Managing Users and Groups (RBAC)

Updated 1 month ago by Chakravarthy Tenneti

Harness provides Role-Based Access Control (RBAC) via User and User Group Account and Application permissions.

Users' login access is managed at the user level, and users' account and application permissions are managed via User Groups.

In this topic:

Visual Summary

Here is an overview of Harness RBAC. It shows how a user is authenticated via its User settings and authorized via its User Group Account and Application Permissions.

Default User Groups

Each Harness account includes default User Groups to help you organize your users. The following table describes the default Harness User Groups.

Default Group

Account Permissions

Application Permissions

Account Administrator

  • Create/Delete Application
  • Manage Users & Groups
  • Manage Template Library
  • Administer Other Account Functions
  • All Permission Types
  • All Applications
  • Actions: Create, Read, Update, Delete, Execute Pipeline, and Execute Workflow

Production Support

No Account Permissions

  • Pipelines: All Applications; Filters: Production Pipelines; Actions: Create, Read, Update, Delete
  • Services: All Applications; Filters: All Services; Actions: Create, Read, Update, Delete
  • Provisioners: All Applications; Filters: All Provisioners; Actions: Create, Read, Update, Delete
  • Environments: All Applications; Filters: Production Environments; Actions: Create, Read, Update, Delete
  • Workflows: All Applications; Filters: Workflow Templates, Production Workflows; Actions: Create, Read, Update, Delete
  • Deployments: All Applications; Filters: Production Environments; Actions: Read, Execute Pipeline, Execute Workflow

Non-Production Support

No Account Permissions

  • Pipelines: All Applications; Filters: Non-Production Pipelines; Actions: Create, Read, Update, Delete
  • Services: All Applications; Filters: All Services; Actions: Create, Read, Update, Delete
  • Provisioners: All Applications; Filters: All Provisioners; Actions: Create, Read, Update, Delete
  • Environments: All Applications; Filters: Non-Production Environments; Actions: Create, Read, Update, Delete
  • Workflows: All Applications; Filters: Workflow Templates, Non-Production Workflows; Actions: Create, Read, Update, Delete
  • Deployments: All Applications; Filters: Non-Production Environments; Actions: Read, Execute Pipeline, Execute Workflow

To Add Users

The following procedure adds a new user to a Harness account.

There is no limit to the number of users you may add. Harness Community Edition support 5 users.

To add a user, do the following:

  1. Click Security, and click Access Management.
  2. Click Users. The Users page appears.
  3. Click Add User. The Add User dialog appears.
  4. Enter the email address(es) that user will use to log into the Harness platform.
  5. If you have User Groups defined, select the User Groups for this user. You can add a user before they are verified. You can also add this user to a group from the group's Add Members dialog when you manage the group.
  6. Click SUBMIT. The user is added. The name provided for the user says user not registered.
    The user will receive a verification email at the address(es) you provided. When the user logs into Harness, the user creates a password, the email address is verified, and the user name is updated.
    You can reset the password in the user's information in Users.

To Add a User Group

The following procedure creates a new User Group and defines permissions for its users:

  1. Click Security, and click Access Management.
  2. Click User Groups. The User Groups page appears.
  3. Create the User Group.
    1. Click Add User Group. The Add User Group dialog appears.
    2. Enter a name and description for the new User Group, and click SUBMIT. The management page for the new group appears.
  4. Add users to the group.
    1. Click Member Users. The Add Members dialog appears.
    2. Click in the text area and select the members for the group, and then click SUBMIT. The Member Users section of the group page is updated with the new members.
  5. Set Account Permissions.
    1. In Account Permissions, enable one or more of the account permissions for this group. For most users, you will enable only the Create/Delete Application permissions. For more information, see Permissions.
  6. Add Application Permissions.
    1. Click Add Permissions. The Add Application Permission dialog appears.
    2. In Permission Type, select the permissions to apply to the group. These are the Harness components you want the group's members to use. For example, if you click Services, you can then use the Filter field to select the services on which the permission will apply. (For details, see Permissions below.)
    3. In Application, select the applications where the permission will apply.
    4. In Filter, select the entities (within the applications you selected in Application) that the group can use.
    5. In Action, select the action(s) you want to authorize the group to perform.
    6. Click SUBMIT. The User Groups page's Application Permissions section is updated.

Permissions Overview

Both sets of Permissions—Account Permissions and Application Permissions—are set on each group. Before setting these permissions, it's important to understand how they interact with each other:

  • Account permissions affect the high-level permissions for the users in a group, such as the ability to add an application, manage users and groups, and manage their account.
  • Application permissions affect the low-level permissions for the users in a group, such as the ability to place Usage Scope on a secret that applies to a specific service.

For most users, you will want to apply Application permissions. Account permissions are primarily for administration.

Permissions Are Additive

When a Harness User is a member of two of more User Groups, that user's permissions are a union (a combination) of both User Groups' permissions.

Permissions Example

A user group might have the Account permission to add an application, but only the Application permission to add services:

Users in this group will be able to create applications and add Services to them, but not will not be able to add Environments, Workflows, or other Application components.

Account Permissions

Account-level permissions are enabled in each User Group page, under Account Permissions.

Account permissions enable the following Harness features:

Account Permission

Details

Manage Applications

You can create, update, and delete Applications in your account. For the group to add entities to the Application, you must add Application Permissions.

View Users and User Groups

Read-only permission for the Users and User Groups in Access Management.

Manage Users and Groups

Create, update, and delete Users and User Groups.

Manage Template Library

Create, update, and delete Account Level Templates in the Template Library.

See Use Templates.

Administer Other Account Functions

Create, update, and delete Application Defaults. See Create Default Application Directories and Variables.

View Audit Trail

View the Audit Trail events. See Audit Trail.

Create Custom Dashboards

Create Custom Dashboards.

Without this permission, you can still view and operate on a dashboard that has been shared with you.

See Custom Dashboards Overview.

Manage Custom Dashboards

Manage Custom Dashboards.

Without these permissions, you can still view and operate on a dashboard that has been shared with you.

See Custom Dashboards Overview.

Manage Tags

Create, update, and delete Tags (key/value pairs) that can be attached to Application components, and impose Allowed Values restrictions on Tags.

See Using Tags.

Manage Config as Code

Enable Git Sync for Harness Accounts and Applications. See Harness Account-Level Git Sync and Harness Application-Level Git Sync.

You can also make changes using the Configuration as Code UI option (</>). See Edit Harness Components as YAML.

Manage Cloud Providers

Create, update, and delete Cloud Providers. If this permission is not enabled, the users within the user groups will be able to only view the Cloud Providers and their settings.

See Add Cloud Providers.

Manage Connectors

Create, update, and delete Connectors (Artifact Servers, Source Repo Providers, Verification Providers, and Collaboration Providers).

If this permission is not enabled, the Users within the User Groups will be able to only view the Connectors.

See Connectors Overview.

Manage Application Stacks

Create, update, and delete Application Stacks. See Add Application Stacks.

Manage Alert Notification Rules

Create, update, and delete the notification alert settings configured for the account. See Manage Alert Notifications.

Manage Secrets Managers

Add, update, and delete Secrets Managers. If this permission is not enabled, the users within the user groups will be able to only view the list of Secrets Managers.

See Add a Secrets Manager and Scope Secret Managers to Applications and Environments.

Manage Secrets

Add secrets for Account-level settings (Cloud Providers, Connectors, etc) and any Applications on which the user has the Application Permissions Create, Read, Update.

If this permission is not enabled, the users within the User Groups will be able to view the secrets only (Encrypted Text and Encrypted Files).

Secret Usage Scope: The Applications and Environments in a secret's Usage Scope must match the User Group Application Permissions' Applications and Environments. To use a secret, the Application Permission must be Update.

Secrets in Delegate Profiles: If you have Manage Secrets enabled, you can use the Scope to Account feature of encrypted text and files secrets, and use those secrets in Delegate Profiles for usernames, passwords, etc. See Using Secrets in a Profile.

See Managing Harness Secrets.

Manage Authentication Settings

Configure Authentication Settings.

See Authentication Settings.

Manage IP Whitelist

Configure IPs to be whitelisted.

See IP Whitelist Management.

Manage API Keys

Create, update, and delete API Keys.

See API Keys

CE Admin

Enables the User Group members to administer CE for the account.

Permissions include enabling CE, creating CE Explorer reports and budgets, and subscribing users to receive email reports.

See Continuous Efficiency Overview.

CE Viewer

View CE Explorer reports. See Continuous Efficiency Overview.

Soon the CE Viewer permission will enable users to subscribe people to CE email reports (not CE Explorer reports). This functionality is pending.

Manage Pipeline Governance Standards

Create, update, and delete Pipeline Governance Standards. See Pipeline Governance.

Manage Deployment Freezes

Create, update, and delete Deployment Freeze windows. See Deployment Freeze and Pause All Triggers using Deployment Freeze.

Manage Delegates

Enables User Group members to add, update, and configure Harness Delegates for the account.

Manage Delegate Profiles

Enables User Group members to add, update, and configure Delegate Profiles.

Application Permissions

Application permissions enable you to perform any activity on an Application level. This includes applying Secrets Management and some Account settings to specific Applications and Environments, via Usage Scope. It also includes adding and modifying Tags on Application components.

Enable Application Permissions

To enable a User Group to manage an Application, add Application Permissions for the Application, and include the Create, Read, Update, and Delete permissions as required. These permissions are called Actions in Application Permissions.

Deploying Workflows and Pipelines

To enable a User Group to deploy Workflows and Pipelines, you must use the Deployments Permission Type.

The Workflows and Pipelines Permission Types are used for Create, Read, Update, and Delete permissions.

Restricting Usage

You can restrict who can apply settings—such as Secrets Management and some Account settings—to specific Application entities. These are set up in the Usage Scope section of the corresponding setting's dialog. For example, here is the Usage Scope section of an Artifact Server dialog:

In this case, the Artifact Server may be used by the ExampleApp Application in both K8s-GCP and dev Environments.

For a User to modify Usage Scope, the User must belong to a Group that has read and update Application permissions for the Application and components on which the restrictions are placed.

  1. In Usage Scope, click the drop-down under Applications, and click the name of the Application.
  2. In Environments, click the name of the Environment.

Production and Non-Production Pipelines and Permissions

You can filter the permissions to include either a Production Pipeline or a Non-production Pipeline.

When a Pipeline contains only all non-production stages, it is called as a Non-production Pipeline.

If a non-production environment is selected for the permission, the user will be able to trigger the pipeline as long as all the stages are deployed to non-production environments.

If a Pipeline has both non-production and production stages, the user needs to have access to all the production and non-production Environments to be able to trigger the Pipeline.

Permissions and Configure as Code

Permissions for Harness Configure as Code YAML files are the same as those for the Harness Manager UI.

For example, to edit the YAML for a Harness Application, the User Group Account and Application permissions must be as follows:

  • Account Permissions: A user's Harness User Group must have the Account Permission Manage Applications enabled.
  • Applications Permissions: A user's Harness User Group must have the Application Permission Update enabled for the specific Applications.


How did we do?