Skip to main content

Managing Access

This page shows how to give users, user groups and service accounts access to your organization and its projects. For what each role allows, see Roles & Permissions.

Where access is managed​

You read and change access on one page, IAM. The other pages add users, user groups and service accounts, and show their roles.

WhatWhereWho can change it
Who has access to the organization and to every projectChoose your organization in the project switcher, then IAM in the sidebarOrg Admins
The organization's users, user groups and service accountsIn the same sidebar: Users, User groups, Service accountsOrg Admins
Who has access to one projectIn the project, Settings → IAM. Users and Service accounts are next to itThat project's Project Admins, and Org Admins

A page or button you can't use stays visible but locked or disabled. When you hover over it, it names the permission you need, such as access:create (see Permissions).

Your organization and its projects​

Choose your organization in the project switcher to open its home, Projects. It lists every project you can see, your access to each, and how many users hold a role on it. Projects where you hold no role are dimmed and don't open.

The project switcher lists the projects you can open, with your organization at the bottom. When you sign in, Autoheal opens your last project, or your only one. If you have several and none is remembered, it opens your organization's home.

To create a project, choose New project on your organization's home or in the project switcher (Org Admins). You become its Project Admin. To rename a project or edit its description, choose ⋯ → Edit next to it on your organization's home. Or choose ⋯ next to it in the project switcher.

IAM​

The IAM page lists everyone with access, one row each: users, user groups and service accounts. Each row shows every role they hold, where it was given, and where it comes from: Direct, via a user group, or From organization.

  • On your organization's IAM, rows cover the organization and every project.
  • On a project's IAM, rows cover that project, including roles given on the organization, which apply in every project.

Give access​

1
Choose Grant access

On the IAM page, choose Grant access.

2
Pick who

Find users, user groups or service accounts by name or email. To add someone who isn't in your organization yet, type their email address and choose Invite.

3
Pick where and the roles

On your organization's IAM, under Role binding, choose Where: the organization, or one project. In a project, Member is picked for you. Then choose Save.

warning

A role given on the organization applies on the organization and in every project. Read-only reads every project. Project Admin manages every project. To limit someone to one project, pick that project under Where.

Change or remove someone's roles​

On the IAM page, choose ⋯ on their row:

  • Edit roles adds and removes the roles given to them directly. On your organization's IAM, pick where first.
  • Remove role removes one role given directly. To change a role held through a user group, go to the user group. To change a role given on the organization, go to your organization's IAM.
note

Your organization always keeps at least one Org Admin, so you can't remove the last one. Make someone else an Org Admin first. If you remove a project's last Project Admin, Autoheal warns you first. An Org Admin can give the role again.

Users​

Invite users to your organization​

1
Open Users

In your organization's sidebar, open Users.

2
Invite

Choose Invite users and type or paste their emails, separated by commas (up to 20). Under Role binding, choose Where: the organization, or one project.

3
Pick roles, or none

In a project, pick their roles. On the organization you can leave roles empty: they can sign in, but see no project until someone gives them a role. Then choose Save.

They receive an email to configure their account. On a self-hosted (BYOC) installation, Autoheal instead shows you each person's first sign-in password once.

Add users to a project​

1
Open the project's Users

In the project, open Settings → Users.

2
Choose Add users

Find users in your organization by name or email, or type the email of someone new and choose Invite.

3
Pick roles and save

Member is picked for you. Change it if you need to. Then choose Save.

note

A Project Admin can invite only email addresses from your organization's allowed domains. These domains are set on your organization's Authentication page under Just-in-time provisioning → Allowed email domains. While that list is empty, only Org Admins can invite users.

A user's page lists every role they hold and where each comes from. On your organization's Users, it also lists the user groups they're in. You change their roles on IAM. Manage on IAM on their page opens it.

Remove someone from the organization​

On your organization's Users, choose ⋯ → Remove from organization next to them, or the same button on their page. Autoheal deletes their account. Every role they hold ends, and their API tokens stop working. What they built stays. If you use SSO with just-in-time provisioning, remove them in your identity provider first. Otherwise, their next sign-in creates their account again.

User groups​

A user group gives the same roles to everyone in it. User groups belong to the organization, so one user group can hold roles on several projects. Only Org Admins create user groups and change who is in them.

Create a user group​

1
Choose New user group

In your organization's sidebar, open User groups, then New user group.

2
Fill it in

Give the user group a name and description and add its members. You can give it roles now, on the organization or one project, or later on IAM.

3
Create

Choose Create user group.

Change a user group​

Select a user group, or choose ⋯ → View, to open its page:

  • Members: choose Add members, or ⋯ → Remove from user group next to someone.
  • Edit changes its name and description. Delete deletes it, and its members lose the roles they held through it.
  • Roles are listed there. Give and remove them on IAM. A Project Admin gives a user group a role on their project from the project's IAM.
warning

A user group belongs to the whole organization. Delete deletes it everywhere, with every role it holds on every project. To end a user group's role on one project only, remove that role on IAM.

Service accounts​

A service account is an identity for automation. It calls the API with its own keys and acts with its own roles, never yours.

  • Organization service accounts: Org Admins create them in your organization's Service accounts. They can have roles on the organization or one project, or no roles yet.
  • Project service accounts live in one project, and its Project Admins manage them. In the project, open Settings → Service accounts, choose New service account and give it a name and its roles.
  • Make an account's first key with New key on its page. You change its roles on IAM. A Project Admin gives an organization service account a role on their project from the project's IAM.

See API Credentials for keys, rotation and calling the API.

Granting yourself access​

You can give yourself a role wherever you're allowed to manage access, or add yourself to a user group that holds roles. Autoheal records it as a self-grant in the access log and emails the other users who manage access there.

Reviewing access​

  • The IAM pages show everyone with access, one row each, every role with where it was given and where it comes from.
  • A project's Users shows the users with access to it. Your organization's Users shows everyone in the organization with their roles and user groups.
  • The access log records every access change: who gave or removed which role, to whom, where and when. Read it through the API, GET /api/v1/rbac/audit-events, with audit:read on the organization.