Access control

Default roles

TCM comes with default roles that cover three common usage scenarios:

• Super Admin Role is a default role with all available administrative permissions. Additionally, the users with this role automatically gain all cluster permissions to all clusters.
• Cluster Admin Role is a default role for cluster administration. It includes administrative permissions for cluster management.
• Default User Role is a default role for working with clusters. It includes basic administrative read permissions that are required to log in to TCM and navigate to a cluster.

Managing roles

Administrators can create new roles, edit, and delete existing ones.

Roles are listed on the Roles page.

To create a new role, click Add, enter the role name, and select the permissions to include in the role.

To edit an existing role, click Edit in the Actions menu of the corresponding table row.

To delete a role, click Delete in the Actions menu of the corresponding table row.

Default admin

There is one default user Default Admin. It has all the available permissions, both administrative and cluster ones. When new clusters are added in TCM, Default Admin automatically receives all cluster permissions for them as well.

Managing users

Administrators can create new users, edit, and delete existing ones.

The tools for managing users are located on the Users page.

To create a user:

1. Click Add.
2. Fill in the user information: username, full name, and description.
3. Generate or type in a password.
4. Select roles to assign to the user.
5. Add clusters to give the user access to, and select cluster permissions for each of them.

To edit a user, click Edit in the Actions menu of the corresponding table row.

To delete a user, click Delete in the Actions menu of the corresponding table row.

Changing your password

To change your own password, click your name in the top-right corner and go to Settings > Change password.

Changing users“ passwords

Administrators can manage a user’s password on this user’s Secrets page. To open it, click Secrets in the Actions menu of the corresponding Users table row.

To change a user’s password, click Edit in the Actions menu of the corresponding Secrets table row and enter the new password in the New secret key field.

Password expiry

Passwords expire automatically after the expiration period defined in the password policy. When a user logs in to TCM with an expired password, the only action available to them is a password change. All other TCM functions and objects are unavailable until the new password is set.

Administrators can also set users“ passwords to expired manually. To set a user’s password to expired, click Expire in the Actions menu of the corresponding Secrets table row.

Blocking passwords

To forbid users“ access to TCM, administrators can temporarily block their passwords. A blocked password can’t be used to log into TCM until it’s unblocked manually or the blocking period expires.

To block a user’s password, click Block in the Actions menu of the corresponding Secrets table row. Then provide a blocking reason and enter the blocking period.

To unblock a blocked password, click Unblock in the Actions menu of the corresponding Secrets table row.

Password policy

Password policy helps improve security and comply with security requirements that can apply to your organization.

You can edit the TCM password policy on the Password policy page. There are the following password policy settings:

• Minimal password length.
• Do not use last N passwords.
• Password expiration in days. Users“ passwords expire after this number of days since they were set. Users with expired passwords lose access to any objects and functions except password change until they set a new password.
• Password expiration warning in days. After this number of days, the user sees a warning that their password expires soon.
• Block after N login attempts. Temporarily block users if they enter their username or password incorrectly this number of times consecutively.
• User lockout time in seconds. The time interval for which users can’t log in after spending all failed login attempts.
• Password must include. Characters and symbols that must be present in passwords:
  • Lowercase characters (a-z)
  • Uppercase characters (A-Z)
  • Digits (0-9)
  • Symbols (such as !@#$%^&*()_+№»“:,.;=][{}`?>/.)

Enabling ACL for a user

To granularly manage a user’s access to particular objects in a cluster, enable the use of ACL in the user profile:

1. Go to Users and click Edit in the Actions menu of the corresponding table row.
2. In the user’s Clusters list, add a cluster on which you want to use ACL or click the pencil icon if the cluster is already on the list.
3. Select the Use Access Control List (ACL) checkbox and save changes.
4. Repeat two previous steps for each cluster on which you want to use ACL for this user.
5. Click Update to save the user account.

If the user doesn’t exist yet, you can do the same when creating it.

Managing ACL

The tools for managing ACL are located on the ACL page.

To add an ACL entry:

1. Click Add.
2. Select a user to which you want to grant access.
3. Select a cluster that stores the target object: a space or a function.
4. Select the target object type and enter its name.
5. Select the privileges you want to grant.

To delete an ACL entry, click Delete in the Actions menu of the corresponding table row.

Managing API tokens

To create a TCM API token:

1. Open the user settings by clicking the user’s name in the top-right corner.
2. Go to the API tokens tab and click Add.
3. Specify the token expiration date and an optional description and click Add.

The created token is shown in a dialog.

To delete an API token, click Delete in the actions menu of the corresponding API tokens table row.

Administrators can also view information about users“ API tokens and delete them on the Secrets page. To open a user’s secrets, click Secrets in the Actions menu of the corresponding Users table row.

Administrative permissions

The following administrative permissions are available in TCM:

Cluster permissions

The following cluster permissions are available in TCM: