. During policy execution these placeholders are replaced by their actual values prior to evaluation.
### Example Use Case ### Example Use Case
#### Geography-based Access Control #### Location-based Access Control
Suppose you want to restrict access to secrets within a folder access based on user geography. Suppose you want to restrict access to secrets within a specific folder based on a user's geographic region.
You could assign a `geography` attribute to each user (e.g., `identity.metadata.geography`). You could assign a `location` attribute to each user (e.g., `identity.metadata.location`).
Then, you can structure your folders to align with this attribute and define permissions accordingly. You could then structure your folders to align with this attribute and define permissions accordingly.
For example, a policy might allow access only to folders matching the user's geographic attribute: For example, a policy might restrict access to folders matching the user's location attribute in the following pattern:
``` ```
/appA/{{ identity.metadata.geography }} /appA/{{ identity.metadata.location }}
``` ```
With this structure, users can only access folders that correspond to their own geography attribute. Using this structure, users can only access folders that correspond to their configured `location` attribute.
This means that if the users attribute changes due to relocation, no policy needs to be changed to gain access to the new folders. Consequently, if a users attribute changes due to relocation, no policies need to be changed to gain access to the folders associated with their new location.
+1 -1
View File
@@ -135,11 +135,11 @@
"pages": [ "pages": [
"documentation/platform/access-controls/overview", "documentation/platform/access-controls/overview",
"documentation/platform/access-controls/role-based-access-controls", "documentation/platform/access-controls/role-based-access-controls",
"documentation/platform/access-controls/attribute-based-access-controls",
"documentation/platform/access-controls/additional-privileges", "documentation/platform/access-controls/additional-privileges",
"documentation/platform/access-controls/temporary-access", "documentation/platform/access-controls/temporary-access",
"documentation/platform/access-controls/access-requests", "documentation/platform/access-controls/access-requests",
"documentation/platform/pr-workflows", "documentation/platform/pr-workflows",
"documentation/platform/audit-log-streams",
"documentation/platform/groups" "documentation/platform/groups"
] ]
}, },