Manage user accounts
Let’s learn how to manage users on SPEKTRA Edge.
SPEKTRA Edge offers the Identify and Access Management (IAM) framework for the user management, which is based on the Role-Based Access Control (RBAC) mechanism. In other words, you apply the certain role or roles to the users or groups, which is called the role binding, to give the certain permissions to the particular individual or group of individuals.
It also has a concept of scope of role binding, which is that the permissions for the particular role only applicable in the certain scope. This means that the role binding happened at the project is only effective under that project, or sub-projects if those available, but not others, like parent projects.
This means that you can create a really powerful and effecive user management mechanism with the well-organized projects or organization structure.
User authentication
The role-binding process is one side of the whole user management process on SPEKTRA Edge. The other side is the user authentication.
There is no order dependency between the two but it just needs to happen to let users have access to SPEKTRA Edge.
What you need
To grant access to users and groups, you need the followings.
- an access to the SPEKTRA Edge dashboard
- an active project
Grant access to users
First, let’s learn how to grant access to users on SPEKTRA Edge.
Click the Grant access button in the Manage resources and access of this project blue bar on the Project overview page, which will ask you following things:
- the E-mail address of the person you want to give access to the project
- the role to be assigned to the person.
Selecting the role for the user in the Grant access to project dialog on the Project overview page.
Now, let’s learn what those user roles mean and what kind of operations can be granted for each role next.
Roles
Here is the pre-existing user roles offered by SPEKTRA Edge.
| Role name | Resource name | Permissions |
|---|---|---|
| Owner | scope-admin | All operations on core and third party services |
| Admin operator | admin-operator | All operations on core services |
| Device operator | devices-operator | All operations on device and applications services |
| Application operator | apps-operator | All operations on applications services |
| Viewer | viewer | Read-only operations on core services |
The owner role has full access to the services offered by SPEKTRA Edge under particular scope.
The admin operator role is similar to the owner role but does not have an access to the third-party services, for example the watchdog service offered by Service Experience Insight. This is a good role for someone who manages the entire service, e.g., user management.
The devices and application operator roles are both for the application management. The devices operator role is good for someone who manages both devices and applications but the application operator is for the application management only.
The viewer role doesn’t have any write access but have read access to core services. This is a good role for someone who only monitors or observes core services.
Organize users by groups
You can create a group to manage multiple users in one-shot.
One good example of the group usage is to grant access to multiple users in a single operation, as explained in the following section.
To create a group, click the Create group button on the Project overview page and fill in the required information, such as the name and the region, as well as the E-mail addresses of the members managed in the group.
Creating Your team group under Your project.
Grant access to groups
You can grant access to the group, which is a great way to grant access to multipe users in the efficient fashion.
To do that, use the group E-mail address to grant access instead of the individual person’s E-mail. The group E-mail address is constructed by SPEKTRA Edge with the following convention.
[Group name] @ [Project name] .groups.iam.edgelq.com
You can also get the group E-mail address on the groups overview page under your project.
The group E-mail address on the groups overview page.
Grant access by clicking the Grant access button on the Project overview page. Give the group E-mail address, your-team@your-project.groups.iam.edgelq.com for this example, and the role you want to grant access to the group.
Granting access to the group with the group’s E-mail address.
You can check the roles for the group members by going to the Access page under the IAM section. You can see all the group members have the same role of the group’s role.
All the group members have the same role of the group’s one.
Group role binding
It takes a while, a minute or two, before the role binding completes on the group members because it is done by the SPEKTRA Edge controllers behind- the-sceans in the eventual consistency fashion.Next step
Congratulations on understanding how to manage users on SPEKTRA Edge.
With the power of the scope based role binding, you can conduct the user management with achieving the high security standard.
The role binding is one side of the user management coin. The other side of the user management is the user sign-up and sign-in.
Let’s dive in the user authentication to understand the full picture of the user management on SPEKTRA Edge.
