Roles and Permissions When SSO Is Configured

Describes the roles supported by the HPE Ezmeral Data Fabric in SSO-enabled clusters.

SSO-configured clusters support the following roles:
Role Permissions ACL Permission Code
Developer (fabric user) Readonly and create volume permission login, cv, cp
Infrastructure Admin Permission to log in and start or stop services login, ss
Fabric Manager Full control of the cluster login, cv, cp, fc

When SSO is not configured, Data Fabric clusters implement permissions through cluster-level access control lists (ACLs). See Creating Cluster-Level ACLs.

When SSO is configured, Data Fabric relies on the roles defined in the JSON web token (JWT). For example:
  "userRoles": [ 
    "default-roles-user46", 
    "offline_access", 
    "admin", 
    "developer", 
    "uma_authorization", 
    "cluster-admin" 
  ],
The LDAP administrator configures these roles when a user is added to LDAP. The roles are then passed into the JWT. You can view the role permissions by issuing the maprlogin print command:
maprlogin print
testcluster: user = mapr, created = 'Fri Mar 10 02:10:34 PST 2023', expires = 'Fri Mar 10 02:30:34 PST 2023', RenewalTill = 'Fri Mar 10 02:30:34 PST 2023', 
uid = 5000, gids = 5000, 5001, CanImpersonate = true, CanGenerateTicket = false, isExternal = true, isRemoteTempTicket = false, capabilities = [login, cv, a, fc]

Data Fabric honors permissions embedded in the JWT first and then honors permissions in cluster-level ACLs.